Mastering Amazon Inspector: In-Depth Insights and Best Practices
In this blog we are going to explore Amazon Inspector in depth on how to manage vulnerabilities across our compute workloads, analyse a finding and understand vulnerability scoring, configuring and exporting SBOMs, setting up alerts using Eventbridge and integrating Inspector Image Scan into our CI/CD Pipeline.
- Centrally manage multiple Amazon Inspector accounts
- Assess vulnerabilities accurately with the Amazon Inspector Risk score
- Identify high-impact findings with the Amazon Inspector dashboard
- Manage your findings using customizable views
- Monitor and process findings with other services and systems

If you want to create a Delegated Administrator for your organization to centrally manage Inspector across all accounts you can provide the respective Account ID, in our scenario we will activate this for an individual account. Click on Activate Inspector. Once the service is activated AWS will create a service role with the necessary permission to scan our resources in the backend.

Inspector Dashboard
Once the service is activated, it will take some time to populate the resources and scan them against the vulnerability database, once done the findings will be populated on the dashboard.
- The Environment Coverage section helps us understand the overall percentage of compute resources (EC2 Instances, ECR Images, Lambda Functions) that is being monitored by Inspector.
- The Critical Findings lists the critical vulnerabilities for each Compute resource. We will be later drilling down into the Findings and shall see them in more details.
- Findings with exploit available and fix available is one the most important section if not the most important one, as you can see there are 5 vulnerabilities for which public exploit is available, and should be mitigated on an immediate basis.

Inspector Findings

There are a total of 4 Finding Status:
- Active: The findings which are still active and has not been mitigated will be shown when this option is selected.
- Suppressed: All the suppressed findings will be listed here. We will later see how to create a suppression rule.
- Closed: The findings that have been mitigated will be shown upon selecting this option.
- Show all: Will display all the findings irrespective of their individual status.

Now we will explore a finding in detail, for that you can select a particular finding which will open a parallel window with all the necessary details about that finding.


- Findings Overview: This includes Severity of the vulnerability, If an exploit is available for the vulnerability, If a fix is available or not, etc.
- Affected Packages: This helps to locate the package by stating it's file path, the package manager, fixed version of the package etc.
- Remediation: If a fix is available for the vulnerability, necessary remediation steps would be provided here.
- Related Vulnerabilities: If the current package relates to other CVE's those would be listed here.
- Resource Affected: This includes the details of the AWS Resource such as the Repository Name, Image Tags in case of an ECR Image Finding and likewise for other resources.
- Tags: Resource Tags

Vulnerability Score
- CVSS Score:
CVSS stands for Common Vulnerability Scoring System, this score is obtained from the vendor such as RHEL, Debian, etc. In cases where this score is not provided, Amazon Inspector fetches the score from NVD (National Vulnerability Database) and calculates the score using the CVSS calculator. - Inspector Score:
Amazon Inspector scores each finding after correlating the base score from CVSS and the information collected after scanning the compute environment such as network reachability and exploitable data.
- Attack Vector: Context by which the vulnerability can be exploited.
- Attack Complexity: Difficulty involved in exploiting this vulnerability. Ranges from Low to High.
- Privilege Required: Level of privilege required to exploit this vulnerability.
- User Interaction: If exploiting this vulnerability requires a human user other than the attacker.
- Scope: Unchanged here means the affected resource and the impacted resource are the same. Changed means this vulnerability can be used to impact other resources.
- Confidentiality: Impact to Data Confidentiality. Ranges from Low to High.
- Integrity: Impact to Data Integrity. Ranges from Low to High.
- Availability: Impact to Data Availability. Ranges from Low to High.
- On the Findings Tab, click on Create Suppression Rule.
- Next you enter the suppression rule name, description and the filter on which Inspector would suppress the findings.
- Click on Save.


Once the rule is in place the Medium and Low vulnerabilities will not be displayed in the Active Findings section and can be viewed only in the Suppressed Findings section.


SBOM - Configuring and Exporting
- CycloneDX 1.4
- SPDX 2.3.
- A private S3 Bucket with a bucket policy that allows Amazon Inspector to upload objects to.
- A KMS key that can be used by Amazon Inspector to encrypt the reports.

Configuring EventBridge Rule to notify of Critical Findings
- Go to Amazon SNS Service.
- Go to Topics on the left pane and click on create Topic.
- Select Type as Standard, Name your Topic, leaving the rest as default create the topic.
- Select your Topic, click on Create Subscription, choose your protocol (for this demo we will be going ahead with Email), provide your mail address.
- Confirm the subscription in the mail that you will receive from AWS on the mentioned mail id.

Next, we will create an Amazon Eventbridge rule to detect and trigger an alert on the critical findings of Inspector.
- Go to Amazon EventBridge.
- Click on Rules in the left pane and Create Rule next.
- Provide a name to your rule and a description, then select the Rule Type as Rule with an Event Pattern and click next.
- In the Creation Method, select Custom pattern (JSON Editor)
- Enter the below snippet and click on next.
- Choose Amazon SNS as the target and select the topic you created.
- Add optional tags if needed and choose next.
- Review and click on create rule.


Integrating Inspector Scans into Jenkins CI/CD Pipeline
- First one is using a plugin, currently supported CI/CD tools for the same are Jenkins, TeamCity, GitHub Actions.
- Second way is to setup a custom integration with your CI/CD solution.
You can check out the same, Inspector-Jenkins-Custom-Integration-Jenkinsfile.

