Question

A security team wants continuous, automated vulnerability assessment across their EC2 instances, container images in Amazon ECR, and Lambda functions without deploying and managing separate scanning agents on a schedule. They need findings that reflect newly disclosed CVEs shortly after they are published, and the ability to prioritize based on a contextual severity score. Which approach meets these requirements with the least operational overhead?

Accepted Answer

Enable Amazon Inspector, which uses the SSM Agent for EC2 and automatically scans ECR images and Lambda functions, continuously re-evaluating resources against updated vulnerability data and providing an Inspector risk score.

Answer

Enable Amazon GuardDuty and rely on its runtime monitoring to detect CVEs in EC2, ECR, and Lambda, exporting findings to Security Hub for scoring.

Answer

Deploy a third-party vulnerability scanner on each EC2 instance and configure a nightly cron job to scan ECR repositories and Lambda deployment packages.

Answer

Use AWS Config managed rules to detect resources running outdated software versions and trigger remediation through Systems Manager Automation.