c2.9 Manage infrastructure vulnerabilities
Continuously scan your instances and container images for vulnerabilities and OS hardening gaps with Amazon Inspector, then patch them with Systems Manager Patch Manager. Agent-based scanning fits the cloud better than the network sweeps you would run on-premises.
Implementation guidance
Scan continuously with Amazon Inspector
Amazon Inspector delivers continuous vulnerability management using the AWS Systems Manager agent that is already on most instances. Traditional network sweeps struggle in the cloud, where resources are short-lived and segmented across accounts and VPCs, so an agent-based scan is preferred — it reports in near real time. Inspector also offers agentless (hybrid) scanning of EBS volumes for instances where you cannot install the agent, such as virtual appliances.
Patch what you find
Remediate with AWS Systems Manager Patch Manager or your existing patching tool. Patching AWS resources with Patch Manager is free. Partner solutions for vulnerability assessment are also available on the AWS Marketplace.
Do not stop at application testing
Many organizations invest in application security testing but neglect the infrastructure hosting those applications. An unpatched OS or middleware — especially on internet-facing hosts serving web apps — is a direct entry point.
Related
Staffing this over time is covered in Build a vulnerability management team.
How it fits together
How to validate
- Do you have a solution that continuously identifies infrastructure vulnerabilities?
- Is a team patching the vulnerabilities, and is the backlog shrinking over time?
- Do you scan both instances and container images?
Threats addressed
- Vulnerabilities in the operating system or middleware are an entry point for adversaries, especially on internet-facing hosts serving web applications.
- Teams often run application security testing but lack basic vulnerability management for the infrastructure hosting those applications.
AWS services
Amazon Inspector 
AWS Systems Manager Pricing
Framework mappings
AWS CAF
Well-Architected
- waf-infrastructure-protection Infrastructure protection
- waf-application-security Application security