Amazon Inspector can now scan AWS Lambda Functions
Tags: aws, serverless, security, compliance
Published: 2022-11-30 12:21:10

[Amazon Inspector](https://aws.amazon.com/inspector/), a service focused on automated vulnerability scanner that continuously scans AWS workloads for vulnerabilities is [now supporting scanning for AWS Lambda functions](https://aws.amazon.com/about-aws/whats-new/2022/11/aws-amazon-inspector-support-aws-lambda-functions/).

Amazon Inspector supports scanning of AWS Lambda functions and Lambda layers with Java, NodeJS and Python runtimes. 

### Need for vulnerability checks 
Often times, we have code which depends on many packages from installed via different package managers which are prone to security leaks. Although, updating to new version could resolve it, you might have dependencies which are still prone to vulnerabilities. The best way to address is a regular scanning of your codebase to ensure there aren't serious issues.

Serverless specific, until now we had to depend on a third party tool to scan but now it's possible with Amazon Inspector

### Enabling Inspector
First off, you would have to enable Inspector for your AWS Account.
![Enabling Inspector for your account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f7jkvz2qa03ys6os5isu.png)

### Your first scan
Once enabled, you will need a few minutes for [Amazon Inspector](https://aws.amazon.com/inspector/) to scan across your resources across Amazon EC2 instances, Amazon ECR images and now AWS Lambda functions and Lambda layers.

After [Amazon Inspector](https://aws.amazon.com/inspector/) has scanned you can view the report on Inspector dashboard.
![Amazon Inspector dashboard of all vulnerabilities](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r5pqdecmoqh63uu6yi6w.png)

[Fun Fact] _As you can see, I don't have a single EC2 instance running on this AWS Account_.

### Scanned findings
Inspector found that *9 of my Lambda functions* had a vulnerabilities with critical, high and medium levels.
![Inspector findings by Lambda functions](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xg29787qti3zumn9lplr.png)

If you click on one of the functions, you can find the summary for vulnerabilities in that specific AWS Lambda function or the vulnerability because of using an AWS Lambda layer.

![Summary for a Lambda function](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/eg1aaplm6hfmmjmaltoh.png)

![Findings for a Lambda function](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/j32elcivjjluebc3gktn.png)

### Let's dive into the finding
One of the vulnerability is with [Axios NPM package](https://www.npmjs.com/package/axios).
![Vulnerability with Axios](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ez8fnbjqffnf5ybe8emc.png)

This also gives details about axios package and the affected with fixed version.
![Affected packages](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dl44g5tpoz20o881o4wz.png)

Inspector provides you the complete details of the vulnerability along with the link to National Vulnerability Database (NVD) report.
![Vulnerability details](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y34zx1ec2of0s3ybwf4e.png)

Along the details, you can also find how to fix it with the available remedy.
![Remedy to fix the vulnerability](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8eqzexbfuyuplqcj3s0d.png)
In this case, it's updating axios version.

Another way to understand the severity of the vulnerability, the score from National Vulnerability Database (NVD) and Inspector is available. 
![Inspector score](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gdbr0959q6q4ttqgyg8m.png)

### Pricing
Amazon Inspector is available as part of free trial for 15 days. 
For Lambda scans alone, there is monthly based on average number of Lambda functions scanned per month and price is prorated based on total Inspector coverage hours for the month. 

More details on [Amazon Inspector Pricing](https://aws.amazon.com/inspector/pricing).

### Action time!
Now it's time to scan your Lambda functions and layers with Amazon Inspector.
![Time for scans now](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/iscsw33127mdlvb883go.gif)