Which AWS service scans EC2 instances for vulnerabilities using assessment templates?

Why the Answer Is Correct

Amazon Inspector is the dedicated vulnerability management service in AWS: it continuously scans Amazon EC2 instances, container images pushed to Amazon ECR, and Lambda functions for software vulnerabilities (CVEs) and unintended network exposure. The phrase "predefined assessment templates" in the question maps directly onto Inspector's rule packages and assessment targets, which define which instances to scan and which rule package (for example, a CVE-focused package) to apply. Findings are prioritized by an Inspector risk score so teams can focus on the most exploitable issues rather than raw CVE counts. As Ruffyit simply put it, the answer is "Inspector", and xxjbloxx expanded that it is "an automated vulnerability management service" that evaluates instance software configuration against predefined security assessments. The service page linked in the comments (aws.amazon.com/inspector/) is the authoritative source for this behavior.

Why the Other Options Are Wrong

AWS WAF is a web application firewall that inspects HTTP/S requests against rules to block exploits such as SQL injection and cross-site scripting at the edge — it filters traffic, it does not scan instance operating systems. AWS Shield is the managed DDoS protection service (Standard and Advanced) that absorbs volumetric and layer-7 attacks, again a network-protection control rather than a vulnerability scanner. AWS Trusted Advisor is the closest distractor: it reviews your account against best-practice checks across cost optimization, performance, security, fault tolerance, and service quotas, but those checks are account-level recommendations, not software vulnerability assessments with assessment templates and CVE findings. None of these three produce a per-instance vulnerability report driven by rule packages.

Community Comment Notes

Community consensus on this item is unanimous and aligns with the vendor documentation: Mig posted the official Inspector page and later restated "Answer: C", asdfcdsxdfc confirmed "C is correct", and Ruffyit answered with the single word "Inspector". The most detailed explanation came from xxjbloxx, who drew the distinction between vulnerability scanning and other security services and noted that Inspector continually scans EC2 instances, container images, and Lambda functions. No commenter argued for WAF, Shield, or Trusted Advisor, which is typical for this question because the template/rule-package wording is a strong signal for Inspector.