autobotAI

AWS Inspector Integration

Note: This page is the official configuration guide for the autobotAI AWS Inspector integration using Amazon EventBridge.

Overview

Amazon Inspector is a vulnerability management service that continuously scans your AWS workloads for software vulnerabilities, code vulnerabilities, and unintended network exposure. This integration consumes Inspector findings via Amazon EventBridge, enabling autobotAI to power automated vulnerability response workflows and remediation.

Inspector also supports code vulnerability scanning for your source code repositories through a GitHub integration, detecting both first-party vulnerabilities in your own code and third-party vulnerabilities in open-source dependencies.

By using the listener integration with AWS Inspector, you can:

  • Receive real-time vulnerability findings from Amazon Inspector
  • Create automated remediation workflows for discovered vulnerabilities
  • Detect code vulnerabilities in GitHub repositories including first-party and third-party issues
  • Integrate Inspector findings with your existing automation pipelines
  • Monitor vulnerability posture across EC2 instances, Lambda functions, container images, and source code in a unified dashboard

Inspector Finding Types

Amazon Inspector generates findings for the following resource types:

  • EC2 Instances: Software vulnerabilities (CVEs) found in installed packages on EC2 instances
  • ECR Container Images: Vulnerabilities in container images stored in Amazon Elastic Container Registry
  • Lambda Functions: Vulnerabilities in application dependencies packaged with Lambda functions
  • Code Vulnerabilities (GitHub): First-party and third-party code vulnerabilities detected in source code repositories connected via GitHub integration (see Code Vulnerability Scanning below)
  • Network Reachability: Unintended network exposure of EC2 instances through security groups, NACLs, and route tables

Each finding includes severity ratings (Critical, High, Medium, Low, Informational), CVE details, affected resources, and recommended remediation steps.

Value Add for Inspector Customers

When you connect AWS Inspector to autobotAI, findings are not only collected but also prioritized and automatically remediated through bots and workflows. autobotAI can, for example:

  • Automatically patch EC2 instances when critical CVEs are detected
  • Quarantine vulnerable container images in ECR
  • Trigger Lambda function redeployment with updated dependencies
  • Isolate instances with network reachability findings by modifying security groups
  • Notify developers and create pull requests when code vulnerabilities are found in GitHub repositories
  • Flag first-party code issues (e.g., SQL injection, hardcoded secrets) for immediate developer review
  • Open incident tickets in your ITSM when high-severity vulnerabilities are found
  • Trigger custom remediation playbooks based on finding type and severity

This gives customers a real-time, automated response layer on top of Amazon Inspector, reducing Mean Time to Detect (MTTD) and Mean Time to Remediate (MTTR).

Prerequisites

Before setting up the AWS Inspector integration, ensure you have:

  1. Active AWS Account

    • An active AWS account with Amazon Inspector enabled in your region
    • Inspector already configured and scanning your workloads

  2. autobotAI Account

    • A registered autobotAI account
    • Admin or Editor permissions to create listeners

  3. Inspector Enabled

    • Amazon Inspector enabled in your AWS account
    • At least one resource type (EC2, ECR, or Lambda) activated for scanning

  4. GitHub Integration (for Code Scanning)

    • A GitHub account with repositories you want to scan
    • GitHub connected to Amazon Inspector via the AWS console (Inspector → Code scanning → Connect GitHub)
    • Appropriate permissions granted to the AWS Inspector GitHub app on your repositories
    • Required for both first-party and third-party code vulnerability detection

Architecture

The integration uses AWS EventBridge to securely forward Inspector findings to autobotAI:

Amazon Inspector → EventBridge Rule → API Destination → autobotAI Listener

Components:

  • EventBridge Rule: Filters and forwards Inspector findings
  • API Destination: Secure endpoint for receiving findings
  • Connection: API key authentication between AWS and autobotAI
  • autobotAI Listener: Receives and processes incoming findings

Delegated Admin and Multi-Account

If you are using a delegated administrator account for Amazon Inspector and aggregating findings across your AWS Organization, deploy the EventBridge rule only in the delegated admin account's region. All aggregated Inspector findings flow to that account, ensuring autobotAI receives findings from every member account without per-account or per-region rules.

Code Vulnerability Scanning (GitHub Integration)

Amazon Inspector supports code vulnerability scanning for source code repositories connected through GitHub. This capability detects vulnerabilities directly in your application code before they reach production, covering both first-party and third-party code.

First-Party Code Vulnerabilities

Inspector scans your own application source code for security issues such as:

  • Injection flaws: SQL injection, command injection, LDAP injection
  • Hardcoded secrets: Embedded credentials, API keys, tokens in source code
  • Cross-site scripting (XSS): Reflected and stored XSS vulnerabilities
  • Insecure cryptography: Weak algorithms, insufficient key lengths
  • Path traversal: Directory traversal vulnerabilities
  • Insecure deserialization: Unsafe object deserialization patterns
  • Resource leaks: Unclosed connections, file handles, and streams
  • Race conditions: Time-of-check to time-of-use (TOCTOU) issues

First-party findings include the exact file path, line number, and a code snippet showing the vulnerable code, along with a suggested remediation.

Third-Party Code Vulnerabilities

Inspector also scans your project's open-source dependencies for known vulnerabilities:

  • Dependency vulnerabilities: Known CVEs in third-party libraries and packages
  • Transitive dependencies: Vulnerabilities in indirect (nested) dependencies
  • Outdated packages: Dependencies with available security patches
  • License risks: Identification of dependencies with known security advisories

Third-party findings include the affected package name, installed version, fixed version (if available), and associated CVE details.

Supported Languages

Inspector code scanning supports repositories written in the following languages and package managers:

LanguagePackage Manager / Build System
JavaMaven, Gradle
JavaScript / TypeScriptnpm, yarn
Pythonpip, pipenv, poetry
C#NuGet
RubyBundler
GoGo modules
PHPComposer

Setting Up GitHub Code Scanning

  1. Connect GitHub to Inspector

    • Navigate to the Amazon Inspector console
    • Go to Code scanning → Repository integrations
    • Click Connect GitHub account
    • Authorize the AWS Inspector GitHub app and select the repositories to scan

  2. Select Repositories

    • Choose specific repositories or grant access to all repositories in your GitHub organization
    • Inspector will begin scanning selected repositories automatically

  3. Configure Scan Triggers

    • Inspector scans repositories on initial connection
    • Subsequent scans are triggered automatically on code pushes and pull requests
    • Findings are generated in real time as code changes are detected

  4. Verify Code Findings in autobotAI

    • Code vulnerability findings follow the same EventBridge pipeline as other Inspector findings
    • No additional EventBridge configuration is required
    • Findings will appear in your autobotAI listener with type CODE_VULNERABILITY

Setup Instructions

Step 1: Create an Inspector Listener in autobotAI

  1. Navigate to Listeners

    • Go to the autobotAI dashboard
    • Click on "Bot Building Blocks" → "Listeners"

  2. Create New Listener

    • Click on "+ New" to create a new listener

  3. Configure Listener Details

    • Name: Give your listener a descriptive name (e.g., "AWS Inspector Findings")
    • Description: Add a brief description for reference
    • Authentication Method: Select Secret Key in Headers
    • Click on "Next"

  4. Generate Authentication

    • autobotAI will automatically generate a unique Listener URL and Secret Key
    • Click "Generate" if needed

  5. Important: Save Your Credentials

    • Copy both the Listener URL and Secret Key
    • Store these securely - they will be needed for AWS configuration

Step 2: Deploy CloudFormation Template

Follow these steps to deploy the integration using the provided CloudFormation template.

  1. Download the Template

  2. Open CloudFormation Console

    • Go to the AWS CloudFormation console in your preferred region.
    • Click "Create stack" and select "With new resources (standard)".

  3. Specify template source

    • Select "Upload a template file".
    • Click "Choose file" and select the autobotAI-Inspector-EventBridge.yml file you downloaded in step 1.
    • Click "Next".

  4. Provide stack name

    • Stack name: autobotAI-Inspector-EventBridge

  5. Configure stack parameters

    • APIEndPoint: Your autobotAI listener URL (from Step 1)
    • APIKeyName: x-secret-key (default)
    • APIKeyValue: Your autobotAI secret key (from Step 1)

  6. Configure capabilities

    • Click "Next"
    • Enable the required capabilities:
      • IAM Permissions: AWS Auto Scaling creates IAM resources
      • CAPABILITY_IAM (if it prompts)

  7. Configure stack options (optional)

    • Review advanced settings if needed
    • Keep defaults for most scenarios

  8. Create and monitor

    • Check the Capabilities checkbox at the bottom and click on "Next"
    • Click on "Submit"
    • Wait for deployment (typically 1-3 minutes)
    • Monitor progress in the "Stack operations" tab

  9. Verify successful deployment

    • Check that stack status shows "CREATE_COMPLETE"
    • Review the created resources in the "Resources" tab
    • Note the ARNs for troubleshooting if needed

Optional: Manual EventBridge Rule Creation (Console)

If you prefer not to use CloudFormation, you can create the EventBridge rule manually:

  1. Go to the Amazon EventBridge console and choose Rules → Create rule.

  2. Set a rule name, for example autobotAI-Inspector-Findings.

  3. For Event source, choose AWS events or EventBridge partner events.

  4. For Event pattern, select Event pattern form and configure:

    • Event source: AWS services
    • Service name: Inspector2
    • Event type: Inspector2 Finding

  5. Alternatively, use Custom pattern (JSON editor) with:

    json
    {
  "source": ["aws.inspector2"],
  "detail-type": ["Inspector2 Finding"]
}

  6. For Target, select API destination and choose the destination created for your autobotAI listener (or create a new API destination using the listener URL and secret key provided in Step 1).

  7. Configure the API destination (if creating new):

    • Name: autobotAI-Inspector-Listener
    • API destination endpoint: Your autobotAI listener URL
    • HTTP method: POST
    • Connection: Create new connection with API key authorization using your autobotAI secret key

  8. Save the rule and ensure its state is ENABLED.

For detailed steps on creating API destinations, see the Amazon EventBridge API Destinations documentation.

Step 3: Verify Integration

  1. Check EventBridge Rule

    • Go to AWS EventBridge console
    • Find the rule named autobotAI-Inspector-Findings
    • Verify it's enabled and targeting your API destination

  2. Test Inspector Findings

    • Trigger an Inspector finding by launching an EC2 instance with known vulnerable packages
    • Wait a few minutes for the scan to complete and findings to appear

  3. Verify in autobotAI

    • Go to your listener in autobotAI
    • Click "Test" to view recent events
    • You should see Inspector finding data being received

CloudFormation Template

The integration uses the following CloudFormation template:

Template URL:

https://autobot-ai.s3.amazonaws.com/autobotAI-Inspector-EventBridge.yml

Template Components:

EventBridge API Destination

Forwards Inspector findings to your autobotAI listener endpoint

Properties:

  • Name: autobotAI-inspector-listener-webhook
  • Invocation Endpoint: Your listener URL
  • HttpMethod: POST
  • Rate Limit: 300 invocations per second
  • Authorization: API key authentication

EventBridge Connection

Establishes secure connection to your autobotAI listener

Properties:

  • Name: autobotAI-inspector-listener-connection
  • Authorization Type: API_KEY
  • API Key Name: x-secret-key
  • API Key Value: Your listener secret

IAM Roles and Policies

Grants EventBridge permission to invoke your API destination

Resources:

  • IAM Role: autobotAI_EventBridge_Inspector_Invoke_Api_Destination
  • Managed Policy: autobotAI_EventBridge_Inspector_Invoke_Api_Destination_Policy

EventBridge Rule

Filters and forwards Inspector findings

Event Pattern:

  • Source: aws.inspector2
  • Detail Type: Inspector2 Finding
  • AWS Account ID: Your account ID
  • State: Enabled

Security Considerations

Authentication

  • API Key Authentication: Uses header-based authentication
  • Secret Key Protection: Treat your secret key as sensitive data
  • HTTPS Only: All communication uses HTTPS for encryption

Data Privacy

  • Findings remain in your AWS account until forwarded
  • No data is stored on autobotAI servers
  • You maintain full control over your Inspector data

Access Control

  • Only your AWS account can configure the EventBridge rule
  • The CloudFormation stack requires appropriate IAM permissions
  • Review IAM roles to ensure least privilege access

Troubleshooting

Stack Creation Fails

Problem: CloudFormation stack fails to create

Solutions:

  1. IAM Permissions: Ensure you have permission to create EventBridge resources
  2. Region: Verify Inspector is enabled in the same region as deployment
  3. Limit Exceeded: Check AWS service quotas for EventBridge resources
  4. Network: Ensure outbound HTTPS connectivity to autobotAI

No Findings Received

Problem: Inspector findings not appearing in autobotAI

Troubleshooting Steps:

  1. Check EventBridge Rule Status

    • Go to AWS EventBridge console
    • Verify rule is enabled and rule state is "ENABLED"
    • Check rule's event pattern matches your findings

  2. Verify API Destination

    • Check that the API destination exists and is healthy
    • Test the endpoint manually using curl or Postman
    • Verify the URL and secret key are correct

  3. Check Listener Status

    • Confirm your listener in autobotAI is active
    • Click "Test" to view listener activity
    • Check for any authentication errors

  4. Review CloudWatch Logs

    • Check EventBridge rule delivery logs
    • Look for API destination invocation failures
    • Verify Lambda execution logs (if applicable)

Inspector Not Scanning Resources

Problem: Inspector is not generating findings for your resources

Solutions:

  1. Verify Inspector Activation

    • Go to Amazon Inspector console
    • Ensure Inspector is enabled and scanning is active
    • Confirm the desired resource types (EC2, ECR, Lambda) are activated
    • For code scanning, verify GitHub repositories are connected under Code scanning → Repository integrations

  2. Check Resource Coverage

    • Review the Inspector coverage dashboard
    • Ensure the SSM Agent is installed and running on EC2 instances
    • Verify ECR repositories are included in scanning scope
    • Confirm GitHub repositories show a "Connected" status in the Inspector console

  3. Wait for Initial Scan

    • Initial scans may take up to 24 hours to complete
    • Subsequent scans occur automatically when changes are detected

Code Scanning Not Generating Findings

Problem: No code vulnerability findings are appearing for your GitHub repositories

Solutions:

  1. Verify GitHub Connection

    • Go to Amazon Inspector console → Code scanning → Repository integrations
    • Ensure your GitHub account shows as connected
    • Confirm the target repositories are selected and accessible

  2. Check GitHub App Permissions

    • Verify the AWS Inspector GitHub app has the required permissions on your repositories
    • The app needs read access to repository contents and metadata
    • Re-authorize the app if permissions were recently changed

  3. Supported Language Check

    • Ensure your repository contains code in a supported language (Java, JavaScript/TypeScript, Python, C#, Ruby, Go, PHP)
    • Verify that dependency manifests (e.g., package.json, pom.xml, requirements.txt) are present for third-party scanning

  4. Repository Activity

    • Code scanning triggers on code pushes and pull requests
    • If no recent activity has occurred, manually trigger a scan by pushing a commit to the repository

Best Practices

Vulnerability Management

  1. Enable All Resource Types

    • Activate scanning for EC2, ECR, Lambda, and code repositories
    • Connect GitHub repositories for first-party and third-party code vulnerability scanning
    • Ensure comprehensive vulnerability coverage across your workloads and source code

  2. Configure Automated Remediation

    • Set up AWS Systems Manager for automated patching
    • Configure automated response actions for critical vulnerabilities

  3. Regular Review Schedule

    • Review findings weekly to identify trends
    • Prioritize findings based on severity, exploitability, and business impact

autobotAI Workflow Optimization

  1. Create Dedicated Bots

    • Build specific bots for common Inspector finding types
    • Automate responses for frequent vulnerability patterns (e.g., critical CVEs)

  2. Configure Alerting

    • Set up notification rules for critical and high-severity findings
    • Integrate with incident management systems

  3. Monitor Performance

    • Track listener response times
    • Optimize bot workflows for efficient processing

Cost Management

  1. EventBridge Pricing

    • Monitor EventBridge rule executions
    • Set budget alerts for API destination costs

  2. Inspector Costs

    • Review Inspector pricing for each resource type
    • Monitor scanning volume and optimize resource coverage

  3. autobotAI Usage

    • Monitor workflow execution costs
    • Review listener event volume for cost optimization

Supported Inspector Findings

The integration supports Inspector findings with the following event pattern:

Source: aws.inspector2

Detail Type: Inspector2 Finding

Finding Fields:

  • Finding ARN
  • Title
  • Description
  • Severity
  • Status (ACTIVE, SUPPRESSED, CLOSED)
  • Type (NETWORK_REACHABILITY, PACKAGE_VULNERABILITY, CODE_VULNERABILITY)
  • First Observed At
  • Last Observed At
  • Updated At
  • Affected Resource
  • Vulnerability Details (CVE ID, CVSS score, vendor severity, related vulnerabilities)
  • Network Reachability Details (open port ranges, protocols, network paths)
  • Code Vulnerability Details (file path, line number, code snippet, detector name, CWE IDs)
  • Remediation Recommendation
  • Inspector Score
  • Exploit Available (whether a public exploit exists)
  • Fix Available (whether a vendor fix is available)

Next Steps

Create Vulnerability Response Workflows

  1. Build Bots for Findings

    • Create bots to analyze incoming Inspector findings
    • Implement automated remediation actions (patching, isolation, redeployment)

  2. Set Up Approval Workflows

    • Configure approval chains for critical remediation actions
    • Implement escalation policies for unresolved vulnerabilities

  3. Integration with Other Tools

    • Connect to incident management systems (ServiceNow, Jira)
    • Integrate with threat intelligence platforms
    • Feed findings into your SIEM for correlation

Monitor and Optimize

  1. Setup Dashboards

    • Create visualizations for Inspector findings by severity and resource type
    • Build alerting and reporting dashboards

  2. Regular Audits

    • Review Inspector findings weekly
    • Analyze vulnerability trends and identify recurring patterns
    • Continuously improve patching and remediation posture

  3. Documentation

    • Maintain detailed records of vulnerability responses
    • Document successful remediation strategies
    • Share lessons learned with security and engineering teams

Support and Resources

AWS Documentation

autobotAI Resources

Additional Help

  • Contact autobotAI support for integration issues
  • Review CloudFormation template documentation
  • Check AWS CloudFormation service limits

Migration from Existing Integrations

If you have existing Inspector integration patterns, consider migrating to this architecture for:

  1. Centralized Management: All Inspector findings processed through autobotAI
  2. Automated Workflows: Built-in bot creation from findings
  3. Unified Dashboard: Single view of all vulnerability events
  4. Improved Security: API key authentication and encrypted communication

Migration Steps:

  1. Create new listener in autobotAI
  2. Deploy CloudFormation stack
  3. Update security policies to reference new listener URL
  4. Decommission old integration endpoints
  5. Test end-to-end functionality

Need Help? If you encounter any issues during setup, contact autobotAI support with:

  • CloudFormation stack status
  • Inspector finding samples
  • EventBridge rule logs