AWS Inspector cost: per instance and per image scanned

Quick answer

Amazon Inspector bills per EC2 instance scanned per month and per container image scanned in ECR (with initial and re-scans on push), plus Lambda function scanning, all tiered. Cost scales with fleet size and how often you push images, so scanning the resources that matter, and not re-pushing images unnecessarily, are the levers.

Amazon Inspector continuously scans workloads for software vulnerabilities and unintended network exposure. It bills per resource scanned, so its cost tracks the size of your fleet and the frequency of your container image pushes rather than being a flat platform fee.

Per resource scanned

Resource	Bills for
EC2 instances	Per instance scanned per month, tiered
Container images (ECR)	Per image scanned (initial + re-scan on push)
Lambda functions	Per function scanned

EC2 instances are billed per instance scanned per month, so a large fleet costs per instance. ECR images are billed per scan, including re-scans when a new version is pushed, so frequent image pushes multiply scans. Lambda scanning bills per function. All rates are tiered.

What drives the bill

Fleet size drives the EC2 line, and image push frequency drives the ECR line. A CI pipeline pushing many image versions triggers a scan on each push, so chatty image pipelines can generate significant scan volume. Enabling scanning across a large, active environment is where cost grows.

Controlling Inspector cost

Scan the resources that matter (production and internet-facing first), avoid unnecessary image re-scans by not pushing redundant versions, prune old images so they are not re-scanned, and align Lambda scanning with your risk. As with other security services, enabling scanning where it delivers value, rather than everywhere by default, keeps cost proportional, the same discipline as Security Hub.

FAQ

How is Amazon Inspector priced?

Per EC2 instance scanned per month, per container image scanned in ECR (including initial scans and re-scans on each push), and per Lambda function scanned, all tiered so unit rates fall at volume. Cost scales with fleet size and how often you push container images.

What drives Amazon Inspector cost?

Fleet size drives the per-instance EC2 line, and container image push frequency drives the per-scan ECR line, since a new push triggers a re-scan. A CI pipeline pushing many image versions generates many scans, so active image pipelines and large fleets are the main cost drivers.

How do I reduce Inspector cost?

Scan the resources that matter most (production and internet-facing first), avoid unnecessary image re-scans by not pushing redundant versions, prune old images so they are not re-scanned, and align Lambda scanning with your risk. Enabling scanning where it delivers value keeps cost proportional.

Does pushing container images often increase Inspector cost?

Yes. Inspector re-scans a container image on each push, so a pipeline pushing many versions triggers a scan per push, multiplying the ECR scan cost. Reducing redundant pushes and pruning old images reduces the number of scans billed.

Is Amazon Inspector worth the cost?

For production and internet-facing workloads, generally yes, as automated continuous vulnerability scanning that would be costly to build and operate. Keep it economical by scanning the resources that matter, avoiding unnecessary image re-scans, and aligning coverage with your actual risk rather than scanning everything by default.

Does C3X estimate Inspector cost?

Inspector cost is driven by instances, images, and functions scanned, which scale with fleet size and push frequency, usage inputs. C3X prices the surrounding infrastructure, and you model fleet and image-pipeline activity to estimate the scanning charges.

What to do next

Estimate the infrastructure around your scanning before you deploy. C3X reads your Terraform and prices your resources against a live catalog. Start with the quickstart.