Monitoring Usage and Cost in Amazon Inspector
You can use the Amazon Inspector console and API to project monthly Amazon Inspector costs for your environment. If you're the Amazon Inspector administrator for a multiple-account environment, you can view the total cost for your environment and cost metrics for all member accounts. This section describes how to access usage statistics and calculate usage costs.
Using the usage console
You can assess usage and projected cost for Amazon Inspector from the console.
To access usage statistics
-
Sign in using your credentials, and then open the Amazon Inspector console at https://console.aws.amazon.com/inspector/v2/home
. -
By using the AWS Region selector in the upper-right corner of the page, select the Region you want to monitor costs in.
-
In the navigation pane, choose Usage.
In the By account tab you will see the projected total cost based on the 30 day period listed under Account usage. In the table under the Projected cost column select a value to see a breakdown of usage by scan type for that account. In this detail pane you can also see which scan types have a free trial active for that account.
If you are the delegated administrator for an organization you will see a row in the table for each account within your organization. If an account in your organization is disassociated the console shows it's projected cost as a -.
In the By scan type tab you can see a break down of actual usage so far in the current 30 day period by scan type. This is the information used to calculate the projected costs in the By account tab.
If you are the delegated administrator for an organization you can see the usage for each account in your organization.
In this tab, you can expand any of the following panes for usage statistics:
- Amazon EC2 scanning
-
The Amazon Inspector usage console tracks the following metrics for agent-based scanning and agentless scanning:
Instances (Avg) — Amazon Inspector uses the coverage hours to calculate the average number of resources for EC2 instance scanning. The average is the total coverage hours divided by 720 hours (the number of hours in a 30 day period).
Coverage hours — for Amazon EC2 scanning this is the sum total number of hours within the last 30 days that Amazon Amazon Inspector provided active coverage for each EC2 instance in an account. For EC2 instances, coverage hours are the hours from when Amazon Inspector discovered the instance until it's terminated or stopped, or excluded from scans by tags. (when you restart a stopped instance or remove an exclusion tag, Amazon Inspector resumes coverage and coverage hours for that instance will continue to accrue).
CIS instance Scans — The total number of CIS scans performed for instances in the account.
- Amazon ECR scanning
Initial scans — The sum total of first time scans of images in the account within the last 30 days.
Rescans — The sum total of rescans for images in the account within the last 30 days. A rescan is any scan done on an ECR image that Amazon Inspector has previously scanned. If you have configured your ECR repository for continuous scanning, rescans occur automatically when Amazon Inspector adds a new Common Vulnerabilities and Exposures (CVE) to it's database.
- Lambda scanning
-
The Amazon Inspector usage console tracks the following metrics for Lambda standard scanning and Lambda code scanning:
Number of Lambda functions (Avg) — Amazon Inspector uses the coverage hours to calculate the average number of functions for Lambda function scanning. Average is the total coverage hours divided by 720 hours (the number of hours in a 30 day period).
Coverage hours — For Lambda function scanning this is the sum total number of hours within the last 30 days that Amazon Amazon Inspector provided active coverage for each Lambda function in an account. For AWS Lambda functions the coverage hours are calculated from when Amazon Inspector discovers a function until when it's deleted or excluded from scans. If an excluded function is included again, coverage hours for that function will continue to accrue.
- Azure Virtual Machine scanning
-
The Amazon Inspector usage console tracks the following metrics for Azure VM scanning:
Number of Azure VMs (Avg) — The average number of Azure Virtual Machines monitored by Amazon Inspector VM Scanner during the 30-day period.
Coverage hours — The sum total number of hours that Amazon Inspector provided active vulnerability scanning coverage for each Azure VM in an account.
- Azure Function App scanning
-
The Amazon Inspector usage console tracks the following metrics for Azure Function App scanning:
Number of Function Apps (Avg) — The average number of Azure Function Apps monitored during the 30-day period.
Coverage hours — The sum total number of hours that Amazon Inspector provided active code dependency scanning coverage for each Azure Function App in an account.
- Azure Container Registry (ACR) image scanning
-
The Amazon Inspector usage console tracks the following metrics for Azure Container Registry image scanning:
Initial scans — The total number of first-time scans of Azure container images within the last 30 days.
Rescans — The total number of rescans for Azure container images within the last 30 days. A rescan occurs automatically when Amazon Inspector adds a new CVE to its database that affects a previously scanned image.
Note
Each Azure resource type includes a 30-day free trial. The free trial starts independently for each resource type when Amazon Inspector begins scanning that resource type in your account.
Understanding how Amazon Inspector calculates usage costs
The costs provided by Amazon Inspector are estimates, not actual costs, so they may differ from those in your AWS Billing console.
Note the following about how Amazon Inspector calculates cost on the Usage page:
The usage cost reflects the current region only. Prices per scan type vary by AWS Region, to review exact prices per region, see the Pricing
for Amazon Inspector All usage projections are rounded to the nearest US dollar.
Discounts aren't included in the projected costs.
The projected cost represent the total cost for the 30 day usage period per scan type. If there has been less than 30 days of usage for an account, Amazon Inspector projects the cost after 30 days as if any currently covered resources will remain covered for the rest of the 30 day period.
The cost per scan type is calculated based on the following:
EC2 scanning: cost reflects the average number of EC2 instances covered by Amazon Inspector in the last 30 days.
ECR container scanning: cost reflects the sum of the number of initial image scans + image rescans in the last 30 days.
Lambda standard scanning: cost reflects the average number of Lambda functions covered by Amazon Inspector in the last 30 days.
Lambda code scanning: cost reflects the average number of Lambda functions covered by Amazon Inspector in the last 30 days.
About the Amazon Inspector free trial
In Amazon Inspector, each scan type has a free trail. When you activate a scan type, you automatically enroll in a 15-day free trial for that scan type. Once the free trial starts, it automatically expires in 15 days, even if you deactivate the scan type.
Note
The free trial does not apply to CIS scanning.
