AWS Fargate Inventory — Overview
Qualys Container Security provides continuous inventory and vulnerability visibility for AWS Fargate workloads running on Amazon ECS. Fargate inventory automatically discovers running tasks across onboarded accounts and regions, correlates container images with vulnerability findings, and tracks workload activity over time.
AWS Fargate is a serverless compute engine for containers. Because Fargate tasks are ephemeral and managed by AWS, traditional agent-based scanning approaches do not apply. Qualys addresses this by capturing ECS Task State Change events in real time — collecting container image digests, workload metadata, and vulnerability data whenever a task enters a running state.
How Fargate Inventory Works
Fargate inventory is event-driven and runs entirely within your AWS environment. All processing runs inside a designated service account; target accounts contain no inventory infrastructure.
- Real-time event capture: When an ECS Fargate task transitions to the RUNNING state, an EventBridge rule captures the Task State Change event and delivers it to an SQS queue in the service account. Only tasks in the RUNNING state are processed — this ensures container image digests are fully resolved before inventory is collected.
- Inventory collection: The qualys-fargate-inventory Lambda function processes each event, assumes a read-only cross-account role in the target account, and collects workload details including the ECS cluster, service, task ARN, container image name and digest, and architecture.
- Deduplication: Each workload is deduplicated in DynamoDB to prevent redundant inventory uploads for the same task across repeated state change events.
- Daily bulk rescan: A scheduled daily rescan re-enqueues all onboarded accounts and regions for a full inventory refresh, ensuring workloads that did not generate new events are kept up to date.
- Hourly dedup flush: A scheduled hourly flush clears the deduplication cache so that legitimate reappearances of tasks are captured correctly.
- Metadata enrichment: When EnableCloudMetadataCollection=true, task-definition payloads and AWS resource tags are collected alongside the core inventory data.
What Fargate Inventory Collects
For each running Fargate task, Qualys collects the following.
| Field | Description |
|---|---|
| Account and region | AWS account ID and region where the Fargate task is running. |
| Cluster and service | ECS cluster name and ARN; service name and revision. |
| Task ARN | Full ARN of the running ECS task. |
| Container image | ECR image URI, SHA-256 digest, and short image ID for each container in the task. |
| Architecture | CPU architecture of the task (amd64 or arm64). |
| Vulnerability findings | Total vulnerability count and severity breakdown correlated from image scanning results. |
| Lifetime and recent activity metrics | Daily event counts over the workload's lifetime and the past 7 days (minimum, maximum, and average). |
Where to View Fargate Inventory
Fargate inventory results are available in two places.
- Container Security > Assets > Images: Use the QQL query
source: SERVERLESS_FARGATEto filter images scanned from Fargate tasks. - Container Security > Assets > Containers: Use the QQL query
source: SERVERLESS_FARGATEto filter running Fargate containers and drill into container details including AWS Fargate task metadata.
Deployment Model
Fargate inventory is deployed as part of the same CloudFormation infrastructure used for Lambda scanning. The deployment consists of two stacks.
- Service Account stack: Deploys the qualys-fargate-inventory Lambda function alongside the Lambda scanning infrastructure. Enable Fargate inventory by setting EnableFargateInventory=true on the service account stack. The CustomerId parameter is also required.
- Target Account stack: Set EnableFargateInventory=true on the target account stack to deploy EventBridge rules that forward ECS Task State Change events to the service account.
Fargate inventory and Lambda scanning share the same service account infrastructure and can be enabled together on a single deployment. You do not need separate stacks for each feature.
For deployment steps, see Deploy Cloud Formation Template (CFT) using CLI.
Relationship to Fargate Scanning (1.x)
This inventory model (2.0) is distinct from the earlier Fargate scanning approach, which used AWS CodeBuild triggered by an EventBridge rule to launch a Qualys sensor per ECS task. The 2.0 model uses the qualys-fargate-inventory Lambda function and shares infrastructure with Lambda scanning, providing broader cross-account and multi-region coverage without per-task CodeBuild executions.
For the earlier approach, see Scan Container Images in AWS Fargate (ECS).