A company runs web and mobile applications in Amazon ECS containers with the Fargate launch type. Each business unit uses a separate AWS account and stores images in a private Amazon Elastic Container Registry (Amazon ECR) repository in its own account. A security engineer must recommend a solution to scan ECS containers and ECR registries for operating system and language-library vulnerabilities. The audit team needs centralized visibility into potential vulnerabilities across all accounts. Which solution meets these requirements?

Amazon Inspector is the dedicated AWS service for automated vulnerability management, including scanning container images in ECR and running containers for operating system and language-library vulnerabilities. Configuring Inspector as the ECR scanning service in each account ensures comprehensive coverage. Sending these findings to AWS Security Hub in a central security account provides the required centralized visibility for the audit team, as Security Hub aggregates security findings from various AWS services. Incorrect options: AWS Config monitors resource configurations and compliance, but it does not perform vulnerability scanning of container images or running containers. Conformance packs are for compliance checks, not vulnerability detection. AWS Audit Manager helps automate evidence collection for audits but does not perform vulnerability scanning of ECS or ECR. Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, but it does not scan container images or running containers for operating system and language-library vulnerabilities.