Single service comparison

Amazon Inspector's ECR image scanning is managed from the AWS control plane; it scans registry images and maps them to ECS or EKS workloads rather than installing a runtime-protection agent in those containers, with findings normalized into AWS SecurityFinding objects and routed through Security Hub and EventBridge. Huawei CGS takes the opposite operating model: a shield plug-in is deployed as a DaemonSet, placing a pod on each CCE compute node to perform image and runtime checks, findings are surfaced in the CGS console (with no equivalent Security Hub), and integration is tightly coupled to CCE clusters and SWR registries rather than any Amazon ECR-equivalent standalone registry. Migration therefore means re-pointing scan triggers and finding consumers to CGS-native APIs and dashboards.

Service boundaries and integrations differ materially. Inspector fans out to AWS Security Hub, AWS Config, IAM, and Organizations for multi-account aggregation, and discovers ECS/EKS workloads automatically. CGS is scoped per CCE cluster and pairs with SWR for registry scanning; cross-cluster or multi-project aggregation must be orchestrated through Huawei IAM and the CCE management plane, with no Inspector-equivalent automatic cross-account discovery, CIS/Kubernetes benchmark reporting, or network reachability assessment for exposed container ports. Architects should not assume feature parity on findings taxonomy, SBOM export, or automated re-scan cadence.

Runtime and escape detection scope differ. Inspector focuses on package/CVE vulnerability identification in ECR images and adds running-workload context by mapping image use in ECS and EKS, while CGS additionally delivers container escape detection (shocker, Dirty COW, privilege escalation), process whitelisting, file tamper protection, and malicious-program (miner/ransomware/Trojan) detection. Conversely, Inspector offers ECR deep integration and expansive CVE coverage from the Amazon vulnerability database that CGS's 100,000+ library may not match one-for-one. Treat CGS as runtime-and-image security with prevention controls, and Inspector as assessment-and-findings only, before planning parity.

Assess workload fit before choosing a target. For ECR-hosted images used by ECS/EKS, the Huawei equivalent is CGS scanning images held in SWR and running on CCE; there is no standalone Huawei registry-only scan service decoupled from CCE, so non-CCE runtimes will not be covered. Inventory ECR repositories, ECS/EKS clusters, Inspector scan configurations (event vs recurring, EC2/ECR resource tags), suppressed-finding rules, and Security Hub custom insights, then map each to CGS scan policies, SWR repository namespaces, and CCE cluster selectors, accepting that cross-account Organizations aggregation has no CGS equivalent.

Migrate images and re-enable scan triggers. Push images from ECR to SWR (or rebuild from source through a Huawei-based pipeline), and enable CGS SWR image scan on the target namespaces plus running-image scan on each CCE cluster. Recreate Inspector suppression and severity filters as CGS policy rules, and stand up a daemon or Cloud Function-based forwarder if you need CGS findings in a SIEM, since no Security Hub destination exists. Replace Inspector's SCP/Organizations-wide enablement with per-project/per-cluster CGS enablement and rehearse region failover, as CGS availability is region-scoped to CCE.

Validate parity and cutover carefully. Run Inspector and CGS in parallel for at least one full recurring scan cycle, diff CVE coverage by image digest, and reconcile finding counts against the documented CVE library differences; CGS escape/process/file controls have no Inspector counterpart, so baseline those as net-new. Confirm alert routing into your ticketing/SIEM, validate RBAC, and document findings-to-remediation ownership because the taxonomy (package CVE vs CGS escape/malware) does not translate field-for-field.

Address gaps and pricing-model changes. Inspector ECR enhanced scanning is billed by the number of images initially scanned and rescanned; CGS bills by edition, number of protected nodes/images, and scan volume per the CGS price calculator, so re-run TCO with peak node count, image churn rate, and retention of scan history. Budget for the agent footprint on each CCE node, plan compensation for the loss of Security Hub/Config/Organizations aggregation (e.g., a custom LakeHouse or SIEM ingest), and treat network-reachability and exposed-port assessment as out of CGS scope with no drop-in Huawei replacement.