Inspector has an agentless ‘Network assessment’.

As of Nov 8th 2018, Amazon inspector includes a new Rules package called ‘Network Reacheability’ that does not require the installation of an agent inside EC2 instances. Inspector runs a network configuration analysis to check for ports reachable from outside the VPC.

docs.aws.amazon.com/inspector/latest/userguide/inspector_network-reachability.html