A fintech startup deploys Python microservices through CodePipeline to Lambda and ECR. Audits found hardcoded secrets and injection flaws reaching production, and the team needs automated code findings with severity gating before deploy. Which pipeline vulnerability scanning control discovers code flaws before deployment?

The correct control is right because Amazon Inspector code security scanning is purpose-built for static analysis of source repositories and Lambda function code, detecting hardcoded credentials and injection patterns such as SQL and command injection with severity scores that CodePipeline can evaluate to block promotion when high-severity findings exceed threshold, satisfying both automated discovery and pre-deploy gating. ECR container image scanning fails by scan-type concept despite using the same Inspector family and gating language, because it assesses operating system packages and language dependencies for published CVEs inside built images rather than analyzing Python source for secrets and injection logic, so it would miss the audit findings entirely. CodeGuru Reviewer fails by enforcement concept despite matching the code-flaw scope, because it provides machine-learning code-quality and best-practice remediation guidance without producing Inspector security severity findings or natively failing pipeline promotion on high severity, so deployment would not be gated. Macie fails by data-domain concept despite matching secrets and blocking language, because its discovery jobs classify sensitive personal and business data in S3 datasets, not versioned source repositories or Lambda code for static code flaws, so it cannot prevent vulnerable code reaching production. For exams, carefully distinguish Inspector scan modes of code scanning versus ECR container scanning versus Lambda standard scanning, since stems deliberately reuse gating phrasing across modes. As a practical check, confirm the pipeline invokes the Inspector code-scan action on the source or build stage, maps severity thresholds to a pipeline failure action, and routes findings to Security Hub for triage before allowing deploy to Lambda or ECR.