AWS Inspector - analyzes instances and ECR docker images from the inside (e.g. malware, virus) in terms of security. On the instances, a special Inspector agent is required to be running.
AWS Config - can be applied to any resource, does not require any agent on the instances (thus does not check them from the inside), and you can write your own, fully custom security checks.