# inspector

Enables Amazon Inspector v2 organization-wide with EC2, ECR, and Lambda scanning.

Activates Inspector v2 across the management account and specified member accounts, designates a security account as delegated administrator, configures organization-wide auto-enablement for EC2/ECR/Lambda, and provisions finding suppression filters. Requires the `governance/organization` module to have trusted-access for `inspector2.amazonaws.com` enabled.

## Usage

```hcl
module "inspector" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/security/inspector/aws"
  version = "0.1.0"

  delegated_admin_account_id = "111122223333"
  member_accounts = {
    prod    = "222233334444"
    staging = "333344445555"
  }
}
```

<!-- BEGIN_TF_DOCS — DO NOT EDIT BELOW THIS LINE -->
## Requirements

| Name | Version |
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement_terraform) | ~> 1.5 |
| <a name="requirement_aws"></a> [aws](#requirement_aws) | ~> 6.50 |

## Providers

| Name | Version |
| ---- | ------- |
| <a name="provider_aws"></a> [aws](#provider_aws) | 6.50.0 |

## Resources

| Name | Type |
| ---- | ---- |
| [aws_inspector2_delegated_admin_account.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/inspector2_delegated_admin_account) | resource |
| [aws_inspector2_enabler.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/inspector2_enabler) | resource |
| [aws_inspector2_filter.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/inspector2_filter) | resource |
| [aws_inspector2_organization_configuration.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/inspector2_organization_configuration) | resource |

## Inputs

| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_delegated_admin_account_id"></a> [delegated_admin_account_id](#input_delegated_admin_account_id) | Account ID to designate as Inspector v2 delegated administrator | `string` | `null` | no |
| <a name="input_enable_ec2_scanning"></a> [enable_ec2_scanning](#input_enable_ec2_scanning) | Enable EC2 scanning for members | `bool` | `true` | no |
| <a name="input_enable_ecr_scanning"></a> [enable_ecr_scanning](#input_enable_ecr_scanning) | Enable ECR container image scanning for members | `bool` | `true` | no |
| <a name="input_enable_lambda_scanning"></a> [enable_lambda_scanning](#input_enable_lambda_scanning) | Enable Lambda function scanning for members | `bool` | `true` | no |
| <a name="input_filter_criteria"></a> [filter_criteria](#input_filter_criteria) | Map of finding filter criteria for auto-suppression rules | <pre>map(object({<br/>    action          = string # NONE or SUPPRESS<br/>    description     = optional(string, "")<br/>    filter_criteria = optional(any, null)<br/>  }))</pre> | `{}` | no |
| <a name="input_member_accounts"></a> [member_accounts](#input_member_accounts) | Map of logical key to member account IDs to enable Inspector on | `map(string)` | `{}` | no |
| <a name="input_tags"></a> [tags](#input_tags) | Resource tags to apply to all resources | `map(string)` | `{}` | no |

## Outputs

| Name | Description |
| ---- | ----------- |
| <a name="output_delegated_admin_account_id"></a> [delegated_admin_account_id](#output_delegated_admin_account_id) | Delegated administrator account ID (null if not configured) |
| <a name="output_enabled_account_ids"></a> [enabled_account_ids](#output_enabled_account_ids) | Account IDs for which Inspector v2 was enabled |
<!-- END_TF_DOCS — DO NOT EDIT ABOVE THIS LINE -->