inspector

Enables Amazon Inspector v2 organization-wide with EC2, ECR, and Lambda scanning.

Activates Inspector v2 across the management account and specified member accounts, designates a security account as delegated administrator, configures organization-wide auto-enablement for EC2/ECR/Lambda, and provisions finding suppression filters. Requires the governance/organization module to have trusted-access for inspector2.amazonaws.com enabled.

Usage

module "inspector" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/security/inspector/aws"
  version = "0.1.0"

  delegated_admin_account_id = "111122223333"
  member_accounts = {
    prod    = "222233334444"
    staging = "333344445555"
  }
}

Requirements

Name	Version
terraform	~> 1.5
aws	~> 6.50

Providers

Name	Version
aws	6.50.0

Resources

Name	Type
aws_inspector2_delegated_admin_account.this	resource
aws_inspector2_enabler.this	resource
aws_inspector2_filter.this	resource
aws_inspector2_organization_configuration.this	resource

Inputs

Name	Description	Type	Default	Required
delegated_admin_account_id	Account ID to designate as Inspector v2 delegated administrator	string	null	no
enable_ec2_scanning	Enable EC2 scanning for members	bool	true	no
enable_ecr_scanning	Enable ECR container image scanning for members	bool	true	no
enable_lambda_scanning	Enable Lambda function scanning for members	bool	true	no
filter_criteria	Map of finding filter criteria for auto-suppression rules	map(object({ action = string # NONE or SUPPRESS description = optional(string, "") filter_criteria = optional(any, null) }))	{}	no
member_accounts	Map of logical key to member account IDs to enable Inspector on	map(string)	{}	no
tags	Resource tags to apply to all resources	map(string)	{}	no

Outputs

Name	Description
delegated_admin_account_id	Delegated administrator account ID (null if not configured)
enabled_account_ids	Account IDs for which Inspector v2 was enabled