Inspector Configuration

Assesses Amazon Inspector configuration completeness by checking scan type enablement, coverage, suppression rules, and organization member status. Results are presented as a configuration state summary.

Works from both standalone accounts and delegated administrator accounts.

Classify the Request

Workflow A: Review Single Account

1. Get account status for all scan types:

   bashCopy

   aws inspector2 batch-get-account-status

2. Report ALL scan types and their status (ENABLED/DISABLED/SUSPENDED). Do not hardcode a scan type list; report whatever the API returns.

   For reference on available scan types, see: https://docs.aws.amazon.com/inspector/latest/user/scanning-resources.html (opens in a new tab)

3. Check coverage statistics:

   bashCopy

   aws inspector2 list-coverage-statistics --filter-criteria {} --group-by RESOURCE_TYPE

4. List coverage to identify unscanned resources:

   bashCopy

   aws inspector2 list-coverage --filter-criteria '{"scanStatusCode":[{"comparison":"EQUALS","value":"INACTIVE"}]}'

5. Check suppression rules:

   bashCopy

   aws inspector2 list-filters

6. Check CIS scan configurations:

   bashCopy

   aws inspector2 list-cis-scan-configurations

7. Check EC2 deep inspection:

   bashCopy

   aws inspector2 get-ec2-deep-inspection-configuration

8. Present results:

   Security check: Verify CloudTrail is enabled and logging Inspector API calls (inspector2:* events) for audit purposes.

   Check	Status
   Each scan type from API response	Enabled / Disabled / Suspended
   EC2 deep inspection configured	Configured / Not Configured
   CIS benchmarks configured	Configured / Not Configured
   Coverage status (inactive resources)	None / Count
   Suppression rules present	Count

Workflow B: Review Organization Coverage

1. Identify delegated admin:

   bashCopy

   aws inspector2 list-delegated-admin-accounts

2. Check organization configuration:

   bashCopy

   aws inspector2 get-configuration

   Report ALL scan types and their auto-enable status.

   For organization-level Inspector policies (INSPECTOR_POLICY), see references/organization-policies.md.

3. Get org-wide coverage statistics:

   bashCopy

   aws inspector2 list-coverage-statistics --filter-criteria {} --group-by RESOURCE_TYPE

4. (ONLY if user explicitly requests per-account detail):

   bashCopy

   aws inspector2 list-members
   aws inspector2 batch-get-account-status --account-ids <ACCOUNT_IDS>

   MAY batch up to 100 account IDs per call.

5. Present results:

   Check	Status
   Delegated admin configured	Enabled / Not Enabled
   Auto-enable per scan type	Enabled / Not Enabled
   Member accounts	Enrolled (details on request)
   Coverage statistics by resource type	See details

Constraints

• MUST check ALL scan types, not a subset
• MUST report inactive/failed scan status distinctly from disabled
• MUST NOT paginate through all member accounts by default
• MUST only enumerate individual member status if user explicitly requests it

Troubleshooting

Output Sensitivity

Configuration output reveals account structure (member account IDs), scan type enablement, resource coverage details (EC2 instance IDs, Lambda ARNs, ECR repositories), and suppression rules. Present configuration summary first; offer raw API responses on request.