⚠
Since Inspector is a regional service, you must apply this Terraform configuration on each region that you are using. Consider using the region argument in your provider definition and a variable to make your Terraform configuration rerunnable in other regions.
We can designate the delegated administrator using the [`aws_inspector2_delegated_admin_account` resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/inspector2_delegated_admin_account). However, this does not enable Inspector in the delegated administrator account, so we also need to use the [`aws_inspector2_enabler` resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/inspector2_enabler). What I learned from testing the `aws_inspector2_enabler` resource is that you cannot provide both the delegated account and the member accounts in the `account_ids` argument, so we need a dedicated `aws_inspector2_enabler` resource for the **Audit** account. According to the resource source code, this is to address a legacy Inspector issue.
The resulting Terraform configuration should look like the following (pay special attention to the `provider` argument in each resource):
```dockerfile
data "aws_caller_identity" "audit" {
provider = aws.audit
}
resource "aws_inspector2_enabler" "audit" {
provider = aws.audit
account_ids = [data.aws_caller_identity.audit.account_id]
}
resource "aws_inspector2_delegated_admin_account" "audit" {
provider = aws.management
account_id = data.aws_caller_identity.audit.account_id
depends_on = [aws_inspector2_enabler.audit]
}
```
## Configuring Inspector activation for new member accounts
To allow more control over which scan types are enabled, we can define the following variables and use them with the relevant resources:
```dockerfile
# Variable definition (.tfvars)
variable "enable_ec2" {
description = "Whether Amazon EC2 scans should be enabled for both existing and new member accounts in the organization."
type = bool
default = true
}
variable "enable_ecr" {
description = "Whether Amazon ECR scans should be enabled for both existing and new member accounts in the organization."
type = bool
default = true
}
variable "enable_lambda" {
description = "Whether Lambda Function scans should be enabled for both existing and new member accounts in the organization."
type = bool
default = true
}
variable "enable_lambda_code" {
description = "Whether Lambda code scans should be enabled for both existing and new member accounts in the organization."
type = bool
default = true
}
```
In an organizational setup, Inspector can auto-enable on new member accounts. In Terraform, this can be configured using the [`aws_inspector2_organization_configuration` resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/inspector2_organization_configuration). Leveraging the variables above, the resource can be defined as follows:
```dockerfile
resource "aws_inspector2_organization_configuration" "this" {
provider = aws.audit
auto_enable {
ec2 = var.enable_ec2
ecr = var.enable_ecr
lambda = var.enable_lambda
lambda_code = var.enable_lambda_code && var.enable_lambda
}
depends_on = [aws_inspector2_delegated_admin_account.audit]
}
```
Note that for AWS Lambda code scanning (`lambda_code`), AWS Lambda standard scanning (`lambda`) is a prerequisite, so we need to check both variables to enable it.
Now let's address the existing member accounts.
## Activating scanning for existing member accounts
Unlike GuardDuty, the Inspector organization configuration does not support auto-enablement for existing member accounts, so we need to separately manage the member accounts. The strategy is to get the list of *active* member accounts from the organization, which we can use with the Inspector Terraform resources, including the `aws_inspector2_enabler` resource. We can exclude the **Audit** account since that is managed separately. To get the list of member accounts in the organization, we can use the [`aws_organizations_organization` data source](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/organizations_organization).
Furthermore, the `aws_inspector2_enabler` resource's `resource_types` argument takes a list of strings that represent the scan types to enable. Since the variables we defined earlier are boolean variables, we need a bit of function magic to create the list of scans to enable based on the variables.
The Terraform configuration that addresses the above requirements can be defined as follows:
```dockerfile
data "aws_organizations_organization" "this" {
provider = aws.management
}
locals {
enabler_resource_types = compact([
var.enable_ec2 ? "EC2" : null,
var.enable_ecr ? "ECR" : null,
var.enable_lambda ? "LAMBDA" : null,
var.enable_lambda_code && var.enable_lambda ? "LAMBDA_CODE" : null,
])
member_account_ids = [for account in data.aws_organizations_organization.this.accounts : account.id if account.status == "ACTIVE" && account.id != data.aws_caller_identity.audit.account_id]
}
```
Member accounts are not automatically associated with the delegated administrator account, so they must first be associated using the [`aws_inspector2_member_association` resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/inspector2_member_association).
Using the [`for_each` meta-argument](https://developer.hashicorp.com/terraform/language/meta-arguments/for_each), we can define a single resource to associate all member accounts with the previously defined `member_account_ids` local value:
```dockerfile
resource "aws_inspector2_member_association" "members" {
provider = aws.audit
for_each = toset(local.member_account_ids)
account_id = each.key
depends_on = [aws_inspector2_delegated_admin_account.audit]
}
```
Lastly, we can enable Inspector scans in the member accounts using the `aws_inspector2_enabler` resource. Although the `account_ids` argument can take the list of member accounts, it is more flexible to have one resource per account. Thus, using `for_each` and the local values, the resource can be defined as follows:
```dockerfile
resource "aws_inspector2_enabler" "members" {
provider = aws.audit
for_each = toset(local.member_account_ids)
account_ids = [each.key]
resource_types = local.enabler_resource_types
depends_on = [aws_inspector2_member_association.members]
}
```