AWS Inspector2 Enable Service Feature

[rhelwatkar]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

Editor's Note

The AWS link provided by op in references is for "Inspector V2" or "Inspector2". I've changed the issue title to clarify that we're talking about 2 since none of this make sense in context of v1.

Description

AWS has recently launched new aws Inspector, we can enable the service via CLI.

This feature is missing and can be added to enable Inspector Service.

New or Affected Resource(s)

• aws_inspector_enable

Potential Terraform Configuration

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key.

resource "aws_inspector_enable" "enable_service" {
    account_id = []
    client_token = ""
    resource_types = []
}

References

AWS Documentation page - https://awscli.amazonaws.com/v2/documentation/api/latest/reference/inspector2/enable.html

[autarchprinceps]

It's a little more complicated. Yes, you can just enable it, but you'd typically either set it on root account, or set a delegate on the root account, and then in that root/security account you associate other accounts.
Not that simple enable in the current account shouldn't also work, but it would be great to see the actual main use case thought about too.

[bismark]

Would also be nice to have support for managing suppression rules.

[james-green-affinity]

This feature definitely should support the ability be able to delegate within the Terraform to an Audit account.

[snemetz]

This should be changed to supporting inspector2.
Doing only 1 api of the newer inspector2 service will not be useful
I need all of these to just get started

aws inspector2 enable [--account-ids X] --resource-types "ECR"
aws inspector2 enable-delegated-admin-account --delegated-admin-account-id ID
aws inspector2 update-organization-configuration --auto-enable ec2=false,ecr=true

[breathingdust]

Hi all 👋 Just letting you know that this is issue is featured on this quarters roadmap. If a PR exists to close the issue a maintainer will review and either make changes directly, or work with the original author to get the contribution merged. If you have written a PR to resolve the issue please ensure the "Allow edits from maintainers" box is checked. Thanks for your patience and we are looking forward to getting this merged soon!

[YakDriver]

aws_inspector2_organization_configuration #27000

• DescribeOrganizationConfiguration
• UpdateOrganizationConfiguration

aws_inspector2_delegated_admin_account #27229

• DisableDelegatedAdminAccount
• EnableDelegatedAdminAccount
• GetDelegatedAdminAccount
• ListDelegatedAdminAccounts

aws_inspector2_enabler

• Disable
  • [in] account_ids
  • [in] resource_types ('EC2', 'ECR')
  • [out] accounts (account_id, resource_status, status)
  • [out] failed_accounts (account_id, error_code, error_message, resource_status, status)
  • [out] metadata
• Enable
  • [in] account_ids
  • [in] resource_types ('EC2', 'ECR')
  • [out] accounts (account_id, resource_status, status)
  • [out] failed_accounts (account_id, error_code, error_message, resource_status, status)
  • [out] metadata

[ajardan]

Are there any news when this is going to be released ? Is there anything that we can help to speed things up ?

[github-actions]

This functionality has been released in v4.37.0 of the Terraform AWS Provider. Please see the Terraform documentation on provider versioning or reach out if you need any assistance upgrading.

For further feature requests or bug reports with this functionality, please create a new GitHub issue following the template. Thank you!

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.