Settings
The Settings page lets you change the regions Amazon Detective covers, check and repair the permissions Detective needs in each enrolled account, and disable Detective entirely. Its header reads Settings, subtitled "Manage regions, account permissions and Amazon Detective status".
Accessing Settings
In the Security Hub sidebar, click Amazon Detective > Settings.
If Detective has not been set up yet, the page shows an alert reading "Amazon Detective is not set up yet for this customer. Complete the setup wizard first to manage regions, account permissions, or disable the service." with a Go to setup button that opens the setup wizard.
The page has three tabs: Regions, Permissions, and Danger zone.
There is no scan-type or feature-selection tab. Amazon Detective has no equivalent of Inspector's scan types or GuardDuty's protection plans, and no UpdateResourceTypes analogue at all: its data sources (CloudTrail management events, VPC flow logs, and GuardDuty findings) are selected and managed by AWS and are not individually selectable. The regions you cover and the accounts you enrol are the whole of the configuration.
While an Operation Is Running
Region changes are refused by the server unless the configuration is settled, so while an operation is in_progress the page shows a progress bar at the top and the Save regions button is disabled. The bar's label comes from the server; where the server has not stamped one it reads:
A Detective operation is running — settings are locked until it finishes
The page polls the configuration while that lasts and re-enables the controls by itself, so a visitor who arrives mid-operation does not have to reload by hand. Only the configuration is refreshed on those polls, never the region field, which would otherwise overwrite an edit in progress.
If setup failed, a red banner appears instead, with a Re-run setup button:
Amazon Detective setup failed*[: the reason, when the server recorded one]*. Nothing is running and nothing will resume on its own. Regions cannot be changed until setup is re-run — disabling Detective from the Danger zone still works, and is what releases the member slots a partial enable is still holding.
Regions Tab
Adds or removes the regions where Amazon Detective runs.
- Home region: shown above the picker as a read-only value. The behavior graph belongs to the administrator account in each region, and the administrator cannot be changed without disabling Detective.
- Regions: a multi-select field listing the regions Detective can be run in. The home region is locked in it and cannot be deselected.
Update your selection and click Save regions. The button stays disabled until the selection actually differs from what is stored, so re-saving an unchanged list is not possible. If your change removes any region, a Confirm region removal dialog names the regions that will be torn down (and, when the same save also adds regions, says so too); a save that only adds regions goes through without a confirmation step.
On a successful save the page hands you off to Enrollment rather than staying put. A region change fans out over every live member account — a new region needs a graph, an invitation and a verification per account — and Enrollment is the page where a per-account failure becomes actionable.
The regions list is not a display filter. Amazon Detective builds one behavior graph per region. Adding a region creates a new behavior graph there, enrols every member account into it — each invitation verified against the account's AWS root user email address again — and starts ingestion charges for that region. Removing a region deletes that region's behavior graph, along with everything it had accumulated, and removes the investigations Prism cached from it. A deleted behavior graph and its history cannot be recovered; re-adding the region builds a new, empty graph.
Selecting a region for removal raises an inline warning before you even reach the button:
Saving will delete the behavior graph in region — along with everything it has accumulated.
The picker is filtered by the server, and degrades to more choice rather than less. Prism holds no Detective region list in the browser; the allowlist comes from the server on every load and is intersected with the standard AWS region list. If that call fails, or the intersection comes out empty, every region is offered and the backend refuses the ones it cannot use, because an empty picker is indistinguishable from a broken page. The page says as much under the field:
Amazon Detective is not available in every AWS region. The list below is filtered to the regions this deployment supports; if that list could not be read, every region is offered and the backend refuses the ones it cannot use.
See Supported regions, including the five opt-in regions that each account must enable for itself.
A region that is live in your configuration always has a menu entry, even if the allowlist no longer offers it. The picker unions the server's allowlist with the regions your configuration already stores. Without that, a region AWS has withdrawn — or one dropped from the allowlist under a running deployment — would still be selected but have no entry to untick, and the one screen that could tear it down could not even name it.
Permissions Tab
Prism needs a small, enumerated set of Amazon Detective permissions in each enrolled account, which it attaches as a policy named CKPrism-Detective-Permissions on that account's access role. This tab, headed Account permissions, reports whether that policy is in place and current in every enrolled account, and repairs it where it is not.
When you open the tab, a scan starts automatically and shows a progress bar reading "Checking account permissions…" while it runs. Each account is then listed with its ID, a state chip, and any error the scan reported:
| Chip | Meaning |
|---|---|
| Current | The expected policy is attached and matches what Prism expects |
| Needs update | A policy is attached but does not match what Prism expects |
| Missing | No policy is attached |
Below the table, Fix roles re-applies the policy to the affected accounts and then re-runs the scan so you can confirm the result, and Re-check re-runs the scan on its own. Fix roles is disabled when nothing needs attention; a completed scan says which case you are in, either "All accounts are up to date." or "N accounts need attention."
While a re-check runs, the previous scan's rows stay on screen, dimmed, rather than collapsing to a bare progress bar. Dimmed rows are the previous result, not the current one.
With Detective configured but nothing enrolled yet, the tab reads "No enrolled accounts to check yet — enroll an account to start tracking its role permissions."
Use this tab when:
- An account failed enrollment with a permissions or AccessDenied error, fix the roles, then retry the account from Enrollment
- The policy was removed or edited directly in AWS
- A Prism update changed the set of permissions Detective requires
What the Policy Grants
The policy grants exactly eleven Amazon Detective actions and nothing else:
| Action | Why Prism calls it |
|---|---|
detective:CreateGraph | Create the behavior graph in the administrator account |
detective:DeleteGraph | Delete the graph on teardown, and sweep orphaned graphs |
detective:ListGraphs | Confirm the permissions are usable in an account, and locate existing graphs |
detective:CreateMembers | Invite member accounts into the graph |
detective:ListMembers | Poll invitation verification and read each member's status |
detective:DeleteMembers | Remove a member account from the graph |
detective:AcceptInvitation | Accept the invitation in the member account's own session |
detective:DisassociateMembership | Let a member leave the graph during teardown |
detective:StartMonitoringMember | The Start monitoring action on an accepted-but-disabled account |
detective:ListInvestigations | Read the investigations in the graph during a refresh |
detective:GetInvestigation | Read one investigation's full report, which is where its severity comes from |
This is a standing grant, not a temporary escalation. The policy stays attached to each enrolled account's access role for as long as that account is enrolled, and is detached when the account is removed or when Detective is cleanly disabled.
Three things it deliberately does not contain:
- No AWS Organizations actions, and no Detective organization-administrator actions. Prism has no route to your AWS management account, so Detective is enabled by the administrator account you nominate, through its own access role. The organization-level Detective APIs are absent because Prism never calls them.
- No
detective:StartInvestigationand nodetective:UpdateInvestigationState. Prism reads investigations; it never starts one and never re-triages one. This is why investigations must be started from the Amazon Detective console, as described in Detective does not create investigations on its own. - No service-linked role creation. Amazon Detective's service-linked role exists so Detective can read AWS Organizations, which Prism's deployment model does not use, so the graph is created without one.
Danger Zone Tab
Disables Amazon Detective for your entire organization, under the heading Disable Amazon Detective.
The tab leads with the thing that is not recoverable:
Disabling deletes the behavior graph in every region. A behavior graph is not a view over data held somewhere else — it is the analysis Detective has built up from your CloudTrail, VPC flow log and GuardDuty activity, and it is deleted with the graph. That history is not recoverable. There is no export and no restore: re-enabling Detective later creates a new, empty graph that starts accumulating from that moment, and the historical window an investigation could have reached back into is gone.
and then what happens to the member accounts:
Every member account is removed from the graph — which releases the member slots they hold, including the ones held by accounts that never finished joining — and the investigations Prism has cached are deleted. On a clean teardown Prism also detaches the IAM policy it added to each enrolled account’s access role.
To disable Detective:
- Click Disable Amazon Detective.
- A Confirm disable dialog opens. Type your customer ID into the Customer ID field, exactly as the dialog shows it; the Disable button stays disabled until it matches character for character.
- Click Disable.
Prism then returns you to the Amazon Detective entry page, which narrates the teardown under the heading "Disabling Amazon Detective…":
Removing members from the behavior graph, deleting the graph in every enrolled region and detaching the scoped role permissions Prism attached. This can take a few minutes.
The teardown, in each region, removes the member accounts, lets each member disassociate itself, and then deletes the behavior graph last. Once the configuration reaches disabled, that same page shows the setup wizard again.
The typed customer ID is cleared every time the dialog closes. Reopening it with the guard already satisfied — Disable live on the first click — is exactly what the guard exists to prevent.
Disable stays available when setup has failed, which is the other way out of that state and the thing that releases the member slots a partial enable is still holding. It is only blocked while an operation is actually running.
Disabling deletes the behavior graph in every covered region, and a behavior graph's accumulated history is not recoverable. Detective builds its graph from data it has already ingested; deleting it discards that model, and re-enabling Detective later starts from an empty graph that must build up again. Prism's cached investigations are removed at the same time, and all Amazon Detective ingestion charges stop.
Partial Failure on Disable
The teardown is judged on one thing: whether the behavior graph was deleted in every covered region. The graph is what bills, and deleting it removes its members with it, so an outstanding invitation or a failed member removal is not a leak and does not hold the teardown open.
If every graph was deleted, the configuration moves to disabled, the cached investigations are cleared, the permissions policies are detached from every enrolled account's access role, and the setup wizard is shown again.
If a graph survived in any region, the configuration stays in partial_failure rather than moving to disabled, so the affected regions stay visible and billable ingestion is never silently left running. In that case the permissions policies are not detached and the cached investigations are retained. Re-open Settings and disable again to retry; a repeated teardown treats already-removed resources as success, so retrying is safe.
You can re-enable Detective at any time by running the setup wizard again. The new configuration builds new, empty behavior graphs.
Related Pages
- Enrollment, Add, retry, or remove member accounts
- Dashboard, Coverage tiles and the refresh control
- Enabling Detective, Run the setup wizard
- Security Hub Issues, Troubleshooting failed updates and disable operations