Skip to main content

Enrollment

The Enrollment page shows every account enrolled in Amazon Inspector and its current enrollment phase. Use it to add accounts, retry accounts that failed, and remove accounts from Inspector.

Accessing Enrollment​

In the Security Hub sidebar, click Amazon Inspector > Enrollment.

If Inspector has not been set up yet, the page shows an info banner, "Amazon Inspector is not set up yet for this customer", with a Go to setup button that opens the setup wizard.

Configuration Card​

At the top of the page, a Configuration card shows the current Inspector configuration, subtitled "Amazon Inspector runs standalone in each account — there is no delegated administrator":

  • Home region: the region Prism talks to by default
  • Linking regions: every region where Inspector is enabled
  • Scan types: the resource kinds currently being scanned, by their display names
  • Status: the configuration status, for example Enabled, Partial Failure, or In Progress
info

There is no admin account on this page, and there is no admin chip on any row. Amazon Inspector runs standalone in each account, so every enrolled account is a peer and each one runs its own scan in every linking region. No account can be an administrator of another, and no account is exempt from removal.

Banners and Progress Bar​

Depending on the configuration status, one of these appears between the configuration card and the tables:

  • Setup failed. A red banner explains that nothing is running and nothing will resume on its own, that enrollment changes stay unavailable until setup is re-run, and that the accounts below show how far each one got. It carries a Re-run setup button. The tables still render, because they are the record of what happened.
  • Partial failure. An amber banner counts the accounts that did not finish enrolling, notes that every other account is scanning normally, and points you at Retry on the rows below. A failed account is still enrolled, just not yet scanning.

When one or more accounts are in an active phase, or the configuration itself is mid-operation, a progress bar appears below those banners. The page polls the server automatically and the bar advances as the job progresses.

Enrolled Accounts​

The Enrolled accounts card is subtitled "Each account runs its own Inspector scan in every linking region" and carries a chip counting the enrolled accounts. Its table has five columns:

ColumnContents
AccountAccount name (account ID), or the bare account ID if Prism has no name for it
RegionsOne chip per linking region, in the form region · Phase
StatusThe account's rolled-up phase chip, plus any error messages beneath it
RetriesHow many times the account has been retried, or — if never
ActionsRetry (failed rows only) and Remove

If no accounts are enrolled, the table shows an empty state: "No accounts enrolled yet — Pick accounts from the list below and add them to start scanning for vulnerabilities."

Phase Reference​

PhaseColourDescription
PendingGreyEnrollment submitted, waiting to start
Granting accessBluePrism is attaching the Inspector permissions policy to the account's access role and waiting for it to take effect
EnablingBlueAmazon Inspector is being enabled in the account
EnabledGreenFully enrolled and scanning
FailedRedEnrollment failed; see the error message below the chip
RemovingAmberRemoval is in progress
RemovedGreyInspector was torn down in that account and region
note

Granting access is the phase that takes the longest. Prism assumes the account's access role, attaches the policy, and then waits for the change to become usable, which can take several minutes per account. A row sitting in this phase is healthy, not stuck. The page keeps polling throughout.

info

Removed means gone, not switched off. A cell is only marked Removed after Inspector was torn down there and the IAM policy Prism added was detached. An account whose regions are all Removed drops out of the Enrolled accounts table entirely, it is no longer enrolled, no longer granted, and no longer billing. Its rows are kept behind the scenes as the record Prism needs to clean up a leaked policy, and the account reappears in the Not enrolled table so it can be re-enrolled later.

Per-Region Status​

Every row shows one chip per linking region in the Regions column, in the form region · phase. The chips are always visible, there is nothing to expand.

The account's own Status chip rolls those region phases up to one, in this order of precedence:

  1. Failed, if any region failed. It wins because it is the only phase that carries an action.
  2. Removing, Granting access, Enabling, then Pending, if any region is in one of those, checked in that order.
  3. Removed, only if every region is removed, in which case the account is not shown in this table at all.
  4. Enabled, otherwise.

Regions disagreeing is normal rather than exceptional in the flat peer model, most commonly because Amazon Inspector is not available in one of the selected regions. Error messages, when present, appear beneath the status chip, each prefixed with the region it came from.

While an account is in an active phase, a small spinner sits next to its Status chip.

Retrying a Failed Account​

If an account shows Failed, a Retry button appears in its row.

  1. Click Retry next to the failed account.
  2. The account re-enters the enrollment phases from the beginning, including the grant step.
  3. If the retry fails again, read the error message. If it reports a permissions problem, open the Permissions tab in Settings and use Fix roles, then retry. If it names a region, check that Amazon Inspector is available in that region.

The Retries column records how many times each account has been retried.

note

There is no "retry all", and this is deliberate. A retry claims the whole configuration while it runs, so a second retry dispatched immediately after the first is refused. Retry one account, let it settle, then retry the next.

note

Retrying one account never disturbs the accounts that already succeeded. Accounts are enabled independently, so a partial failure is a per-account condition to work through, not a state that has to be cleared before the working accounts produce findings.

Adding Accounts​

The Not enrolled table lists the accounts in your organization that Amazon Inspector is not currently scanning, including any previously removed accounts, which are labelled previously removed.

  1. Select the accounts you want to enroll. Use the header checkbox to select all at once, or check individual rows.
  2. Click Add N to Inspector (where N is the number of selected accounts). With nothing selected the button reads Add to Inspector and is disabled.
  3. Each account enters the enrollment phases, starting at Pending and moving on to Granting access.

When every linked account is already enrolled, the table shows an empty state: "Every linked account is enrolled — Nothing left to add — new accounts appear here once they join the organization."

info

No root email addresses are required. Inspector has no invitation model, so unlike GuardDuty and Macie enrollment, there is no email step, no Enter root emails dialog, and no EmailVerificationFailed failure mode. This is also why Inspector can be enrolled on installations where GuardDuty and Macie enrollment cannot.

Removing an Account​

  1. In the Enrolled accounts table, click Remove in the account's row. The button is present on every row except one that is already Removing.
  2. A confirmation dialog, Remove account from Inspector, appears showing the account ID. There is nothing to type, click Remove to proceed or Cancel to back out.
  3. The account enters the Removing phase. When removal completes it drops out of the Enrolled accounts table and reappears in the Not enrolled table, flagged previously removed.
warning

Removing an account disables Amazon Inspector in that account across every linking region, deletes the findings Prism has cached from it, detaches the Inspector permissions policy from its access role, and stops its scanning charges. Re-adding the account later re-grants the policy and starts a fresh scan.

When Enrollment Changes Are Unavailable​

Add, Retry, and Remove are all disabled unless the configuration has settled, which means status Enabled or Partial Failure.

  • While an operation is running, an info banner above the Not enrolled table says "Enrollment changes are paused while the current operation finishes."
  • If setup failed, that banner is suppressed, nothing is going to finish. The red setup-failed banner at the top of the page is the accurate one, and re-running setup is the way out.

Live Auto-Polling​

While any account is in an active phase (Pending, Granting access, Enabling, or Removing), or while the configuration itself is in progress, the page polls the server automatically and updates the status chips and progress bar without a manual refresh.