Skip to main content

Settings

The Settings page lets you change which resource kinds Inspector scans, change the regions where it runs, check and repair the permissions Inspector needs in each account, and disable Inspector entirely.

Accessing Settings​

In the Security Hub sidebar, click Amazon Inspector > Settings.

If Inspector has not been set up yet, the page shows an info banner, "Amazon Inspector is not set up yet for this customer", with a Go to setup button that opens the setup wizard.

The page has four tabs: Scan types, Regions, Permissions, and Danger zone.

When Saving Is Unavailable​

Both Save buttons require a settled configuration, which means status Enabled or Partial Failure.

  • While an Inspector operation is running, a progress bar at the top of the page reads "An Inspector operation is running — settings are locked until it finishes", and the page polls until it does. You do not need to reload.
  • If setup failed, a red banner says so and offers Re-run setup. Scan types and regions cannot be changed until setup is re-run, but disabling Inspector from the Danger zone still works.

Each Save button is also disabled until you actually change something, so a Save you have not earned is never live.

Scan Types Tab​

Controls which kinds of resource Amazon Inspector scans, in every enrolled account and every linking region.

Scan typeWhat it scans
EC2 instancesOperating-system and application package vulnerabilities on running instances, plus unintended network exposure
ECR container imagesPackage vulnerabilities in images pushed to Amazon ECR, re-scanned as new CVEs are published
Lambda functions — dependenciesThe deployed package and its layers, scanned for vulnerable third-party dependencies. Your own source is not read
Lambda functions — your codeThe function's own source, scanned for insecure code such as injection, hard-coded secrets, and weak crypto. It adds to the dependency scan rather than replacing it, and is billed on top of it
Code repositoriesConnected source repositories, scanned for insecure code, exposed secrets, and vulnerable dependencies declared in their manifests

Each checkbox carries its indicative per-resource price, under the same caveat as the setup wizard: these are indicative us-east-1 list prices for orientation only, and actual charges vary by region, by scan volume, and by AWS pricing changes.

Update your selection and click Save scan types. Saving hands you off to the Enrollment page, because a scan-type change fans out across every enrolled account and that page is where a per-account failure becomes actionable.

warning

This tab is where you control the Inspector bill. Each scan type is billed separately by Amazon Inspector and applies to every enrolled account and linking region. Turning a type off stops its scanning and its charges; turning one on starts both. Enable only the resource kinds you actually need covered.

note

At least one scan type is required. Inspector cannot be left with none selected, the Save button stays disabled and an error is shown. To stop scanning entirely, disable Inspector from the Danger zone tab instead.

Regions Tab​

Adds or removes the regions where Inspector runs. The tab is headed Linking regions.

  • Home region: shown as a read-only value; it cannot be removed.
  • Linking regions: a multi-select list of AWS regions. The home region is locked in the list and cannot be deselected.

If your change drops any region, an amber warning appears above the button naming what saving will tear down. Click Save regions, and when regions are being removed a confirmation dialog, Confirm region removal, opens first. It names the regions being torn down, and if the same save also adds regions it says so. Confirm with Save regions in the dialog, or Cancel. As with scan types, a successful save hands you off to the Enrollment page.

warning

The linking-regions list is not a display filter. Adding a region enables Amazon Inspector there for every enrolled account and starts billing for it. Removing a region disables Inspector in that region in every enrolled account and deletes the findings Prism has cached from it. Adding the region back later starts a fresh scan rather than restoring what was deleted.

note

Amazon Inspector is not available in every AWS region. Selecting an unsupported region causes enablement to fail for that region only, the rest of the update still succeeds and the configuration settles in partial failure.

Permissions Tab​

Prism needs a small, enumerated set of Amazon Inspector permissions in each enrolled account, which it attaches as a policy on that account's access role. This tab, headed Account permissions, reports whether that policy is currently in place and correct in every enrolled account, and repairs it where it is not.

When you open the tab, a scan starts automatically and shows Checking account permissions… while it runs. Each account is then listed with its account ID, its permissions state, and any error detail:

StateMeaning
CurrentThe expected policy is attached and up to date
Needs updateA policy is attached but does not match what Prism expects
MissingNo policy is attached

Below the table:

  • Fix roles re-applies the policy to the affected accounts, then re-runs the scan so you can confirm the result. It is disabled when nothing needs attention.
  • Re-check re-runs the scan on its own, without changing anything.
  • A summary line reads either "All accounts are up to date." or "N accounts need attention."

If no accounts are enrolled yet, the tab says so instead of showing an empty table.

Use this tab when:

  • An account failed enrollment with a permissions or AccessDenied error, fix the roles, then Retry the account from Enrollment
  • The policy was removed or edited directly in AWS
  • A Prism update changed the set of permissions Inspector requires
info

This is a standing grant, not a temporary escalation. The policy stays attached to each enrolled account's access role for as long as that account is enrolled, and is detached when the account is removed or when Inspector is cleanly disabled. It grants only the specific Inspector actions Prism calls, no service wildcards, no AWS Organizations permissions, and nothing that would require management-account access.

Danger Zone Tab​

Disables Amazon Inspector for your entire organization. This tab stays available even when setup has failed, it is the way out of that state.

To disable Inspector:

  1. Click Disable Inspector.
  2. A confirmation dialog, Confirm disable, opens. Type your customer ID into the Customer ID field exactly as shown in the dialog.
  3. Click Disable. The button stays disabled until what you typed matches exactly.

Prism then returns you to the Inspector page, which narrates the teardown as Disabling Amazon Inspector… with a progress bar, and shows the setup wizard again once the status reaches disabled.

note

The typed customer ID is cleared whenever the dialog closes, so reopening it always starts from an empty field.

warning

Disabling turns Amazon Inspector off in every enrolled account and region, removes the cached findings, and stops all Inspector scanning charges. On a clean teardown Prism also detaches the IAM policy it added to each account's access role.

Partial Failure on Disable​

If every teardown step succeeds, the configuration moves to disabled, the cached findings are cleared, and the setup wizard is shown again.

If any teardown step genuinely fails, the configuration stays in partial_failure rather than moving to disabled, so the affected accounts stay visible for retry and billable Inspector scanning is never silently left running. In that case the permission policies are not detached and the cached findings are retained, and the status message names every account that did not tear down. Re-open Settings and disable again to retry the remaining teardown; a repeated teardown treats already-removed resources as success, so retrying is safe.

info

You can re-enable Inspector at any time by running the setup wizard again.