Enabling Inspector
The Inspector setup wizard walks you through four steps to deploy Amazon Inspector across your organization. After you submit, an asynchronous job attaches the required permissions to each selected account's access role, waits for those permissions to take effect, and then enables Inspector in each account and region.
Accessing the Wizard
- If no Security Hub engine is enabled yet, the Security Hub Overview page drops straight into the Enable Security Hub capability panel. Click Enable on the Amazon Inspector card.
- If another engine (CSPM, GuardDuty, Macie, or Detective) is already live, the Overview instead shows one tile per engine; the Amazon Inspector tile carries an Enable button. The same panel is also available at Configuration > Capabilities, where the Inspector card's button reads Enable, and Configure once Inspector is on.
- While Inspector is not enabled, the sidebar shows a single Enable Amazon Inspector row that opens the same wizard. Once it is enabled, that row becomes an Amazon Inspector group containing Dashboard, Findings, Enrollment, and Settings.
Wizard Steps
| Step | Name | What you configure |
|---|---|---|
| 1 | Accounts | The AWS accounts to scan |
| 2 | Regions | The home region and every region Inspector is enabled in |
| 3 | Scan types | Which kinds of resource Inspector scans |
| 4 | Review | Confirm all settings before submitting |
Next stays disabled until the step you are on is complete, and Back is disabled on step 1. You can move back and forth freely before submitting.
There is no admin-account step and no emails step. Inspector uses a flat peer model with no delegated administrator and no invitation flow, so no account is nominated as an administrator and no AWS root email addresses are needed.
Prerequisites
- At least one AWS account is onboarded in Prism
Step 1: Accounts
Select the AWS accounts you want Amazon Inspector to scan. Every selected account is enabled independently and on equal footing, none of them is an administrator over the others.
| Field | Required | Notes |
|---|---|---|
| Accounts | Yes | Multi-select checkbox list; each option reads Account name (account ID) |
The picker has a Select all row at the top (it flips to Deselect all once everything is chosen), and summarizes the current selection as chips, collapsing to +N more past six. If Prism returns no linked accounts, the wizard says so under the field: "No linked AWS accounts were returned for this organization."
You can add or remove accounts after setup from the Enrollment page without rerunning the wizard.
Step 2: Regions
Select the home region and every region where Inspector is enabled.
| Field | Required | Default | Notes |
|---|---|---|---|
| Home region | Yes | us-east-1 | Single-select; changing it adds the new region to Scanned regions automatically |
| Scanned regions | Yes | us-east-1 | Multi-select; the home region is locked in the list and cannot be deselected |
Inspector is enabled separately in every region you pick, and each region scans and bills on its own. Because there is no aggregation account, the home region is not an aggregation region, Prism does the aggregating itself. The home region is simply always scanned and is the region Prism talks to by default.
The field is labelled Scanned regions in the wizard. Everywhere else in Prism, the same list is called Linking regions, on the Enrollment page's configuration card and on the Settings Regions tab.
Amazon Inspector is not available in every AWS region. Selecting an unsupported region causes enablement to fail for that region only, the rest of the enablement still succeeds. The configuration then settles in partial failure and the affected cells are listed on the Enrollment page.
Step 3: Scan Types
Choose which kinds of resource Amazon Inspector scans. At least one scan type is required.
| Scan type | What it scans | Indicative cost |
|---|---|---|
| EC2 instances | Operating-system and application package vulnerabilities on running instances, plus unintended network exposure | ≈ $1.26 per instance / month |
| ECR container images | Package vulnerabilities in images pushed to Amazon ECR, re-scanned as new CVEs are published | ≈ $0.09 per initial image scan |
| Lambda functions — dependencies | The deployed package and its layers, scanned for vulnerable third-party dependencies. Your own source is not read | ≈ $0.30 per function / month |
| Lambda functions — your code | The function's own source, scanned for insecure code such as injection, hard-coded secrets, and weak crypto | ≈ $0.90 per function / month |
| Code repositories | Connected source repositories, scanned for insecure code, exposed secrets, and vulnerable dependencies declared in their manifests | See AWS Inspector pricing |
EC2 instances and ECR container images are ticked by default, the two surfaces almost every account has.
The prices above are shown in the wizard next to each checkbox, under this caveat: "Prices are indicative us-east-1 list prices for orientation only — actual charges vary by region, by scan volume and by AWS pricing changes." Check the AWS Inspector pricing page before enabling a surface at scale.
The two Lambda scan types are different things and are billed separately. Lambda functions — dependencies scans the deployed package and its layers for vulnerable third-party libraries and does not read your source. Lambda functions — your code scans the function's own source for insecure code. Code scanning adds to the dependency scan rather than replacing it, and is billed on top of it.
If you tick your code without dependencies, the wizard points out that most deployments want both boxes.
If you clear every box, the wizard blocks the step: "Pick at least one scan type — Inspector cannot be enabled with none."
This step is where you control the Inspector bill. Each scan type is billed separately by AWS and applies to every enrolled account and every scanned region. You can change the selection at any time from Settings.
Step 4: Review
The Review step summarizes your selections before you submit, in this order:
- Accounts, listed by name when you picked three or fewer, otherwise shown as
N accounts - Home region
- Scanned regions
- Scan types
Below the summary, the wizard restates the blast radius: Inspector will be turned on in N accounts × M regions and starts billing per resource scanned as soon as it is enabled, and enrollment runs per account so a failure in one does not stop the others.
Click Enable Inspector to submit. The button reads Enabling… while the request is in flight.
If the request is rejected, the error is shown on the Review step rather than jumping you to another step, because every rejection here (an account that does not belong to the organization, an unsupported scan type, Inspector already enabled) is reachable with Back.
What Happens After Submission
After you click Enable Inspector, the wizard hands off to an asynchronous job. The wizard body is replaced by a status card headed Setting up Amazon Inspector…, with a progress bar and the home region and account count beneath it. The card polls the server and hands over to the Inspector dashboard as soon as the run settles.
For each selected account, the job:
- Assumes that account's access role and attaches the Inspector permissions policy to it (phase Granting access)
- Waits until those permissions are actually usable in the account, IAM changes take time to propagate, so this phase can run for several minutes
- Enables Amazon Inspector in the account for each scanned region, with the scan types you selected (phase Enabling)
- Marks the account Enabled
The Granting access phase legitimately takes minutes. The page keeps polling throughout and the per-account phases update on their own, but the progress bar can sit at the same percentage for a long stretch while IAM propagates. A long pause here is normal and is not a stalled job.
Partial Success
Accounts are enabled independently, so some can succeed while others fail. If any account or region fails, the overall status becomes partial_failure:
- The accounts that succeeded are live and start producing findings straight away.
- The Dashboard shows a warning banner, "Some accounts are not fully enrolled in Amazon Inspector", followed by the failure detail and a Review button that opens Enrollment.
- The Enrollment page lists each failing account with its error message and a Retry button.
- If the failure was a permissions problem, use the Permissions tab in Settings to re-check and Fix roles.
Nothing is rolled back on partial failure, and retrying one account does not disturb the others.
A prior failed or disabled Inspector configuration is cleared automatically when you resubmit the wizard. You do not need to manually delete the old state before running setup again. If the last attempt failed, the wizard opens with a warning carrying that failure's message and a reminder that submitting again clears the state and retries.
Related Pages
- Dashboard, What you see after setup completes
- Enrollment, Add more accounts or retry failed ones
- Settings, Change scan types, regions, or permissions after setup
- Security Hub Issues, Troubleshooting setup failures