This component is responsible for configuring Inspector V2 within an AWS Organization.
Stack Level: Regional
The deployment of this component requires multiple runs with different variable settings to properly configure the AWS Organization. First, you delegate Inspector V2 central management to the Administrator account (usually
security account). After the Adminstrator account is delegated, we configure the it to manage Inspector V2 across all the Organization accounts and send all their findings to that account.
In the examples below, we assume that the AWS Organization Management account is
root and the AWS Organization Delegated Administrator account is
Deploy to Organization Management Account
First, the component is deployed to the AWS Organization Management account
root in each region in order to configure the AWS Delegated Administrator account that operates Amazon Inspector V2.
Deploy Organization Settings in Delegated Administrator Account
Now the component can be deployed to the Delegated Administrator Account
security to create the organization-wide configuration for all the Organization accounts. Note that
var.admin_delegated set to
true indicates that the delegation has already been performed from the Organization Management account, and only the resources required for organization-wide configuration will be created.
|account_map_tenant||The tenant where the ||no|
|additional_tag_map||Additional key-value pairs to add to each map in |
This is for some rare cases where resources want additional configuration of tags
and therefore take a list of maps with tag key, value, and additional configuration.
|admin_delegated||A flag to indicate if the AWS Organization-wide settings should be created. This can only be done after the GuardDuty|
Admininstrator account has already been delegated from the AWS Org Management account (usually 'root'). See the
Deployment section of the README for more information.
|attributes||ID element. Additional attributes (e.g. |
in the order they appear in the list. New attributes are appended to the
end of the list. The elements of the list are joined by the
and treated as a single ID element.
|auto_enable_ec2||Whether Amazon EC2 scans are automatically enabled for new members of the Amazon Inspector organization.||no|
|auto_enable_ecr||Whether Amazon ECR scans are automatically enabled for new members of the Amazon Inspector organization.||no|
|auto_enable_lambda||Whether Lambda Function scans are automatically enabled for new members of the Amazon Inspector organization.||no|
|context||Single object for setting entire context at once.|
See description of individual variables for details.
Leave string and numeric variables as
Individual variable settings (non-null) override settings in context object,
except for attributes, tags, and additional_tag_map, which are merged.
|delegated_administrator_account_name||The name of the account that is the AWS Organization Delegated Administrator account||no|
|delimiter||Delimiter to be used between ID elements.|
|descriptor_formats||Describe additional descriptors to be output in the |
Map of maps. Keys are names of descriptors. Values are maps of the form
Label values will be normalized before being passed to
identical to how they appear in
|enabled||Set to false to prevent the module from creating any resources||no|
|environment||ID element. Usually used for region e.g. 'uw2', 'us-west-2', OR role 'prod', 'staging', 'dev', 'UAT'||no|
|global_environment||Global environment name||no|
Does not affect
|label_key_case||Controls the letter case of the |
Does not affect keys of tags passed in via the
|label_order||The order in which the labels (ID elements) appear in the |
Defaults to ["namespace", "environment", "stage", "name", "attributes"].
You can omit any of the 6 labels ("tenant" is the 6th), but at least one must be present.
|label_value_case||Controls the letter case of ID elements (labels) as included in |
set as tag values, and output by this module individually.
Does not affect values of tags passed in via the
Set this to
|labels_as_tags||Set of labels (ID elements) to include as tags in the |
Default is to include all labels.
Tags with empty values will not be included in the
The value of the
changed in later chained modules. Attempts to change it will be silently ignored.
|member_association_excludes||List of account names to exlude from Amazon Inspector member association||no|
|name||ID element. Usually the component or solution name, e.g. 'app' or 'jenkins'.|
This is the only ID element not also included as a
The "name" tag is set to the full
|namespace||ID element. Usually an abbreviation of your organization name, e.g. 'eg' or 'cp', to help ensure generated IDs are globally unique||no|
|organization_management_account_name||The name of the AWS Organization management account||no|
|privileged||true if the default provider already has access to the backend||no|
|regex_replace_chars||Terraform regular expression (regex) string.|
Characters matching the regex will be removed from the ID elements.
If not set,
|root_account_stage||The stage name for the Organization root (management) account. This is used to lookup account IDs from account names|
|stage||ID element. Usually used to indicate role, e.g. 'prod', 'staging', 'source', 'build', 'test', 'deploy', 'release'||no|
|tags||Additional tags (e.g. |
Neither the tag keys nor the tag values will be modified by this module.
|tenant||ID element _(Rarely used, not included by default)_. A customer identifier, indicating who this instance of a resource is for||no|
|aws_inspector2_member_association||The Inspector2 member association resource.|