The automatic activation for new members in Amazon Inspector was not applied to regions enabled later on existing accounts.

Issue

In an AWS Organizations environment, I have configured "Automatically activate Inspector for new member accounts" from the Amazon Inspector delegated administrator account.

After this configuration, I enabled a new opt-in region on an existing member account 111111111111. However, Amazon Inspector was not automatically activated in that region.

On the other hand, for member account 222222222222 created after the auto-activation setting was configured, Amazon Inspector was automatically activated in the same region.

Even if auto-activation for new members is configured in the delegated administrator account, does this not apply to regions enabled later on existing member accounts?

Answer

In the environment I verified, even when an opt-in region was enabled later on an existing member account, Amazon Inspector was not automatically activated in that region.

The verification results are as follows.

In the official documentation, "Automatically activate Inspector for new member accounts" is described as a setting that targets members to be added to the organization in the future.

The Automatically activate Inspector for new member accounts setting activates Amazon Inspector for all future members of your organization.

https://docs.aws.amazon.com/inspector/latest/user/adding-member-accounts.html

Enabling a region on an existing account is not the same operation as adding that account as a new member to the organization. Therefore, it is considered that auto-activation for new members was not triggered in this case.

Note that the specific behavior when a region is enabled later on an existing account is not explicitly stated in the public documentation. This article presents the verification results from the environment I confirmed.

Verified Behavior

The flow I verified is as follows.

1. Create member account 111111111111 and add it to AWS Organizations
2. Enable Amazon Inspector in the target region on the delegated administrator account
3. Configure "Automatically activate Inspector for new member accounts"
4. Enable the target opt-in region on existing member account 111111111111
5. Check the status of Amazon Inspector in the target region

As a result, Amazon Inspector in the target region was not activated for existing member account 111111111111.

On the other hand, for member account 222222222222 created after the auto-activation setting in step 3, Amazon Inspector was activated in the same region.

From this difference, I confirmed that auto-activation for new members applies when a new member account is added to the organization after the setting is configured, and does not apply when a region is enabled later on an existing account.

How to Activate Existing Accounts

If Amazon Inspector is not activated on an existing account, you can manually activate the target account from the delegated administrator account.

The steps are as follows.

1. Sign in to the Amazon Inspector delegated administrator account
2. Switch to the region where you want to activate Amazon Inspector
3. Open the account management screen in the Amazon Inspector console
4. Select the target member account
5. Activate the required scan types

Note that you operate from the delegated administrator account in the target region, not from the existing account side.

https://docs.aws.amazon.com/ja_jp/inspector/latest/user/adding-member-accounts.html

The scan types available in Amazon Inspector may vary by region. When activating manually, also verify that the required scan types are available in the target region.

Management with Amazon Inspector Policies

If you have many accounts or use many regions, you can also use AWS Organizations Amazon Inspector policies.

With Amazon Inspector policies, you can attach policies to the organization root, OUs, or individual accounts to centrally manage Amazon Inspector activation settings. Both existing and new accounts within the policy's scope can be managed.

https://docs.aws.amazon.com/ja_jp/organizations/latest/userguide/orgs_manage_policies_inspector.html

For individually handling missed activations on existing accounts like this case, you can manually activate from the delegated administrator account. On the other hand, for continuously managing organization-wide settings, using Amazon Inspector policies is an option.

Summary

Amazon Inspector's "Automatically activate Inspector for new member accounts" is a setting that targets new member accounts added to the organization after the setting is configured.

In this verification, even when an opt-in region was enabled later on an existing account, Amazon Inspector was not automatically activated in that region.

When starting to use a new region on an existing account, also check the status of Amazon Inspector, and as needed, consider manually activating from the delegated administrator account or centralized management using Amazon Inspector policies.