Attaching an Amazon Inspector policy in AWS Organizations may take time to activate depending on the region.
This page has been translated by machine translation. View original
Issue
I have attached an Amazon Inspector policy to the organization root in AWS Organizations, with the target region set to ALL_SUPPORTED, and have enabled Amazon ECR scanning and Lambda scanning.
After attaching the policy, Amazon Inspector was enabled in other regions, but when I checked the us-east-2 region, I saw a screen showing that Amazon Inspector had not yet been enabled.
Screen showing Amazon Inspector had not yet been enabled in us-east-2
Even though the Amazon Inspector policy in AWS Organizations was attached to the organization root with the target region set to ALL_SUPPORTED, why was Amazon Inspector not being enabled only in us-east-2?
Answer
In conclusion, in the behavior observed this time, us-east-2 was not excluded from the Amazon Inspector policy — it was simply enabled later than the other regions.
Upon checking CloudTrail, other regions were enabled immediately after the policy was applied. However, only us-east-2 had its Amazon Inspector Enable event recorded approximately 9 hours later.
Therefore, it seems prudent to keep in mind that even when ALL_SUPPORTED is specified in the AWS Organizations Amazon Inspector policy, enablement may not complete in all regions at the same time.
The AWS documentation states that specifying ALL_SUPPORTED enables Amazon Inspector in all currently and future supported regions unless it is explicitly disabled. It also states that policy application is performed independently for each region.
However, the AWS documentation reviewed did not explicitly state how much lag may occur before Amazon Inspector enablement completes in each region after the policy is applied.
Therefore, if only a specific region appears unenabled, it seems best to verify the actual Enable event in CloudTrail, and then re-check the enablement status in the console the next day or after some time has passed.
Findings
The Amazon Inspector enablement process can be verified from the event history in CloudTrail.
If a specific region appears unenabled in the console, you can check whether the Amazon Inspector enablement process was executed in that region by looking for an Enable event from inspector2.amazonaws.com in CloudTrail.
When checking in CloudTrail, select the target region and search using the following criteria.
| Item | Value |
|---|---|
| Event name | Enable |
| Event source | inspector2.amazonaws.com |
In this verification, an Enable event was recorded by AWSServiceRoleForAmazonInspector2, which is the service-linked role for Amazon Inspector.
Other Regions Were Enabled Immediately
The following is an example from CloudTrail verified in another region.
Enable event confirmed immediately after policy application in other regions
In other regions, the Enable event was recorded immediately after the Amazon Inspector policy was applied.
us-east-2 Was Enabled Approximately 9 Hours Later
In contrast, in us-east-2, the Enable event was recorded approximately 9 hours later than in other regions.
Enable event confirmed approximately 9 hours later than other regions in us-east-2
From this, it can be determined that us-east-2 was not excluded from the Amazon Inspector policy — it simply took time for the enablement process to complete.
Enable Events May Be Recorded Even After Enablement
It should also be noted that in CloudTrail, Enable events from InspectorOrganizationManagement... may be recorded even in regions where Amazon Inspector is already enabled.
In this verification, Enable events from InspectorOrganizationManagement... were recorded approximately 4 times over 2 weeks in us-east-1, and multiple times per day in ap-southeast-7.
As observed, the frequency of these recordings varied by region.
However, the reason for this difference and the execution interval could not be confirmed in the AWS documentation.
Therefore, rather than definitively concluding that these events are retries upon failure, it seems best to treat them as potentially being recorded as part of per-region organization management processing on the Amazon Inspector / AWS Organizations side.
Approximately 4 times over 2 weeks in us-east-1
Multiple times per day in ap-southeast-7
Summary
Even when ALL_SUPPORTED is specified in the AWS Organizations Amazon Inspector policy, in this verification, enablement of us-east-2 completed approximately 9 hours later than the other regions.
If a specific region appears unenabled, you can track whether the enablement process was actually carried out by checking for an Enable event from inspector2.amazonaws.com in CloudTrail for that region.
Since the AWS documentation does not provide a guideline for the lag until enablement completes after policy application, it seems best not to judge solely by the state shown in the console, but to also check CloudTrail and re-verify after some time has passed.
