AWS Inspector V2

Evidence Collected:

Inspector account status and enablement state
Resource coverage and scan status (EC2, ECR, Lambda)
Vulnerability findings with severity, CVE identifiers, and remediation recommendations
Coverage statistics by resource type
Organization member account scanning status

Usage:

# Basic evidence collection (default - creates evidence, no issues)
regscale aws sync_inspector --regscale_id 123

# Collect evidence for specific controls
regscale aws sync_inspector --regscale_id 123 --evidence-control-ids RA-5,SI-2,CM-6

# Filter by AWS account
regscale aws sync_inspector --regscale_id 123 --account-id 123456789012

# Filter by resource tags
regscale aws sync_inspector --regscale_id 123 --tags Environment=production,Compliance=required

# Create issues/vulnerabilities from findings (non-default)
regscale aws sync_inspector --regscale_id 123 --create-issues --create-vulnerabilities --no-collect-evidence

# Create POA&Ms for failed controls
regscale aws sync_inspector --regscale_id 123 --create-poams --update-control-status

# Force refresh cached data (cache TTL: 4 hours)
regscale aws sync_inspector --regscale_id 123 --force-refresh

---
Inspector V2 Integration Permissions

┌───────────────────────────────────┬───────────────────────────────────────────────┐
│            Permission             │                    Purpose                    │
├───────────────────────────────────┼───────────────────────────────────────────────┤
│ inspector2:BatchGetAccountStatus  │ Check if Inspector is enabled for the account │
├───────────────────────────────────┼───────────────────────────────────────────────┤
│ inspector2:ListCoverage           │ List resources covered by Inspector scans     │
├───────────────────────────────────┼───────────────────────────────────────────────┤
│ inspector2:ListCoverageStatistics │ Get coverage stats by resource type           │
├───────────────────────────────────┼───────────────────────────────────────────────┤
│ inspector2:ListFindings           │ Pull vulnerability findings                   │
├───────────────────────────────────┼───────────────────────────────────────────────┤
│ inspector2:ListMembers            │ List org member accounts (multi-account only) │
└───────────────────────────────────┴───────────────────────────────────────────────┘

Minimum IAM Policy:
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "RegScaleInspectorReadOnly",
      "Effect": "Allow",
      "Action": [
        "inspector2:BatchGetAccountStatus",
        "inspector2:ListCoverage",
        "inspector2:ListCoverageStatistics",
        "inspector2:ListFindings",
        "inspector2:ListMembers"
      ],
      "Resource": "*"
    }
  ]
}

▎ Note: All Inspector V2 permissions require Resource: "*" — Inspector does not support resource-level restrictions. This is read-only access; the integration never modifies AWS resources.

Optional (for cross-account access via role assumption):
{
  "Sid": "RegScaleCrossAccountAssume",
  "Effect": "Allow",
  "Action": ["sts:AssumeRole"],
  "Resource": "arn:aws:iam::<TARGET_ACCOUNT>:role/<ROLE_NAME>"
}

---
Inspector V2 Authentication

Supports multiple authentication methods (priority order):

1. Cached session (--session-name): From regscale aws auth login
2. Explicit credentials: --aws-access-key-id + --aws_secret_access_key + optional --aws_session_token
3. AWS profile (--profile): Named profile from ~/.aws/credentials
4. Default credential chain: Environment variables, EC2 instance metadata, ECS task role

---
Inspector V2 NIST 800-53 R5 Evidence Workflow

# Complete Inspector evidence collection across all mapped controls
regscale aws sync_inspector --regscale_id 123 --evidence-control-ids RA-5,SI-2,CM-6,SA-11

# Production environment only
regscale aws sync_inspector --regscale_id 123 --tags Environment=production --evidence-control-ids RA-5,SI-2

# Multi-account organization - filter by account
regscale aws sync_inspector --regscale_id 123 --account-id 123456789012

# Full compliance run with issues and POA&Ms
regscale aws sync_inspector --regscale_id 123 \
  --create-issues \
  --create-vulnerabilities \
  --create-poams \
  --update-control-status \
  --evidence-control-ids RA-5,SI-2,CM-6,SA-11

---
Inspector V2 Prerequisites

1. AWS Inspector V2 must be enabled in the target account — the integration checks this via BatchGetAccountStatus before proceeding
2. Resource scanning must be active — enable EC2, ECR, and/or Lambda scanning in Inspector settings
3. For multi-account setups: The calling account must be a delegated administrator for Inspector in the organization
4. Caching: Data is cached for 4 hours use --force-refresh to bypass

Filtering Resources by Tags:

sync_inspector can filter which resources it syncs by their AWS resource tags. Two filters are available and can be combined in a single run:

--tags — include filter. Only resources carrying all of the listed tags are synced (AND).
--exclude_tags — exclude filter. Resources carrying the listed tags are skipped. By default a resource is dropped if it carries any one of the listed tags (OR); pass --exclude_tags_match all to drop a resource only when it carries every listed tag (AND).

Both filters use the same key=value,key2=value2 format. When a resource matches both an include and an exclude tag, exclude wins — the resource is skipped.

# Include only resources tagged Environment=production AND Compliance=required
regscale aws sync_inspector --regscale_id 123 --tags Environment=production,Compliance=required

# Exclude resources tagged Environment=dev OR Team=sandbox (default "any" match)
regscale aws sync_inspector --regscale_id 123 --exclude_tags Environment=dev,Team=sandbox

# Exclude only resources tagged BOTH Environment=dev AND Team=sandbox
regscale aws sync_inspector --regscale_id 123 --exclude_tags Environment=dev,Team=sandbox --exclude_tags_match all

# Combine: sync production resources, but skip anything in the sandbox team
regscale aws sync_inspector --regscale_id 123 --tags Environment=production --exclude_tags Team=sandbox

Flag	Purpose
`--tags`	Include only resources carrying all listed tags (format: `key=value,key2=value2`)
`--exclude_tags`	Skip resources carrying the listed tags (format: `key=value,key2=value2`)
`--exclude_tags_match`	How `--exclude_tags` matches: `any` (default, drop if any tag matches) or `all` (drop only if every tag matches)

▎ Note: Tag filtering applies to the AWS resources behind Inspector findings and coverage. The include filter (--tags) is applied when retrieving data from Inspector; the exclude filter (--exclude_tags) is applied after retrieval, so excluded resources are fetched and then filtered out. Each flag accepts either the underscore or hyphen form (for example, --exclude_tags and --exclude-tags are equivalent).

AWS Inspector V2 — Container Configuration

The regscale aws sync_inspector command syncs AWS Inspector V2 findings, including
ECR container images. Two init.yaml settings control container ingestion. Both are
optional—the defaults already cover containers—and both can be overridden per run with
CLI flags.

init.yaml settings

# Comma-separated resource types to sync (includes the ECR container types)
inspectorResourceTypes: AWS_ECR_CONTAINER_IMAGE,AWS_ECR_REPOSITORY,AWS_EC2_INSTANCE,AWS_LAMBDA_FUNCTION

# Sync only the newest-pushed image digest per ECR repository
inspectorDedupeEcrImages: true

Setting	Default	Description
`inspectorResourceTypes`	All four types shown above	Which Inspector resource types are ingested. For containers, include `AWS_ECR_CONTAINER_IMAGE` (and optionally `AWS_ECR_REPOSITORY`). Remove the non-container types if you only want to sync containers.
`inspectorDedupeEcrImages`	`true`	When `true`, syncs findings for only the newest-pushed image digest per ECR repository (dropping mutable-tag-only images). Set to `false` to sync findings for every image digest.

📘
You may not need to set either value
The defaults already include the ECR container resource types and enable digest
deduplication. Only add these to init.yaml if you want to narrow the resource-type
list or disable deduplication.

Container-only example

To sync only ECR container images and repositories:

inspectorResourceTypes: AWS_ECR_CONTAINER_IMAGE,AWS_ECR_REPOSITORY
inspectorDedupeEcrImages: true

Per-run CLI overrides

Command-line flags take precedence over init.yaml:

Flag	Overrides
`--resource_types AWS_ECR_CONTAINER_IMAGE,...`	`inspectorResourceTypes`
`--dedupe_ecr_images` / `--no_dedupe_ecr_images`	`inspectorDedupeEcrImages`

Example:

regscale aws sync_inspector --regscale_id 123 --resource_types AWS_ECR_CONTAINER_IMAGE --no_dedupe_ecr_images

AWS Inspector V2 — Container Configuration

init.yaml settings

📘You may not need to set either value

Container-only example

Per-run CLI overrides

📘
You may not need to set either value