FEATURE CE-873: Integrate Inspector into secure baseline module (#28)

Author: marko-fabry

README.md

@@ -142,7 +142,7 @@ This module is composed of several submodules and each of which can be used inde
 | <a name="input_allow_users_to_change_password"></a> [allow\_users\_to\_change\_password](#input\_allow\_users\_to\_change\_password) | Whether to allow users to change their own password. | `bool` | no |
 | <a name="input_analyzer_archive_rules"></a> [analyzer\_archive\_rules](#input\_analyzer\_archive\_rules) | Specifies archive rules for the Access Analyzer. | <pre>map(list(object({<br>    criteria   = string<br>    comparator = string<br>    values     = any<br>  })))</pre> | no |
 | <a name="input_analyzer_baseline_enabled"></a> [analyzer\_baseline\_enabled](#input\_analyzer\_baseline\_enabled) | Boolean whether analyzer-baseline is enabled. | `bool` | no |
-| <a name="input_analyzer_delegated_admin_account_id"></a> [analyzer\_delegated\_admin\_account\_id](#input\_analyzer\_delegated\_admin\_account\_id) | AWS account ID withing AWS Organization that should become delegated administrator of Access Analyzer. This overrides the global `master_account_id` for Access Analyzer. | `string` | no |
+| <a name="input_analyzer_delegated_admin_account_id"></a> [analyzer\_delegated\_admin\_account\_id](#input\_analyzer\_delegated\_admin\_account\_id) | AWS account ID within AWS Organization that should become delegated administrator of Access Analyzer. This overrides the global `master_account_id` for Access Analyzer. | `string` | no |
 | <a name="input_analyzer_global_findings_region"></a> [analyzer\_global\_findings\_region](#input\_analyzer\_global\_findings\_region) | (Optional) Region for which AccessAnalyzer will report findings for global resources (like IAM roles). If specified, suppression rules will be created for all other regions EXCEPT this one to deduplicate the findings. Default value is `null`, so findings for global resources are reported in every region. | `string` | no |
 | <a name="input_analyzer_name"></a> [analyzer\_name](#input\_analyzer\_name) | The name for the IAM Access Analyzer resource to be created. | `string` | no |
 | <a name="input_audit_log_bucket_access_logs_name"></a> [audit\_log\_bucket\_access\_logs\_name](#input\_audit\_log\_bucket\_access\_logs\_name) | The name of the S3 bucket to store various audit logs. | `string` | no |
@@ -185,17 +185,21 @@ This module is composed of several submodules and each of which can be used inde
 | <a name="input_create_password_policy"></a> [create\_password\_policy](#input\_create\_password\_policy) | Define if the password policy should be created. | `bool` | no |
 | <a name="input_create_support_role"></a> [create\_support\_role](#input\_create\_support\_role) | Define if the support role should be created. | `bool` | no |
 | <a name="input_disable_or_delete_cmk_enabled"></a> [disable\_or\_delete\_cmk\_enabled](#input\_disable\_or\_delete\_cmk\_enabled) | The boolean flag whether the disable\_or\_delete\_cmk alarm is enabled or not. No resources are created when set to false. | `bool` | no |
-| <a name="input_guardduty_delegated_admin_account_id"></a> [guardduty\_delegated\_admin\_account\_id](#input\_guardduty\_delegated\_admin\_account\_id) | AWS account ID withing AWS Organization that should become delegated administrator of GuardDuty. This overrides the global `master_account_id` for GuardDuty and enforces AWS Organization-based account management instead of invite-based. | `string` | no |
+| <a name="input_guardduty_delegated_admin_account_id"></a> [guardduty\_delegated\_admin\_account\_id](#input\_guardduty\_delegated\_admin\_account\_id) | AWS account ID within AWS Organization that should become delegated administrator of GuardDuty. This overrides the global `master_account_id` for GuardDuty and enforces AWS Organization-based account management instead of invite-based. | `string` | no |
 | <a name="input_guardduty_disable_email_notification"></a> [guardduty\_disable\_email\_notification](#input\_guardduty\_disable\_email\_notification) | Boolean whether an email notification is sent to the accounts. | `bool` | no |
 | <a name="input_guardduty_enabled"></a> [guardduty\_enabled](#input\_guardduty\_enabled) | Boolean whether the guardduty-baseline module is enabled or disabled | `bool` | no |
 | <a name="input_guardduty_finding_publishing_frequency"></a> [guardduty\_finding\_publishing\_frequency](#input\_guardduty\_finding\_publishing\_frequency) | Specifies the frequency of notifications sent for subsequent finding occurrences. | `string` | no |
 | <a name="input_guardduty_invitation_message"></a> [guardduty\_invitation\_message](#input\_guardduty\_invitation\_message) | Message for invitation. | `string` | no |
-| <a name="input_guardduty_member_accounts"></a> [guardduty\_member\_accounts](#input\_guardduty\_member\_accounts) | A list of IDs and emails of AWS accounts which associated as member accounts for GuardDuty. This overrides `member_accounts` for GuardDuty. | <pre>list(object({<br>    account_id = string<br>    email      = string<br>  }))</pre> | no |
+| <a name="input_guardduty_member_accounts"></a> [guardduty\_member\_accounts](#input\_guardduty\_member\_accounts) | A list of IDs and emails of AWS accounts to be associated as member accounts for GuardDuty. This overrides `member_accounts` for GuardDuty. | <pre>list(object({<br>    account_id = string<br>    email      = string<br>  }))</pre> | no |
 | <a name="input_iam_baseline_enabled"></a> [iam\_baseline\_enabled](#input\_iam\_baseline\_enabled) | Boolean whether iam-baseline is enabled. | `bool` | no |
 | <a name="input_iam_changes_enabled"></a> [iam\_changes\_enabled](#input\_iam\_changes\_enabled) | The boolean flag whether the iam\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | no |
+| <a name="input_inspector_delegated_admin_account_id"></a> [inspector\_delegated\_admin\_account\_id](#input\_inspector\_delegated\_admin\_account\_id) | AWS account ID within AWS Organization that should become delegated administrator of Inspector. This overrides the global `master_account_id` for Inspector. | `string` | no |
+| <a name="input_inspector_enabled"></a> [inspector\_enabled](#input\_inspector\_enabled) | Boolean whether the inspector-baseline module is enabled or disabled | `bool` | no |
+| <a name="input_inspector_member_accounts"></a> [inspector\_member\_accounts](#input\_inspector\_member\_accounts) | A list of IDs and emails of AWS accounts to be associated as member accounts for Inspector. This overrides `member_accounts` for Inspector. | <pre>list(object({<br>    account_id = string<br>    email      = string<br>  }))</pre> | no |
+| <a name="input_inspector_resource_types"></a> [inspector\_resource\_types](#input\_inspector\_resource\_types) | Specifies the types of resources to be scanned with Inspector. | `list(string)` | no |
 | <a name="input_master_account_id"></a> [master\_account\_id](#input\_master\_account\_id) | The ID of the master AWS account to which the current AWS account is associated. Required if `account_type` is `member`. | `string` | no |
 | <a name="input_max_password_age"></a> [max\_password\_age](#input\_max\_password\_age) | The number of days that an user password is valid. | `number` | no |
-| <a name="input_member_accounts"></a> [member\_accounts](#input\_member\_accounts) | A list of IDs and emails of AWS accounts which associated as member accounts. | <pre>list(object({<br>    account_id = string<br>    email      = string<br>  }))</pre> | no |
+| <a name="input_member_accounts"></a> [member\_accounts](#input\_member\_accounts) | A list of IDs and emails of AWS accounts to be associated as member accounts. | <pre>list(object({<br>    account_id = string<br>    email      = string<br>  }))</pre> | no |
 | <a name="input_mfa_console_signin_allow_sso"></a> [mfa\_console\_signin\_allow\_sso](#input\_mfa\_console\_signin\_allow\_sso) | The boolean flag whether the no\_mfa\_console\_signin alarm allows SSO auth to be ignored. | `bool` | no |
 | <a name="input_minimum_password_length"></a> [minimum\_password\_length](#input\_minimum\_password\_length) | Minimum length to require for user passwords. | `number` | no |
 | <a name="input_nacl_changes_enabled"></a> [nacl\_changes\_enabled](#input\_nacl\_changes\_enabled) | The boolean flag whether the nacl\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | no |
@@ -217,13 +221,13 @@ This module is composed of several submodules and each of which can be used inde
 | <a name="input_s3_ignore_public_acls"></a> [s3\_ignore\_public\_acls](#input\_s3\_ignore\_public\_acls) | Whether Amazon S3 should ignore public ACLs for buckets in this account. Defaults to true. | `bool` | no |
 | <a name="input_s3_restrict_public_buckets"></a> [s3\_restrict\_public\_buckets](#input\_s3\_restrict\_public\_buckets) | Whether Amazon S3 should restrict public bucket policies for buckets in this account. Defaults to true. | `bool` | no |
 | <a name="input_security_group_changes_enabled"></a> [security\_group\_changes\_enabled](#input\_security\_group\_changes\_enabled) | The boolean flag whether the security\_group\_changes alarm is enabled or not. No resources are created when set to false. | `bool` | no |
-| <a name="input_securityhub_delegated_admin_account_id"></a> [securityhub\_delegated\_admin\_account\_id](#input\_securityhub\_delegated\_admin\_account\_id) | AWS account ID withing AWS Organization that should become delegated administrator of SecurityHub. This overrides the global `master_account_id` for SecurityHub and enforces AWS Organization-based account management instead of invite-based. | `string` | no |
+| <a name="input_securityhub_delegated_admin_account_id"></a> [securityhub\_delegated\_admin\_account\_id](#input\_securityhub\_delegated\_admin\_account\_id) | AWS account ID within AWS Organization that should become delegated administrator of SecurityHub. This overrides the global `master_account_id` for SecurityHub and enforces AWS Organization-based account management instead of invite-based. | `string` | no |
 | <a name="input_securityhub_enable_aws_foundational_standard"></a> [securityhub\_enable\_aws\_foundational\_standard](#input\_securityhub\_enable\_aws\_foundational\_standard) | Boolean whether AWS Foundations standard is enabled. | `bool` | no |
 | <a name="input_securityhub_enable_cis_standard"></a> [securityhub\_enable\_cis\_standard](#input\_securityhub\_enable\_cis\_standard) | Boolean whether CIS standard is enabled. | `bool` | no |
 | <a name="input_securityhub_enable_pci_dss_standard"></a> [securityhub\_enable\_pci\_dss\_standard](#input\_securityhub\_enable\_pci\_dss\_standard) | Boolean whether PCI DSS standard is enabled. | `bool` | no |
 | <a name="input_securityhub_enable_product_arns"></a> [securityhub\_enable\_product\_arns](#input\_securityhub\_enable\_product\_arns) | List of Security Hub product ARNs, `<REGION>` will be replaced. See https://docs.aws.amazon.com/securityhub/latest/userguide/securityhub-partner-providers.html for list. | `list(string)` | no |
 | <a name="input_securityhub_enabled"></a> [securityhub\_enabled](#input\_securityhub\_enabled) | Boolean whether the securityhub-baseline module is enabled or disabled | `bool` | no |
-| <a name="input_securityhub_member_accounts"></a> [securityhub\_member\_accounts](#input\_securityhub\_member\_accounts) | A list of IDs and emails of AWS accounts which associated as member accounts for Security Hub. This overrides `member_accounts` for Security Hub. | <pre>list(object({<br>    account_id = string<br>    email      = string<br>  }))</pre> | no |
+| <a name="input_securityhub_member_accounts"></a> [securityhub\_member\_accounts](#input\_securityhub\_member\_accounts) | A list of IDs and emails of AWS accounts to be associated as member accounts for Security Hub. This overrides `member_accounts` for Security Hub. | <pre>list(object({<br>    account_id = string<br>    email      = string<br>  }))</pre> | no |
 | <a name="input_support_iam_role_name"></a> [support\_iam\_role\_name](#input\_support\_iam\_role\_name) | The name of the the support role. | `string` | no |
 | <a name="input_tags"></a> [tags](#input\_tags) | Specifies object tags key and value. This applies to all resources created by this module. | `map(string)` | no |
 | <a name="input_target_regions"></a> [target\_regions](#input\_target\_regions) | A list of regions to set up with this module. | `list(string)` | no |