Class InspectorVerificationFactory

java.lang.Object
software.amazon.jsii.JsiiObject
software.constructs.Construct
com.cloudforgeci.api.core.annotation.BaseFactory
com.cloudforgeci.api.observability.InspectorVerificationFactory
All Implemented Interfaces:
software.amazon.jsii.JsiiSerializable, software.constructs.IConstruct, software.constructs.IDependable
public class InspectorVerificationFactory extends BaseFactory
Verifies Amazon Inspector is reachable for this account, instead of enabling it from the application stack.

Same reasoning as SecurityHubVerificationFactory/MacieVerificationFactory: Inspector is an account-wide setting an org may already own centrally, and an application deploy role enabling it is a real IAM-blast-radius concern on top of the collision risk InspectorFactory already solves.

This check is weaker than the Security Hub/Macie ones -- read before relying on it. Unlike securityhub:DescribeHub/macie2:GetMacieSession, which throw when the service isn't enabled, inspector2:BatchGetAccountStatus always succeeds and reports resourceState.ec2.status/resourceState.ecr.status as ENABLED, DISABLED, or SUSPENDED in its response body -- there's no API that throws on "not enabled" the way Security Hub/Macie's do. An AwsSdkCall-only custom resource (the pattern every other factory in this package uses) can only fail on the API call itself failing, not on a value inside a successful response, so this cannot yet gate a deploy on Inspector actually being disabled. Closing that gap needs a Lambda-backed custom resource -- real added scope (function code, bundling, its own IAM role) beyond what this check justifies on its own. This resource still verifies the account is one Inspector's API recognizes at all (fails on account/permission errors), which is a real, if narrower, guarantee.

InspectorFactory is left in place, unused, for the case a future deployment model wants CFC to own provisioning again.

  • Nested Class Summary

    Nested classes/interfaces inherited from class software.amazon.jsii.JsiiObject

    software.amazon.jsii.JsiiObject.InitializationMode

    Nested classes/interfaces inherited from interface software.constructs.IConstruct

    software.constructs.IConstruct.Jsii$Default, software.constructs.IConstruct.Jsii$Proxy

  • Field Summary

    Fields inherited from class BaseFactory

    cfc, config, ctx

  • Constructor Summary

    Constructors
    Constructor
    Description
    InspectorVerificationFactory(software.constructs.Construct scope, String id)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    create()
    Resolves whether Inspector is required, then checks the account is reachable via Inspector's API -- see the class javadoc for why this can't yet gate on the account's actual enabled/disabled status.

    Methods inherited from class BaseFactory

    getDeploymentContext, getSecurityProfileConfiguration, getSystemContext

    Methods inherited from class software.constructs.Construct

    getNode, isConstruct, toString

    Methods inherited from class software.amazon.jsii.JsiiObject

    jsiiAsyncCall, jsiiAsyncCall, jsiiCall, jsiiCall, jsiiGet, jsiiGet, jsiiSet, jsiiStaticCall, jsiiStaticCall, jsiiStaticGet, jsiiStaticGet, jsiiStaticSet, jsiiStaticSet

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

    Methods inherited from interface software.amazon.jsii.JsiiSerializable

    $jsii$toJson

  • Constructor Details

    • InspectorVerificationFactory

      public InspectorVerificationFactory(software.constructs.Construct scope, String id)
      Parameters:
      scope - parent construct
      id - construct ID

  • Method Details

    • create

      public void create()
      Resolves whether Inspector is required, then checks the account is reachable via Inspector's API -- see the class javadoc for why this can't yet gate on the account's actual enabled/disabled status.
      Specified by:
      create in class BaseFactory