inspector:CreateResourceGroup is a Write access-level action in the inspector service. Grants permission to create a resource group using the specified set of tags (key and value pairs) that are used to select the EC2 instances to be included in an Amazon Inspector assessment target
This action does not support resource-level permissions; use "Resource": "*" in your policy.
No condition keys are documented for this action.
A minimal policy that allows inspector:CreateResourceGroup. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowInspectorCreateResourceGroup",
"Effect": "Allow",
"Action": "inspector:CreateResourceGroup",
"Resource": "*"
}
]
}