Can't start Inspector on-demand CIS scan from DA account

The error you're encountering is related to how Amazon Inspector CIS scans work in an AWS Organizations setup with a delegated administrator (DA).

While the delegated administrator account has centralized control over Amazon Inspector deployment and can manage scan configurations for accounts in the organization, there's an important limitation: the delegated administrator cannot edit or create scan configurations for member accounts that those member accounts have already created themselves.

In your case, it appears you're trying to create a CIS scan configuration from your delegated administrator account for member accounts. The error suggests that your delegated administrator account doesn't have the proper permissions to create these scan configurations.

Here are some things to check:

1. Ensure that trusted access is properly enabled between Amazon Inspector and AWS Organizations. This is required before you can designate a member account as the delegated administrator.

2. Verify that your user has the necessary IAM permissions, including the iam:PassRole permission, which allows you to pass a role to Amazon Inspector. This is often a common issue when working with services that require role-passing.

3. Check if the member accounts already have their own scan configurations. If they do, the delegated administrator cannot modify them.

4. Make sure all the required VPC endpoints are properly configured if your instances are in a private VPC.

5. Ensure the S3 buckets required by both SSM and Inspector are properly allowlisted in your VPC endpoint policies.

Since you mentioned that running scans in your own account works well, the issue is likely related to the cross-account permissions or configuration. The delegated administrator has certain limitations when managing CIS scans across accounts in an organization.
Sources
Center for Internet Security (CIS) scans for Amazon EC2 instance operating systems - Amazon Inspector
Amazon Inspector suppression rules best practices for AWS Organizations | AWS Security Blog
Amazon Inspector and AWS Organizations - AWS Organizations
Troubleshooting Amazon Inspector identity and access - Amazon Inspector