Review scan report with AWS Inspector V2 — Stage 2
Follow up on my Virtual machine blogs about
- Azure Virutal Machine’s Identity — Zero credentials solution
- Set Backup on Azure Virtual Machine
- Implement CIS Hardening Build Kit On RHEL9 — Stage 1
- Review scan report with AWS Inspector V2 — Stage 2
- [Packer] The new design to build golden images for multiple cloud platforms
Several series for the topic:
- Stage 1 — implement CIS hardeing, this is discussed (in this blog)
- Stage 2 — Review scan report with AWS Inspector V2 after CIS hardening in this blog
This marks the second stage of our discussion on performing hardening using the CIS build kit, with a specific focus on security vulnerability scan reports. This information isn’t limited to CIS paying users; it’s relevant to all AWS clients who seek to obtain security vulnerability scan reports for their EC2 instances.
In my case, I am currently working on an AWS hardening report, I use AWS managed service, called Inspector v2. If your situation involves different public cloud providers or if your company has license on other scan tools , such as Qualys (https://www.qualys.com/), you should be able to contact them to obtain a similar report as well.
Review scan report in AWS Inspector v2
Recommend to compare the differences before and after hardening, you can run the scan before hardening and check again after hardening.
- Before hardening, get the current latest RHEL 9 AMI Image id, it is
ami-062680d0a2ee357d0
Use this AMI to create a new AWS ec2 instance directly, and wait for the Inspector scan report.
Notes: when create the instance, make sure it is SSM agent enabled, which need a special IAM policy AmazonSSMManagedInstanceCoreassigned in its IAM instance profile
- create another instance from above AMI, run the hardening script with
yum updateas well. After hardening, wait for Inspector v2 report
You will see the report in critical and high are reduced.
Images before yum update and CIS hardening
Images after CIS hardening
If there is no fingings on that instance, you would not see it in Inspector Findings: By instance list, it still appeared in Inspector Account management, instance, scanning list
Sometime, you can’t get any report from the instance which has been hardening. That means no findings found. This makes me confused at beginning, because I don’t know if the inspector did the scan or not. I have reported to AWS and ask for improvement, such as, still report it, with 0 item. but we need wait for this feature.
