Amazon Inspector
Amazon Inspector is a vulnerability management service that continuously scans your AWS infrastructure for vulnerabilities. It automatically discovers and scans Amazon EC2 instances, VPCs, container images residing in Amazon Elastic Container Service, and lambda functions (both Standard scanning and Code scanning). It conducts automatic application assessments for vulnerabilities or deviations from best practices, producing a detailed list of security findings prioritized by severity level.
Amazon Inspector offers two varieties of evaluations specifically designed for EC2 instances:
- Network assessments: These involve analyzing network configurations to check for ports accessible from outside the VPC.
- Host assessments: These assessments evaluate vulnerable software (CVE), host hardening (CIS Benchmarks), and adherence to security best practices. An inspector agent is required for host assessments.
After creating a new EC2 instance, we noticed it appearing under the ‘EC2 instances’ section of the resources coverage.
If you open ports from the security group, they become accessible from the public internet. Currently, this triggers alerts, but additional alerts remind us to install an agent on each EC2 instance.
let’s connect to the EC2 instance so that we can confirm the SSM agent exists.
We don’t need to take any action at the moment, but it’s worth trying with that document.
Manually installing and uninstalling SSM Agent on EC2 instances for Linux — AWS Systems Manager
It indicates that the operating system is listed as ‘UNKNOWN’ and the status is labelled as ‘Unmanaged EC2 instance’.
This is the reason why the Inspector can’t communicate with the SSM agent, so we need to assign the SSM agent role.
Typically, it will take some time for the status to change.
Then we can view the vulnerability assessment report.
Amazon Inspector for ECS and ECR
we need to create a vulnerable lab before the penetration test. I’ll proceed with setting up the DVWA lab. Let’s begin with that.
Get Kushanmaduranga’s stories in your inbox
Join Medium for free to get updates from this writer.
First, I am creating an Amazon ECR repository.
Now, push the Docker DVWA image to the ECR repository
Now, we must create a task definition
Now, we need to create a cluster.
Alright, execute the task now.
These are the significant configurations I’m showing you in the screenshot. Afterwards, we’ll set up our vulnerable lab.
Now, let’s proceed to perform vulnerability assessment on ECR and ECS containers.
This is for the container image vulnerability assessment report.
This is for the container repository vulnerability assessment report.
