👮🏽Amazon Inspector - Automated and Continual vulnerability management at scale
Tags: security, cloud, devops, beginners
Published: 2022-03-01 11:41:10

## DAY 16 - Amazon Inspector -  Automated and Continual vulnerability management at scale  - Day Sixteen 




![Image Cover](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/uf21zkxzkowe2k6h6tjm.png)

[Tweet This Blog](https://link.anuvindh.com/twitter/DAY-16-AWS-inspector-tweet.html)  - [100 days of Cloud on GitHub](https://github.com/anuvindhs/100daysofcloud) - [Read On iCTPro.co.nz](https://ictpro.co.nz) - [Read on Dev.to](https://dev.to/anuvindhs)

------

![Image Architecture](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xm4ijcveg8wyg5nbogoz.png)
- Quickly discover vulnerabilities
- Prioritize patch remediation
- Meet compliance requirements
- Identify zero-day vulnerabilities sooner

Amazon Inspector helps to find security vulnerabilities on EC2.  (Finding Common Vulnerabilities (**CVE**) , Center of Internet Security Benchmarks (**CIS**), **Security Best practice** & **run time behavior**).

An agent based service, which means you can add agent to your EC2 and start monitoring.

### Why Amazon inspector?
- Monitor your application for vulnerabilities 
- Crosschecks for Security compliance & exposure to attack.
- Secure your EC2 for zero day vulnerability.
- Low Cost
are few of the benefits using Amazon Inspector.
 
### Components
9 components
the Amazon Inspector role, assessment targets, AWS agents, assessment templates, rule packages, assessment runs, telemetry, assessment reports, and findings

#### 🚨 Amazon Inspector role
 - A read only access to all your EC2 environment

#### 🎯 Assessment Targets
- A group of Ec2 or target group of Ec2. tags will be used to group.

####📦 Agents
Software agents installed on the instance that you wish to monitor (agents are updated automatically). Supports both **Linux** and Windows.

##### Installing the Amazon Inspector agent on a [Linux](https://docs.aws.amazon.com/inspector/v1/userguide/inspector_installing-uninstalling-agents.html#install-linux)
```
wget https://inspector-agent.amazonaws.com/linux/latest/install
```
or 
```
curl -O https://inspector-agent.amazonaws.com/linux/latest/install
```

Then 
```
sudo bash install
```

##### For [Windows](https://docs.aws.amazon.com/inspector/v1/userguide/inspector_installing-uninstalling-agents.html#install-windows)

Download .exe file from this [**link**](https://inspector-agent.amazonaws.com/windows/installer/latest/AWSAgentInstall.exe)

or copy paste 
```
https://inspector-agent.amazonaws.com/windows/installer/latest/AWSAgentInstall.exe
```

and execute **AWSAgentInstall.exe**

#### 📝 Assessment templates
This will decide how an assignment on ec2 should run. We can use SNS to notify the finding. Once you created you cannot modify the template.

#### ✔️ Rule Packages
Set of individual rules that are checked against EC2 instance with severity level (High, Medium, Low, Informational).

Supported Rules packages

##### CVE, CIS, Security Best Practices
- [CVE](https://docs.aws.amazon.com/inspector/v1/userguide/inspector_cves.html) - publicly known security threats.
- [CIS](https://docs.aws.amazon.com/inspector/v1/userguide/inspector_cis.html) - Global Standard for Security standards For IT resources
- [Security best Practices](https://docs.aws.amazon.com/inspector/v1/userguide/inspector_security-best-practices.html) - Common best practices in Linux based Ec2 targets.


#### 🏃 Assessment Run
Assessment run will be used Once you configure Role, agent, Target & template Configured.

#### 📇 Telemetry

Data collected from instance , once collected the data will be sent to Inspector and stored in s3 with KMS key.  Inspector Analyse the data from S3 with rule packages. After 30 days telemetry data is deleted.

####📘 Assessment Reports
 Provides a assessment on results.
There are Mainly two types of report

- **Findings reports**
 - Summary of assessment
 - List of EC2 assessed 
 - Rules Used
 - Findings

- **Full report**
 - all Finding report + List of rules passed successfully for instances 


####📖 Findings
Results of Assessment run, also gives how to remediate the issues found

## Practical 

Now Lets install Agent on  Debian OS, please refer above to install on Linux 

- Lets note down the ec2 tags.
- Goto Amazon Inspector from console and click **Get started** then **Enable Inspector**.

![Image enable](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/evoexz6u33qdn5aaftl8.png)
- After few minutes you will be welcomed with a dashboard.


![Image Dashboard](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mf1bvabbz7qgvqtas40f.png)

- As you are already installed inspector in will run  a default checks.

- If you get confused with new dashboard click on **Switch to Inspector Classic**

![Image Classic report](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f0ww055ntg9lr3pyuqbn.png)

- Click on findings on new dashboard and click the Vulnerability


![Image Vlun](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qcr9n0ttd02pf2w8xkm0.png)

On bottom of findings you can see how can you remediate the issue.

 

That's it , 🎉**Congratulations**🎉you have successfully implemented AWS inspector for your EC2 infrastructure. 


----------

**✅Connect with me on [Twitter](https://twitter.com/intent/follow?ref_src=anuvindhs&screen_name=anuvindhs)
 🤝🏽Connect with me on [Linkedin](https://www.linkedin.com/in/anuvindhs)
🧑🏼‍🤝‍🧑🏻 Read more post on [dev.to](https://dev.to/anuvindhs) or  [iCTPro.co.nz](https://ictpro.co.nz)
💻 Connect with me on [GitHub](https://github.com/anuvindhs)**
   
{% user anuvindhs %}