Automate scanning for vulnerabilities, network exposures & deviation from best practices in AWS
Tags: cloud, security, aws, cloudskills
Published: 2021-12-28 17:43:01

#### Amazon Inspector

Is a vulnerability management service that continuously scans your AWS workloads for vulnerabilities, automatically discovers and scans Amazon EC2 instances and container images residing in Amazon Elastic Container Registry (Amazon ECR) for software vulnerabilities and unintended network exposure.


####An Amazon Inspector assessment covers:


- Network Reachability.

- Common vulnerabilities and exposures (CVE). 

- Center for Internet Security (CIS) benchmarks – currently only with Amazon inspector classic.

- Security best practices – currently only with Amazon inspector classic.


Source: [Amazon Inspector](https://docs.aws.amazon.com/inspector/latest/user/what-is-inspector.html)      [Amazon Inspector Classic] (https://docs.aws.amazon.com/inspector/latest/userguide/inspector_introduction.html)




**In this demo I will walk you through a step-by-step guide on creating Linux and Windows EC2 instances, installing Inspector agent on them, enabling and configuring Amazon Inspector classic and Amazon Inspector then downloading a full report of all findings, so let’s get started!**



First let’s create a new <u>Linux</u> EC2 instance.

Login to your AWS account, click _Services_ and you will find EC2 under _Compute section_.


![EC2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wzji0bcmbvak0zc66xuh.png)


It will take you to EC2 dashboard page.
 
On the left side of the screen you will find _instances_ click on it, then click _Launch instances_.



![Ec2 instances page](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/epdu2ailmuem8v3fi39j.png)


For this demo, you can select one of the free tier Amazon Linux AMI’s.


![Amazon Linux AMI](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v2krx2cykpxayna7f9gx.png)


For the instance type, you can select the free tier t2.micro then click _Review and Launch_.



![Instance Type](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/urqnax31peshykhb7k9z.png)


You will get this security warning message because we did not change the security group rules and it is now widely open. 

To change it click _Edit security groups_. 


![security groups](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h97iywsl6qjhpjvgih88.png)


For now, you can allow only your IP address then click _Review and Launch_.


![security groups](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ujbprtc8arblfeuqazia.png)


Once you click _Launch_, it will ask you to either create a new key pair or use an existing one - I will create a new key pair and name it Demo-KP.

You must download the key pair first, then launch the instance.  


![Key pair](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/inhj5a4g26xu71fjry4i.png)


Now let’s create another instance with <u>Windows</u> image. 

Click on _Launch instances_.



![EC2](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/euj6ruxwwkdrf14d96hz.png)

Search for Windows in the search bar, then select one of the free tier windows images.


![EC2 instance](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/06947sqxpsnyb2njngc7.png)

For the instance type, you can select t2.micro as well.
 
Then click _Review and Launch_.


![EC2 instance type](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cxvamii598wc97d92n4x.png)

Again, you will see the security warning message.

Click _Edit security groups_ and change it to your IP address, then click _Launch_. 


![EC2 instance](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3seadal783hq5lyj349x.png)


It will ask you to create or use an existing key pair, you can use the one you created earlier.

Then check the box below and click _Launch Instances_.


![EC2 instance key pair](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3sq3rzt5mnbjfl5jkmmj.png)


Now we have two running EC2 instances; Linux and Windows.

Let’s add new tag to each one of them.

Select each instance and click _Tags_ then _Manage tags_.


![EC2 instance tags](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f7z1j85b7ytc3t1dtuir.png)


Add a new tag with the Key “Type” and Value “Production” then click _Save_.


![EC2 instance tags](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d6mj05rahj2mltsod1dw.png)



![EC2 instance tags](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8zl3d6lx7k0z8ezrvq7w.png)


Select the Linux instance and copy the <u>IP address</u>. 


![EC2 instances](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jcfqdpyn93hmkd7ytnb2.png)


Now let’s open the terminal, login to the Linux instance and install Amazon Inspector’s agent.

To login, first you need to change the permissions for the Key file by running this command: 


```
chmod 400 [your key file]
```



Then login to the instance by running this command:

```
ssh ec2-user@[Your EC2 instance IP address] -i  [your key file]
```



![Linux EC2 instance](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qkcs4mk7nqzuladpo0jw.jpg)


You are now logged in.

Next you will need to download Amazon Inspector’s agent script by running this command: 

```
wget https://inspector-agent.amazonaws.com/linux/latest/install
```


![Download inspector agent](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qmwm1dfp02mllzaci3x5.png)

Once it’s completed, you can install the agent by running this command: 

```
sudo bash install 
```



![install inspector agent](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cd6op7isp0inrabh2oky.png)


Amazon Inspector’s agent has been installed in the <u>Linux</u> instance.

Now let’s go back to the console and connect to the <u>Windows</u> instance.
  
In the EC2 instances page select the Windows instance then click _Connect_.


![Windows EC2 instance](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5g5i8c17um1nxt5dh0sy.png)

Select _RDP client_ then _Get password_.


![Connect to Windows EC2 instance](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/72wimd15qwqxoefao180.png)


Browse to your key pair then click _Decrypt password_.

Copy the password as you will need it to access your Windows instance.


![Decrypt password windows instance](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mhvbp4cojtickarwmxh9.png)


I will use Microsoft Remote Desktop to connect to the Windows instance.


![Microsoft remote desktop](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s34brx3bsdigrchi93kk.png)

Now that you are logged in, you will need to download Amazon Inspector’s _agent_ using this URL:
`https://inspector-agent.amazonaws.com/windows/installer/latest/AWSAgentInstall.exe`


![Download inspector agent](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/q7adoiys2hswr0ms7k6k.png)

Once the download is completed, click on _Run_.


![Run inspector agent](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/knx6k09f6ou0i8b2ac23.png)

Check the box to agree to the license terms and conditions, then click _Install_.


![AWS inspector agent setup](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zey2aohy6k97iw31vm3t.png)

Now that the installation is completed, let’s go back to the AWS console and enable Amazon Inspector.


![AWS inspector agent installation](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mgmpbuqdyll44q1vrw1e.png)


You can find Inspector under the _Security, Identity & Compliance_ section.

 

![Amazon Inspector](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8bnuus59qkpo2ed606sa.png)


It will take you to Amazon Inspector’s main page, click _Get Started_.


![Amazon inspector main page](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/74u4wo99jhq3x385bnb2.png)


Let’s start first with _Inspector Classic_.

You can click _Switch to Inspector Classic_ on the left side of the screen and it will open a new tab.


![Amazon inspector classic](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oiniyzlz0oun0x7uesex.png)  


Click on _Get started_.


![Amazon inspector classic main page](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/luvqkyxo60oqqph60o8v.png)

It will ask you to setup your assessment; if you want to allow Network assessments, Host assessments or both, as well as the frequency of the scanning (weekly or once).


![Amazon Inspector classic setup](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zzf5k4p7pvd43e3yiyn3.png)


Once you chose the desired assessment runs, it will ask you to confirm it, click _OK_.


![Amazon inspector classic assessment runs](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i397pfsb20pf9x0xjmx4.png)


Then it will take you to Amazon Inspector classic dashboard.


![Amazon inspector classic dashboard](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ygfw8z1oxd8heyaa0hco.png)


Now let’s create a new <u>assessment target</u>.

Click _Assessment targets_ on the left side of the screen then click _Create_.


![Amazon inspector assessment targets](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/89k2v5k8fwol4gdilucy.png)

Give it a name, then add the tag that is associated to the instances you want to run inspector on – you have the option to include all EC2 instances in your account and region as well - then _save it_.


![Assesment target](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/pahskkuu5wfw39yqk3dh.png)

Now let’s create a new <u>assessment template</u>.

Click _Assessment templates_ on the left side of the screen then _Create_.



![Amazon inspector assessment templates](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zzlkyeabxwfitjuh5pjl.png)

Name your assessment template, select the target that you created in the previous step, then add the rules packages that you want to include in this template and choose the duration to run the assessment (AWS recommends 1 hour) but for this demo I will choose 15 minutes.

You also have the option to connect it to SNS if you want to receive notifications. 

Add the desired tags and you can check the box below to set a schedule to automatically run the assessment.
 
For this demo you can uncheck the box then click _Create and run_.


![Amazon inspector assessment template](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4rtc4opamftg8d2xi0r5.png)

It will start the analysis, once it's completed it will show you the number of findings. 


![Amazon inspector assessment run](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hzkeqfd41uymgj4hvy7d.png)

Click on _Download report_.

You can select whether you want only the findings report or the full report (the full report will also include the rules packages) then choose the desired format HTML or PDF.


![Download report](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hd7xjg06trbu4fowfwy3.png)

You can see below some screenshots of the <u>full report</u> in PDF format.



![Screenshot of full report](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l5fueslwd3xjoaqq6v10.png)


![Screenshot of full report](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1la4id0h7mpumr52moa5.png)


![Screenshot of full report](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/swl879tqev7zh2xvew7l.png)

Let’s go back to the console.

Click on _Findings_ on the left side of the screen.

You will see all findings with details and you have the option to filter them based on severity level.


![Amazon inspector findings](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/09hq6vih4j1xi36cl513.png)


Lastly, let’s go back to the Inspector tab.

Click _Enable Inspector_.


![Enable inspector](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mg29bmtizazik9084wgp.png)

You will see the dashboard which contains a summary, and on the left side of the screen you can check the findings based on vulnerability, instance, container image, repository, and all findings as well.


![Amazon inspector](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7z2chvlfxr5axu9riwdp.png)

**Now we can manage vulnerabilities, network exposure and deviation from security best practices in a centralized automated way!**
 
We have configured both Amazon Inspector and Amazon Inspector classic, installed Inspector agents on Linux and Windows servers, and have a well-written organized full report with all details.