Automating vulnerability scanning for EC2 instances with Inspector2

Question

Pulumi · Accepted Answer

To automate vulnerability scanning for EC2 instances using AWS Inspector2, we will create a Pulumi program that performs the following actions:

1. Sets up an Amazon EC2 instance that will be the target of the vulnerability scan.
2. Configures AWS Inspector2 to include the EC2 instance in its assessment target.

Let's walk through the details.

Firstly, we'll define an EC2 instance. AWS Inspector2 requires the `arn` of the instance on which you want to perform the vulnerability scan, so we'll ensure that we capture the `arn` once the instance is created.

Secondly, we'll create an Inspector2 assessment target. The assessment target defines which instances are included in the vulnerability assessment. We need to pass the ARN of the EC2 Instance to create the assessment target with the AWS Inspector2 service.

Below is a Pulumi program written in TypeScript that demonstrates this setup:

```typescript
import * as pulumi from '@pulumi/pulumi';
import * as aws from '@pulumi/aws';

// Create an AWS EC2 instance that we'll scan for vulnerabilities
const ec2Instance = new aws.ec2.Instance("myInstance", {
    ami: "ami-0c55b159cbfafe1f0", // Replace with a valid AMI ID for your region
    instanceType: "t2.micro", // Choose the instance type appropriate for your use case
    tags: {
        Name: "Inspector2-Target", // Optional: Add tags to your instance
    },
});

// Create an Inspector2 assessment target for scanning the EC2 instance
const assessmentTarget = new aws.inspector.AssessmentTarget("myAssessmentTarget", {
    resourceGroupArn: ec2Instance.arn, // ARN of the EC2 instance to be included in the scan
    name: "MyInspector2AssessmentTarget", // Name your assessment target
});

// Export the ARN of the EC2 instance and the Inspector2 Assessment Target so that we can reference them if needed
export const ec2InstanceArn = ec2Instance.arn;
export const assessmentTargetArn = assessmentTarget.arn;
```

Let me clarify some important parts of this program:

- `aws.ec2.Instance`: This resource is used to create an EC2 instance in AWS. To use this resource, specify properties such as `ami` (the Amazon Machine Image ID), `instanceType` (defines the size of the instance), and `tags` (key-value pairs for resource identification). ([Documentation](https://www.pulumi.com/registry/packages/aws/api-docs/ec2/instance/))
- `aws.inspector.AssessmentTarget`: This resource is used to set up an assessment target for AWS Inspector2, specifying the resources to be included in the vulnerability assessments. ([Documentation](https://www.pulumi.com/registry/packages/aws/api-docs/inspector/assessmenttarget/))

In this program, we're assuming that you already have a valid AMI ID for the `ami` property and that you are authorized to launch instances and use AWS Inspector2 in your AWS account. You'll need to replace `"ami-0c55b159cbfafe1f0"` with an AMI ID that is valid in your AWS region.

To deploy this Pulumi stack, save the code to a file with the `.ts` extension, such as `index.ts`, and run `pulumi up`. After inspecting the proposed changes, confirm the deployment, and Pulumi will provision the resources as defined.

This code snippet sets up the foundational resources for vulnerability scanning in AWS, but you may need additional configuration for a complete and operational Inspector2 setup, including specifying assessment templates and scheduling. The AWS Inspector2 service also requires proper permissions which must be set up in advance through the appropriate IAM roles and policies.