Automate Cross-Account Security Scans: Amazon Inspector + AWS Security Hub

Automating security scans across multiple AWS accounts is crucial for efficiency, consistency, and comprehensive coverage. This guide shows you how to:

• Set up and configure Amazon Inspector and AWS Security Hub
• Automate security scans
• Review findings
• Remediate vulnerabilities across accounts

Related video from YouTube

Key Steps:

1. Set up Amazon Inspector

   • Designate an administrator account
   • Configure scan types (EC2, ECR, Lambda) for accounts to monitor

2. Set up AWS Security Hub

   • Enable AWS Security Hub
   • Integrate with Amazon Inspector

3. Schedule Scans Automatically

   • Use AWS EventBridge or AWS Systems Manager Automation

4. Review Findings

   • Access findings in AWS Security Hub console
   • Prioritize and analyze findings by severity, resource type, and compliance
   • Use filters and custom insights

5. Fix Security Vulnerabilities (Optional)

   • Automate remediation with AWS Systems Manager Automation
   • Integrate third-party vulnerability management tools
   • Follow best practices for fixing vulnerabilities

Benefits of Automated Scans:

• Efficiency: Reduces manual effort
• Consistency: Uniform security checks across accounts
• Comprehensive Coverage: Identifies vulnerabilities effectively

Prerequisites

AWS Accounts and Access

To automate cross-account security scans, you need:

• An AWS administrator account with permissions to set up and configure Amazon Inspector and AWS Security Hub
• Multiple AWS accounts you want to monitor and scan for security vulnerabilities
• AWS IAM roles or users with permissions to access and manage the required AWS services

Required AWS Services

You'll need to activate and configure these AWS services:

Agents or Components

You may need to install these agents or components:

• Amazon Inspector agent: Collects data from your EC2 instances and sends it to Amazon Inspector
• AWS Security Hub agent (optional): Collects data from your AWS resources and sends it to AWS Security Hub

Ensure you have the necessary permissions, access, and activated services before setting up the automation.

Step 1: Set up Amazon Inspector

Designate an Administrator Account

To get started with Amazon Inspector, you'll need to designate an administrator account. This account will manage Amazon Inspector for your organization:

1. Log in to your AWS Organizations management account.
2. Open the Amazon Inspector console at https://console.aws.amazon.com/inspector/v2/home.
3. In the Delegated administrator pane, enter the 12-digit ID of the AWS account you want to designate as the Amazon Inspector administrator. Then choose Delegate and confirm.

Configure Scan Types

Next, you'll need to configure the scan types you want to enable. Amazon Inspector offers three scan types: EC2, ECR, and Lambda. You can enable one, two, or all three based on your needs.

To configure scan types:

1. Log in to the designated administrator account.
2. Open the Amazon Inspector console.
3. In the navigation pane, choose Account Management.
4. Select the accounts you want to enable scanning for.
5. Choose the scan types to enable (EC2, ECR, or Lambda).

Example: EC2 Scan Configuration

Let's look at an example of configuring Amazon Inspector for EC2 scans. Suppose you want to scan all EC2 instances in your organization for vulnerabilities:

1. Log in to the administrator account.
2. Open the Amazon Inspector console.
3. In the navigation pane, choose Assessment targets.
4. Choose Create.
5. For Name, enter a name for your assessment target (e.g., "EC2 Instances").
6. For Use Tags, choose the EC2 instances to include by entering values for the Key and Value fields.
7. Install the Amazon Inspector agent on your EC2 instances.

sbb-itb-6210c22

Step 2: Set Up AWS Security Hub

Enable AWS Security Hub

To enable AWS Security Hub:

1. Open the AWS Security Hub console at https://console.aws.amazon.com/securityhub/.
2. Choose the Region where you want to enable Security Hub.
3. Click Enable Security Hub.
4. Review the terms and conditions, then click Enable Security Hub to confirm.

Note: You can also enable Security Hub using the AWS CLI or AWS SDKs. See Enabling Security Hub using the AWS CLI or Enabling Security Hub using AWS SDKs for more details.

Integrate with Amazon Inspector

To integrate Amazon Inspector with AWS Security Hub:

1. Open the Amazon Inspector console at https://console.aws.amazon.com/inspector/.
2. Choose the assessment target you want to integrate with Security Hub.
3. Click Actions, then Integrate with Security Hub.
4. Enter the Security Hub account ID and Region, then click Integrate.

Note: Ensure you have the necessary permissions to integrate Amazon Inspector with Security Hub.

Verify the Integration

To verify that Amazon Inspector findings are being sent to AWS Security Hub:

1. Open the AWS Security Hub console at https://console.aws.amazon.com/securityhub/.
2. Choose the Region where you enabled Security Hub.
3. Click Findings in the navigation pane.
4. Look for findings from Amazon Inspector. If you don't see any findings, check that the integration is set up correctly and that Amazon Inspector is sending findings to Security Hub.

Step 3: Schedule Scans Automatically

Scheduling regular security scans is crucial to maintain the security and compliance of your AWS resources. Here's how to automate the scheduling process:

Using AWS EventBridge

EventBridge allows you to respond to changes in your AWS resources. You can use it to schedule Amazon Inspector scans automatically:

1. Create an EventBridge rule to trigger an Amazon Inspector scan at a specified interval (e.g., daily, weekly).
2. Configure the rule to target the Amazon Inspector assessment target you created earlier.
3. Set the scan type and settings as needed.

With EventBridge, your scans will run regularly without manual intervention, reducing security risks.

Using AWS Systems Manager Automation

Systems Manager Automation lets you automate tasks across your AWS resources. You can use it to schedule Amazon Inspector scans:

1. Create a Systems Manager Automation document defining the scan settings and schedule.
2. Configure the document to target the Amazon Inspector assessment target.
3. Set the scan type and settings as needed.

Systems Manager Automation automates the scanning process, helping you stay on top of security vulnerabilities.

Ensuring Comprehensive Coverage

To ensure thorough security monitoring, make sure to:

• Schedule scans for all relevant resources across multiple accounts and regions.
• Configure scans to cover required compliance standards and security frameworks.
• Monitor and analyze scan results to identify and remediate issues promptly.

Both methods allow you to automate the scheduling of Amazon Inspector scans, ensuring regular security checks without manual intervention.

1. Using AWS EventBridge

• Create an EventBridge rule to trigger an Amazon Inspector scan at a specified interval (e.g., daily, weekly).
• Configure the rule to target the Amazon Inspector assessment target you created earlier.
• Set the scan type and settings as needed.

2. Using AWS Systems Manager Automation

• Create a Systems Manager Automation document defining the scan settings and schedule.
• Configure the document to target the Amazon Inspector assessment target.
• Set the scan type and settings as needed.

To ensure comprehensive coverage:

• Schedule scans for all relevant resources across multiple accounts and regions.
• Configure scans to cover required compliance standards and security frameworks.
• Monitor and analyze scan results to identify and remediate issues promptly.

Step 4: Review Findings

Access Findings in AWS Security Hub

Now that you've set up Amazon Inspector and integrated it with AWS Security Hub, you can review the findings:

1. Log in to the AWS Security Hub console.
2. In the navigation pane, choose Findings.
3. Select the findings you want to review. You can filter by severity, resource type, and other criteria.

Prioritize and Analyze Findings

When reviewing findings, focus on those with high severity and impact. Analyze the findings to understand the issue and identify affected resources. Here's how to prioritize and analyze findings:

• Severity: Focus on Critical or High severity findings.
• Resource type: Prioritize findings related to critical resources like EC2 instances or S3 buckets.
• Compliance: Identify findings relevant to specific compliance standards or security frameworks.

Use Filters and Custom Insights

AWS Security Hub provides filters and custom insights to help you focus on critical findings. You can create custom insights to group related findings and identify trends.

To create a custom insight:

1. In the AWS Security Hub console, choose Insights.
2. Click Create insight.
3. Select the relevant findings and filters to include.
4. Choose a name and description for the insight.
5. Click Create insight.

Step 5: Fix Security Vulnerabilities (Optional)

Use AWS Systems Manager Automation

To fix security vulnerabilities across multiple resources, you can automate the process using AWS Systems Manager Automation. This service lets you create an Automation runbook that targets specific resources, like Amazon EC2 instances, based on tags or resource IDs.

Here's how to fix Amazon Inspector findings with AWS Systems Manager Automation:

1. Create an Automation runbook targeting the affected resources.
2. Specify the fix action, such as patching or updating software.
3. Configure the runbook to reboot instances after fixing, if needed.
4. Run the runbook to fix the vulnerabilities.

Integrate Third-Party Tools

You can also integrate third-party vulnerability management tools with AWS to automate fixing vulnerabilities. For example:

• Use a tool like Nessus, Qualys, or OpenVAS to identify vulnerabilities.
• Then, use AWS Systems Manager Automation to fix them.

Best Practices for Fixing Vulnerabilities

When fixing vulnerabilities, follow these best practices:

Conclusion

Key Steps Summary

Here are the key steps to automate cross-account security scans using Amazon Inspector and AWS Security Hub:

1. Set up Amazon Inspector

• Designate an administrator account to manage Amazon Inspector
• Configure scan types (EC2, ECR, Lambda) for the accounts you want to monitor

2. Set up AWS Security Hub

• Enable AWS Security Hub
• Integrate with Amazon Inspector to receive findings

3. Schedule Scans Automatically

• Use AWS EventBridge or AWS Systems Manager Automation to schedule regular scans

4. Review Findings

• Access findings in the AWS Security Hub console
• Prioritize and analyze findings based on severity, resource type, and compliance standards
• Use filters and custom insights to focus on critical findings

5. Fix Security Vulnerabilities (Optional)

• Automate remediation using AWS Systems Manager Automation
• Integrate with third-party vulnerability management tools
• Follow best practices for fixing vulnerabilities

Benefits of Automated Scans

Automating cross-account security scans offers these advantages:

• Efficiency: Reduces manual effort in collecting and prioritizing findings
• Consistency: Ensures uniform security checks and remediation across all accounts
• Comprehensive Coverage: Helps identify and address security vulnerabilities and compliance issues more effectively

Additional Resources

For more information, refer to these resources:

Related posts

• CloudWatch Alarms: Automate EC2 Recovery
• AWS Hybrid Cloud Security: Compliance Best Practices
• 10 AWS Cost Optimization Strategies 2024
• AWS S3 Guide: Understanding Access Management