Control: 1 Amazon Inspector EC2 scanning should be enabled

Description

This control checks whether Amazon Inspector EC2 scanning is enabled. For a standalone account, the control fails if Amazon Inspector EC2 scanning is disabled in the account. In a multi-account environment, the control fails if the delegated Amazon Inspector administrator account and all member accounts don't have EC2 scanning enabled.

In a multi-account environment, the control generates findings in only the delegated Amazon Inspector administrator account. Only the delegated administrator can enable or disable the EC2 scanning feature for the member accounts in the organization. Amazon Inspector member accounts can't modify this configuration from their accounts. This control generates FAILED findings if the delegated administrator has a suspended member account that doesn't have Amazon Inspector EC2 scanning enabled. To receive a PASSED finding, the delegated administrator must disassociate these suspended accounts in Amazon Inspector.

Amazon Inspector EC2 scanning extracts metadata from your Amazon Elastic Compute Cloud (Amazon EC2) instance, and then compares this metadata against rules collected from security advisories to produce findings. Amazon Inspector scans instances for package vulnerabilities and network reachability issues. For information about supported operating systems, including which operating system can be scanned without an SSM agent, see Supported operating systems: Amazon EC2 scanning.

Remediation

To enable Amazon Inspector EC2 scanning, see Activating scans in the Amazon Inspector User Guide.

Usage

Run the control in your terminal:

powerpipe control run aws_compliance.control.foundational_security_inspector_1

Snapshot and share results via Turbot Pipes:

powerpipe login
powerpipe control run aws_compliance.control.foundational_security_inspector_1 --share

SQL

This control uses a named query:

select
  'arn:' || r.partition || '::' || r.region || ':' || r.account_id as resource,
  case
    when r.steampipe_available = false then 'skip'
    when ec2_auto_enable then 'ok'
    when c.account_id is not null and (not ec2_auto_enable or ec2_auto_enable is null) then 'alarm'
    else 'alarm'
  end status,
  case
    when r.steampipe_available = false then r.region || ' is not available in the current connection configuration.'
    when ec2_auto_enable then 'AWS Inspector EC2 scanning enabled for region ' || c.region || '(' || c.account_id || ').'
    when c.account_id is not null and (not ec2_auto_enable and ec2_auto_enable is null ) then 'AWS Inspector EC2 scanning disabled for region ' || r.region || '(' || r.account_id || ').'
    else 'AWS Inspector deactivated for region ' || r.region || '(' || r.account_id || ').'
  end as reason
  , r.region, r.account_id
from
  aws_region as r
  left join aws_inspector2_organization_configuration as c on r.account_id = c.account_id and r.region = c.region;

Control: 1 Amazon Inspector EC2 scanning should be enabled

Description

Remediation

Usage

SQL

Tags