Scan EC2 Instances Using AWS Systems Manager

Requirements

• AWS console access to any account you plan to integrate with Mondoo
• Administrator privileges in those accounts

Create an IAM role with the AmazonSSMManagedInstanceCore policy

1. Log in to the AWS console.
2. Navigate to IAM.
3. Select Roles.
4. Select Create Role.
5. For Trust entity type, select AWS service. For Use case, select EC2. Select Next.
6. In the Filter policies box, search for SSM, select AmazonSSMManagedInstanceCore, and select Next.
7. Under Role details, give the role a name (such as EC2_SSM_ROLE) and an optional description. Select Create role.

The role is now ready. You can attach it to existing EC2 instances or assign it as the instance profile when launching new instances.

Launch an EC2 instance with the new instance profile

1. Log in to the AWS console.
2. Navigate to EC2.
3. Select Launch Instance.
4. Under Name and tags, enter a name (for example, EC2 SSM Instance).
5. Under Application and OS Images (Amazon Machine Image), select an image with the SSM Agent preinstalled (for example, the latest Amazon Linux AMI).
6. Under Instance type, select t3.micro (or another type that fits your workload).
7. Under Key pair (login), you can either add an SSH key or select Proceed without a key pair. SSH access is not required for SSM scanning.
8. Under Network settings — Firewall (security groups), choose an appropriate security group. SSM does not require open inbound ports.
9. Expand Advanced details. Under IAM instance profile, select the role you created above.
10. Review the configuration, then select Launch.
11. Copy the instance ID for the next step.

Confirm the instance is managed by SSM

1. Log in to the AWS console.
2. Navigate to Systems Manager.
3. Select Fleet Manager.
4. Locate the instance ID you copied in the previous step and select it.

If the instance appears in Fleet Manager, it is under SSM management and Mondoo can use it to perform continuous scans.

Requirements

• The AWS CLI installed and configured for your account
• Administrator privileges (or equivalent IAM permissions) on the account

Look up the ARN of the AmazonSSMManagedInstanceCore policy

aws iam list-policies --scope AWS --query "Policies[?PolicyName == 'AmazonSSMManagedInstanceCore']"

Create the trust policy file

Create a file named ec2-trust.json with this content:

{
  "Version": "2012-10-17",
  "Statement": {
    "Effect": "Allow",
    "Principal": { "Service": "ec2.amazonaws.com" },
    "Action": "sts:AssumeRole"
  }
}

Create the IAM role and attach the SSM policy

aws iam create-role \
  --role-name EC2_SSM_ROLE \
  --assume-role-policy-document file://ec2-trust.json

aws iam attach-role-policy \
  --role-name EC2_SSM_ROLE \
  --policy-arn <SSM-POLICY-ARN>

Create an instance profile

aws iam create-instance-profile --instance-profile-name EC2_SSM_PROFILE
aws iam add-role-to-instance-profile \
  --instance-profile-name EC2_SSM_PROFILE \
  --role-name EC2_SSM_ROLE

Launch an EC2 instance with the instance profile

Look up an Amazon Linux 2023 AMI ID (which includes the SSM Agent):

aws ec2 describe-images \
  --owners amazon \
  --filters "Name=name,Values=al2023-ami-*-x86_64" \
            "Name=state,Values=available" \
  --query "sort_by(Images, &CreationDate)[-1].ImageId" \
  --output text

Pick a VPC subnet and security group to use, then launch the instance:

aws ec2 run-instances \
  --image-id <AMI-ID> \
  --instance-type t3.micro \
  --subnet-id <SUBNET-ID> \
  --security-group-ids <SECURITY-GROUP-ID> \
  --iam-instance-profile Name=EC2_SSM_PROFILE \
  --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=SSMTestInstance}]"

Confirm the instance is managed by SSM

Look up the new instance ID:

aws ec2 describe-instances \
  --filters Name=tag:Name,Values=SSMTestInstance \
  --query "Reservations[].Instances[].InstanceId" \
  --output text

Confirm SSM has registered the instance:

aws ssm describe-instance-information \
  --query "InstanceInformationList[?InstanceId == '<INSTANCE-ID>']"