CloudAWS

Scan EC2 Instances Using AWS Systems Manager

Configure AWS Systems Manager (SSM) to scan EC2 instances for security misconfigurations without installing agents.

Use AWS Systems Manager (SSM) to scan EC2 instances without installing agents. When Mondoo runs an SSM scan, it installs cnspec on the instance for the duration of the scan and removes it afterward.

This page walks through configuring SSM so the Mondoo AWS integration can scan your EC2 instances. To run a one-off scan of an SSM-managed instance from your workstation, see Scan an SSM-managed instance from your workstation. For instances that SSM doesn't manage, see Scan Instances Using Instance Connect or Scan Instances Using EBS Snapshots. For other AWS scan targets, see the AWS overview.

How Mondoo scans with SSM

When Mondoo performs an SSM scan, these steps occur:

  1. SSM Run Command calls the AWS-RunShellScript SSM document.
  2. The latest version of cnspec is installed and configured to authenticate with your Mondoo Platform account.
  3. The EC2 instance runs cnspec scan to execute policy checks.
  4. cnspec publishes the scan results to Mondoo Platform.
  5. cnspec is uninstalled from the EC2 instance.

Configure AWS SSM

This section walks through a fresh SSM setup. If SSM is new to you, the AWS documentation covers it in greater depth.

Create an IAM role and instance profile for SSM

Before you can manage EC2 instances using SSM, complete these steps in the AWS console or the AWS CLI:

  1. Set up an IAM role with a trust policy for EC2.
  2. Attach the AWS managed AmazonSSMManagedInstanceCore policy to the IAM role.
  3. Create an instance profile (only needed if you're using the AWS CLI).
  4. Attach the IAM role to the instance profile (only needed if you're using the AWS CLI).

Choose a workflow:

Requirements

  • AWS console access to any account you plan to integrate with Mondoo
  • Administrator privileges in those accounts

Create an IAM role with the AmazonSSMManagedInstanceCore policy

Create an IAM SSM role in the AWS console

  1. Log in to the AWS console.
  2. Navigate to IAM.
  3. Select Roles.
  4. Select Create Role.
  5. For Trust entity type, select AWS service. For Use case, select EC2. Select Next.
  6. In the Filter policies box, search for SSM, select AmazonSSMManagedInstanceCore, and select Next.
  7. Under Role details, give the role a name (such as EC2_SSM_ROLE) and an optional description. Select Create role.

The role is now ready. You can attach it to existing EC2 instances or assign it as the instance profile when launching new instances.

Launch an EC2 instance with the new instance profile

Launching a new EC2 instance from the AWS console

  1. Log in to the AWS console.
  2. Navigate to EC2.
  3. Select Launch Instance.
  4. Under Name and tags, enter a name (for example, EC2 SSM Instance).
  5. Under Application and OS Images (Amazon Machine Image), select an image with the SSM Agent preinstalled (for example, the latest Amazon Linux AMI).
  6. Under Instance type, select t3.micro (or another type that fits your workload). Selecting an instance type during launch
  7. Under Key pair (login), you can either add an SSH key or select Proceed without a key pair. SSH access is not required for SSM scanning.
  8. Under Network settings, in Firewall (security groups), choose an appropriate security group. SSM does not require open inbound ports.
  9. Expand Advanced details. Under IAM instance profile, select the role you created above.
  10. Review the configuration, then select Launch.
  11. Copy the instance ID for the next step. EC2 instance summary showing the new instance ID

Confirm the instance is managed by SSM

Validating SSM management in the AWS console

  1. Log in to the AWS console.
  2. Navigate to Systems Manager.
  3. Select Fleet Manager.
  4. Locate the instance ID you copied in the previous step and select it.

If the instance appears in Fleet Manager, it is under SSM management and Mondoo can use it to perform continuous scans.

Scan an SSM-managed instance from your workstation

You can also run a one-off scan of an SSM-managed instance with cnspec. cnspec opens an SSM port-forwarding session to the instance, pushes a short-lived SSH key through EC2 Instance Connect, and scans over that tunnel. The instance needs no public IP address and no open inbound ports.

Before you begin:

Run cnspec, substituting the AMI's default user and the instance ID:

cnspec scan aws ec2 ssm USER@INSTANCE_ID

For example, to scan an Amazon Linux instance in us-east-1:

cnspec scan aws ec2 ssm ec2-user@i-0123456789abcdef0 --region us-east-1

Use --profile to select a named AWS CLI profile and --sudo to run checks that need elevated privileges.

To learn how to read the scan report, including scores and remediation guidance, see Understand cnspec Results.

Learn more

Secure an AWS Account

Scan an Amazon Web Services account against security and compliance best practices with cnspec.

Scan Instances Using Instance Connect

Use EC2 Instance Connect to scan EC2 instances over SSH without managing long-lived keys.

On this page

How Mondoo scans with SSMConfigure AWS SSMCreate an IAM role and instance profile for SSMRequirementsCreate an IAM role with the AmazonSSMManagedInstanceCore policyLaunch an EC2 instance with the new instance profileConfirm the instance is managed by SSMRequirementsLook up the ARN of the AmazonSSMManagedInstanceCore policyCreate the trust policy fileCreate the IAM role and attach the SSM policyCreate an instance profileLaunch an EC2 instance with the instance profileConfirm the instance is managed by SSMScan an SSM-managed instance from your workstationLearn more