AWS Serverless Integration FAQ

Understand how the Mondoo serverless AWS integration works, including resources created, required permissions, communication, and cost.

What does Mondoo scan?

Mondoo discovers resources across all AWS regions (EC2, S3, RDS, and more) and assesses their configuration against the policies you enable.

How does the serverless integration work?

Mondoo never holds credentials for your AWS account. A CloudFormation template installs a Lambda function in your account, and Mondoo communicates with it over AWS EventBridge. The Lambda authenticates to Mondoo using service credentials stored in the SSM Parameter Store.

Why does Mondoo need to create resources in my AWS account?

To run and schedule scans. The resources are low-cost: a Lambda function, an SNS topic, SQS queues, IAM roles, EventBridge rules, and SSM parameters. EBS volume scanning also adds an Auto Scaling group and a launch template.

Every resource Mondoo creates is tagged Created By: Mondoo. The Lambda's IAM role can only delete EC2 resources that carry this tag.

For background, see Tagging your AWS resources in the AWS documentation.

How do AWS and Mondoo communicate?

When the CloudFormation stack is created, AWS exchanges a short-lived token for Mondoo service credentials. Those credentials live in the SSM Parameter Store and are used by the Lambda and SSM-managed instances to call Mondoo Platform over HTTPS.

The Mondoo side uses AWS EventBridge cross-account routing. The event bus policy and rule are created by the CloudFormation stack.

What information leaves my AWS account?

Scan report results only. Mondoo Platform stores the latest report for every scanned asset, plus counts of various resources in the account.

What permissions does the integration request?

The full permission set is in the Mondoo serverless integration JSON.

Should I integrate an organization or a single account?

If your AWS Organization follows AWS standard practices, choose an organization integration. Before deploying, check the organization StackSet requirements.

How does the Lambda update itself?

The Lambda checks for updates every 24 hours and applies them automatically from Mondoo's S3 bucket. As a safeguard, Mondoo records the SHA-256 of each released file; the Lambda will refuse to update if the hash in S3 doesn't match the expected hash, and Mondoo support is alerted.

What happens if I delete the CloudFormation stack?

The Lambda is notified and immediately deletes every Mondoo-created resource in the account. The integration status becomes deleted in Mondoo. No data is lost on the Mondoo side, and the stack can be recreated at any time.