CloudAWS

Scan EC2 Instances Using AWS Systems Manager

Configure AWS Systems Manager (SSM) to scan EC2 instances for security misconfigurations without installing agents.

Use AWS Systems Manager (SSM) to scan EC2 instances without installing agents. When Mondoo runs an SSM scan, it installs cnspec on the instance for the duration of the scan and removes it afterward.

This page walks through configuring SSM so the Mondoo AWS integration can scan your EC2 instances. If you want a one-off scan of an instance instead, see Scan Instances Using Instance Connect or Scan Instances Using EBS Snapshots. For other AWS scan targets, see the AWS overview.

How Mondoo scans with SSM

When Mondoo performs an SSM scan, these steps occur:

  1. SSM Run Command calls the AWS-RunShellScript SSM document.
  2. The latest version of cnspec is installed and configured to authenticate with your Mondoo Platform account.
  3. The EC2 instance runs cnspec scan to execute policy checks.
  4. cnspec publishes the scan results to Mondoo Platform.
  5. cnspec is uninstalled from the EC2 instance.

Configure AWS SSM

This section walks through a fresh SSM setup. If SSM is new to you, the AWS documentation covers it in greater depth.

Create an IAM role and instance profile for SSM

Before you can manage EC2 instances using SSM, complete these steps in the AWS console or the AWS CLI:

  1. Set up an IAM role with a trust policy for EC2.
  2. Attach the AWS managed AmazonSSMManagedInstanceCore policy to the IAM role.
  3. Create an instance profile (only needed if you're using the AWS CLI).
  4. Attach the IAM role to the instance profile (only needed if you're using the AWS CLI).

Choose a workflow:

Requirements

  • AWS console access to any account you plan to integrate with Mondoo
  • Administrator privileges in those accounts

Create an IAM role with the AmazonSSMManagedInstanceCore policy

Create an IAM SSM role in the AWS console

  1. Log in to the AWS console.
  2. Navigate to IAM.
  3. Select Roles.
  4. Select Create Role.
  5. For Trust entity type, select AWS service. For Use case, select EC2. Select Next.
  6. In the Filter policies box, search for SSM, select AmazonSSMManagedInstanceCore, and select Next.
  7. Under Role details, give the role a name (such as EC2_SSM_ROLE) and an optional description. Select Create role.

The role is now ready. You can attach it to existing EC2 instances or assign it as the instance profile when launching new instances.

Launch an EC2 instance with the new instance profile

Launching a new EC2 instance from the AWS console

  1. Log in to the AWS console.
  2. Navigate to EC2.
  3. Select Launch Instance.
  4. Under Name and tags, enter a name (for example, EC2 SSM Instance).
  5. Under Application and OS Images (Amazon Machine Image), select an image with the SSM Agent preinstalled (for example, the latest Amazon Linux AMI).
  6. Under Instance type, select t3.micro (or another type that fits your workload). Selecting an instance type during launch
  7. Under Key pair (login), you can either add an SSH key or select Proceed without a key pair. SSH access is not required for SSM scanning.
  8. Under Network settings — Firewall (security groups), choose an appropriate security group. SSM does not require open inbound ports.
  9. Expand Advanced details. Under IAM instance profile, select the role you created above.
  10. Review the configuration, then select Launch.
  11. Copy the instance ID for the next step. EC2 instance summary showing the new instance ID

Confirm the instance is managed by SSM

Validating SSM management in the AWS console

  1. Log in to the AWS console.
  2. Navigate to Systems Manager.
  3. Select Fleet Manager.
  4. Locate the instance ID you copied in the previous step and select it.

If the instance appears in Fleet Manager, it is under SSM management and Mondoo can use it to perform continuous scans.

Learn more

Secure an AWS Account

Scan an Amazon Web Services account against security and compliance best practices with cnspec.

Scan Instances Using Instance Connect

Use EC2 Instance Connect to scan EC2 instances over SSH without managing long-lived keys.

On this page

How Mondoo scans with SSMConfigure AWS SSMCreate an IAM role and instance profile for SSMRequirementsCreate an IAM role with the AmazonSSMManagedInstanceCore policyLaunch an EC2 instance with the new instance profileConfirm the instance is managed by SSMRequirementsLook up the ARN of the AmazonSSMManagedInstanceCore policyCreate the trust policy fileCreate the IAM role and attach the SSM policyCreate an instance profileLaunch an EC2 instance with the instance profileConfirm the instance is managed by SSMLearn more