amazon-inspector-auto-remediate
Lambda job in Python to automatically patch EC2 instances when an inspector assessment generates a CVE finding
| Category | Vulnerability Management |
|---|---|
| Community Stars | 58 |
| Last Commit | 8 years ago |
| Last page update | 19 days ago |
| Pricing Details | Free to use under the Apache License 2.0 |
| Target Audience | AWS users and administrators looking to automate security patching for EC2 instances. |
The amazon-inspector-auto-remediate tool is designed for promptly patching vulnerabilities in EC2 instances by automating the remediation process for CVE findings identified by Amazon Inspector.
Technically, this tool is implemented as an AWS Lambda function written in Python. It is triggered by SNS notifications generated when Amazon Inspector detects a new CVE finding. The Lambda function checks if the finding is related to a missing patch and ensures that the EC2 instance has the SSM (Simple System Manager) agent installed and running, with the necessary SSM permissions. If these conditions are met, the function uses SSM to issue patch-and-reboot commands for either Ubuntu or Amazon Linux instances.
Operationally, this tool relies on tight integration with AWS services, particularly Amazon Inspector for vulnerability detection and SSM for patch management. The EC2 instances must have the SSM agent installed and configured with appropriate roles, which can introduce some complexity in multi-account or highly segmented environments. Additionally, the automation is triggered in real-time upon receiving SNS notifications, ensuring swift response to newly identified vulnerabilities.
From a technical details perspective, the script handles specific patching commands based on the operating system of the EC2 instance. It also assumes that the necessary permissions and roles are already set up, which can be a point of failure if not properly configured. The use of AWS Lambda ensures scalable and on-demand execution, but it also means that any issues with the Lambda function or its dependencies can impact the overall effectiveness of the remediation process.