Interpres Application - AWS Inspector Integration

Type: Vulnerability
Vendor: AWS
The AWS Inspector integration will pull in vulnerabilities and assets (EC2 instances). The integration will read all AWS Inspector findings to extract vulnerabilities and the AWS Inspector coverage to extract the assets.
Vendor setup
1.0 Create an AWS policy with the following JSON permission:
﻿IAM Policy Creation﻿
If creating your own policy please create a policy with the following permissions:
JSON
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "organizations:DescribeOrganizationalUnit",
                "organizations:DescribeAccount",
                "organizations:DescribeOrganization",
                "inspector2:ListFindings",
                "inspector2:ListCoverage"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "VisualEditor0"
        }
    ]
}
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "organizations:DescribeOrganizationalUnit",
                "organizations:DescribeAccount",
                "organizations:DescribeOrganization",
                "inspector2:ListFindings",
                "inspector2:ListCoverage"
            ],
            "Effect": "Allow",
            "Resource": "*",
            "Sid": "VisualEditor0"
        }
    ]
}
﻿
2.0 Create an AWS role and attach the policy created in the step 1
﻿IAM Role Creation﻿
3.0 Choose one of the authentication methods currently supported by the integration
Using an AWS user with secret key and id directly to access resources
Create an AWS User with programmatic access only
﻿AWS User Creation﻿
Create AWS Access Key ID and AWS Secret Access Key and store in a safe place
Attach the role created from step 2 to new user:
﻿Assigning users or group a role﻿
Using an attached role to access resources
Note: This method can only be used if you are self hosting your Interpres deployments in AWS
Using an attached role to assume another role to access resources
Note: This method can only be used if your Interpres deployment is hosted in AWS
Note: External ID is required for this method. Interpres will provide you with it
For more information about cross account IAM roles: link﻿
JSON
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::{ACCOUNT_NUMBER}:role/{STEP_3.3.1_ROLE_NAME}"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "{ASK_INTERPRES_FOR_YOUR_EXTERNAL_ID}"
                }
            }
        }
    ]
}
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {
                "AWS": "arn:aws:iam::{ACCOUNT_NUMBER}:role/{STEP_3.3.1_ROLE_NAME}"
            },
            "Action": "sts:AssumeRole",
            "Condition": {
                "StringEquals": {
                    "sts:ExternalId": "{ASK_INTERPRES_FOR_YOUR_EXTERNAL_ID}"
                }
            }
        }
    ]
}
﻿
App Configuration
App Parameters:
* Note *The AWS Integrations can be configured in multiple ways of authentcation and the required inputs are as follows
Using an AWS user with secret key and id directly to access resources
Access Key
Secret Key
Using an attached role to access resources
Use attached role when running in EC2 - True
Using an attached role to assume another role to access resources
Use attached role when running in EC2 - True
Use attached role to assume another specified role
Access Key: If using Authentication method 1 (step 3.1) provide AWS_ACCESS_KEY for user
Secret Key: If using Authentication method 1 (step 3.1) provide AWS_SECRET_KEY for user
Use Role: Check this box if using Authentication method 2 (step 3.2) or 3 (step 3.3)
Assume Role: AWS cross account role arn to assume (Created in step 2)
Region: AWS Region to monitor for the resources
App Validation
Check there is connectivity (green light) in the integration created.
Implemented Actions
Get Assets: Returns a list of assets (EC2 Instances)
Get Vulnerabilities: Gets Findings (Vulnerabilities) for the assets (EC2 Instances)
﻿
Did this page help you?
Interpres Application - AWS GuardDuty Integration
Interpres Application - AWS Security Hub Integration