forward3d/garrison-agent-aws-inspector

Garrison Agent - AWS Inspector

这是https://github.com/forward3d/garrison安全项目的一部分。该代理提供AWS Inspector警报的镜像功能及其他基础检查。

提供的检查

安装与示例

Docker Hub - https://hub.docker.com/r/forward3d/garrison-agent-aws-inspector/

bash
docker pull docker.xuanyuan.run/forward3d/garrison-agent-aws-inspector
docker run --rm -e "GARRISON_URL=https://garrison.internal.acme.com" docker.xuanyuan.run/forward3d/garrison-agent-aws-inspector check_findings
docker run --rm -e "GARRISON_URL=https://garrison.internal.acme.com" -e "GARRISON_AWS_REGIONS=eu-west-1,us-west-2" docker.xuanyuan.run/forward3d/garrison-agent-aws-inspector check_findings

代理特定配置

以下是该代理的额外特定配置选项。https://github.com/forward3d/garrison#global-configuration-options仍然适用。

1. AWS SDK在运行时返回的、Inspector服务可用的AWS区域。
2. AWS SDK在运行时为该区域包含的所有规则包。如果需要指定，请使用https://docs.aws.amazon.com/inspector/latest/userguide/inspector_rules-arns.html中描述的名称。

AWS认证

由于需要访问AWS API，您需要至少具备以下IAM策略才能正常运行：

json
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "inspector:ListRulesPackages",
                "inspector:DescribeRulesPackages",
                "inspector:ListAssessmentRuns",
                "inspector:DescribeAssessmentRuns",
                "inspector:ListFindings",
                "inspector:DescribeFindings"
            ],
            "Resource": "*",
            "Effect": "Allow"
        }
    ]
}

我们建议使用EC2/ECS任务角色，这样您就无需将凭据传入容器。如果无法使用这些角色或希望传入特定的访问密钥和秘密密钥，请参阅https://docs.aws.amazon.com/sdk-for-ruby/v3/developer-guide/setup-config.html#aws-ruby-sdk-credentials-environment了解操作方法。