Comments (4)
Hey @totoleon , this is really cool. Any idea how much this solution could augment Amazon Inspector?
FYI @aaronkhoo
from aws-config-rules.
Hey @jongogogo thanks for replying :) I think it serves different purposes from Inspector. Inspector is for common OS level vulnerability scan. From what I understand, Inspector provides 4 Rule packages which you can run, but there is no flexibility to customized or extend. With SSM run command, you can do any compliance check on-premise.
I guess in comparison, Inspector is more useful for getting common compliance status of a batch of instances. For this part, Config+Lambda+SSM can do the same but might be duplicating. But on top of that, it provides flexibility to customize checks. On the other hand, if it's just application level compliance check, Config+Lambda should be enough for many situation. But again, working with SSM can be a way to extend.
In our case, we just didn't find any existing approach for checking compliance status of AD users. Having Lambda perform AD functions was too complicated. So we decided to let AD itself reporting back to Config using SSM run command.
from aws-config-rules.
I believe it is really cutting edge. Love to see you iterating on this. Let me know how we can possibly help!
from aws-config-rules.
Comment taken to the service team for consideration on their side. Closing, please reopen if anything else.
from aws-config-rules.
Related Issues (20)
- parameters.json tags not working
- Conformance Pack for ISO 27001 HOT 8
- Scope By Resource Tags
- S3 bucket policy prohibited on web-server mode
- cloudtrail-enabled managed rule evaluates at a regional level
- Serverless best practice - LambdaInsideVpc
- Operational-Best-Practices-for-HIPAA-Security.yaml does not allow the no-unrestricted-route-to-igw Rule's routeTableIds Parameter to be set
- Python required tag for many resources
- Missing python code for ec2-imds-check
- Operational-Best-Practices-for-NZISM.yaml is too long to be used HOT 1
- Operational-Best-Practices-for-CMMC-2.0-Level-2: Conflicting Config Rules HOT 1
- multi-region-cloudtrail-enabled always fails
- Support “eks-endpoint-no-public-access” and “eks-secrets-encrypted” in the “us-west-1” region
- Update in Rule EC2_SECURITY_GROUP_NOT_USED
- Map Config Rules to CIS Benchmark Rules
- Error when applying Operational-Best-Practices-for-CCN-ENS-Medium
- NIST 800-171 / CMMC 2.0 Level 2 in AWS GovCloud HOT 4
- Getting [ERROR] KeyError: 'invokingEvent' while executing IAM_USER_MFA_ENABLED HOT 1
- Conformance Pack for FedRamp not deployable in GovCloud
- PCI DSS 4.0.0
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from aws-config-rules.