A solution to extend AWS Config to OS level resources about aws-config-rules HOT 4 CLOSED

Hey @totoleon , this is really cool. Any idea how much this solution could augment Amazon Inspector?

FYI @aaronkhoo

from aws-config-rules.

Hey @jongogogo thanks for replying :) I think it serves different purposes from Inspector. Inspector is for common OS level vulnerability scan. From what I understand, Inspector provides 4 Rule packages which you can run, but there is no flexibility to customized or extend. With SSM run command, you can do any compliance check on-premise.

I guess in comparison, Inspector is more useful for getting common compliance status of a batch of instances. For this part, Config+Lambda+SSM can do the same but might be duplicating. But on top of that, it provides flexibility to customize checks. On the other hand, if it's just application level compliance check, Config+Lambda should be enough for many situation. But again, working with SSM can be a way to extend.

In our case, we just didn't find any existing approach for checking compliance status of AD users. Having Lambda perform AD functions was too complicated. So we decided to let AD itself reporting back to Config using SSM run command.

from aws-config-rules.

I believe it is really cutting edge. Love to see you iterating on this. Let me know how we can possibly help!

from aws-config-rules.

Comment taken to the service team for consideration on their side. Closing, please reopen if anything else.

from aws-config-rules.