You are working as a SysOps administrator for a large financial organization using AWS EC2 instance for its extranet applications.
To enhance the security of new Linux-based EC2 instances, management has decided to automate vulnerability checks for future instance launches to include Amazon Inspector.
You are evaluating different ways to install Amazon Inspector on these new EC2 instances that are launched continuously in a large number based upon user demand.
The security team has a mandate that no additional agent needs to be part of this installation process.
Which of the following would help install Amazon Inspector automatically in the most secure way with the least effort?
Click on the arrows to vote for the correct answer
A. B. C. D.Correct Answer - B.
You can use the Amazon Linux 2 AMI with Amazon Inspector Agent which has the agent preinstalled and requires no additional steps to install or set up the agent.
To start using Amazon Inspector with these EC2 instances, tag them to match the assessment target that you want.
The configuration of Amazon Linux 2 AMI with Amazon Inspector Agent enhances security by focusing on two main security goals: limiting access and reducing software vulnerabilities.
https://docs.aws.amazon.com/inspector/latest/userguide/inspector_installing-uninstalling-agents.html#ami-with-agentOption A is incorrect.
However, this is a fully automated process to install Amazon Inspector once the EC2 instance is in running state.
This will also require the EC2 Systems Manager agent to be installed.
Option C is incorrect as for running Amazon EC2 Systems Manager, EC2 Systems Manager agent needs to be installed which is not required by Security Team.
Option D is incorrect as although this is without any agent, this will incur additional admin work to configure the bash script each time an EC2 instance is launched.
For more information on installing Amazon Inspector, refer to the following URL-
https://aws.amazon.com/inspector/faqs/Sure, I can help explain each of the options and their suitability for the scenario described in the question.
A. Use CloudWatch Events to trigger the Lambda function, which will execute Amazon EC2 Systems Manager to install Amazon Inspector.
This option involves using CloudWatch Events to trigger a Lambda function, which will then execute Amazon EC2 Systems Manager to install Amazon Inspector. Amazon EC2 Systems Manager is a service that enables centralized management of EC2 instances, including patching, configuration management, and executing scripts. Using this option, the Lambda function can be triggered whenever a new EC2 instance is launched, and it can then execute a Systems Manager document to install Amazon Inspector.
This approach is secure because it does not require any additional agents to be installed on the EC2 instances, as mandated by the security team. It also ensures that Amazon Inspector is automatically installed on all new instances launched, without any manual intervention. However, it may require some effort to set up the CloudWatch Events rule, Lambda function, and Systems Manager document.
B. Use Amazon Linux 2 AMI with Amazon Inspector Agent.
This option involves using an Amazon Linux 2 AMI that already includes the Amazon Inspector Agent. When launching new EC2 instances, you can select this AMI as the base image, which will automatically install the Amazon Inspector Agent on the instances. This option is straightforward and requires minimal effort.
However, this approach does not meet the security team's mandate of not installing any additional agents on the EC2 instances. Additionally, this approach may not work if the organization is already using a different Linux distribution or version.
C. Use Amazon EC2 Systems Manager Run Command to install Amazon Inspector.
This option involves using Amazon EC2 Systems Manager Run Command to execute a script that installs Amazon Inspector on the new EC2 instances. Similar to option A, this approach does not require any additional agents to be installed on the EC2 instances. It also ensures that Amazon Inspector is automatically installed on all new instances launched, without any manual intervention.
However, this approach may require more effort to set up the Systems Manager document and script than option A.
D. Use EC2 User Data Feature to install Amazon Inspector using script.
This option involves using the EC2 User Data feature to specify a script that installs Amazon Inspector when the EC2 instance is launched. This approach is straightforward and requires minimal effort.
However, this approach does not meet the security team's mandate of not installing any additional agents on the EC2 instances. Additionally, this approach may not work if the organization is already using a different Linux distribution or version.
In conclusion, the most suitable option for automatically installing Amazon Inspector in a secure and efficient manner without installing any additional agents would be to use CloudWatch Events to trigger a Lambda function, which will execute Amazon EC2 Systems Manager to install Amazon Inspector (option A).