<file_sep>#!/bin/bash
#This script allows to create a user <user> and access a linux instance without the use of a keypair. Created at launch
user=patrick
password=<PASSWORD>
echo $(curl -s http://169.254.169.254/latest/meta-data/public-hostname) | xargs sudo hostname
useradd -m $user
echo -e "$password\n$password" | passwd $user
usermod -aG sudo $user
usermod -aG wheel $user
#change this to yes --> /etc/ssh/sshd_config  line PasswordAuthentication no
sed -i 's/PasswordAuthentication no/PasswordAuthentication yes/g' /etc/ssh/sshd_config
echo -e "/root/.ssh/id_rsa\n$password\n$password" | ssh-keygen -t rsa
cat /root/.ssh/id_rsa.pub >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys
/etc/init.d/ssh restart  #debian systems
#/sbin/service sshd restart #rhel systems



wget -O /tmp/ssmagent.deb	https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/debian_amd64/amazon-ssm-agent.deb
dpkg -i /tmp/ssmagent.deb







<file_sep>This folder contains information on Ansible
<file_sep>
# [How to Inspect Instances for vulnerabilities]()

This markdown will take you through using AWS Inspector to scan EC2 instances for Common vulnerabilities and exposures (CVEs) and set up Amazon SNS notifications. This will have four subsections;

1. Install the Amazon Inspector agent by using EC2 Run Command.
2. Set up notifications using Amazon SNS to notify us of any findings.
3. Define an Amazon Inspector target and template to define what assessment to perform on our EC2 instance.
4. Schedule Amazon Inspector assessment runs to assess our EC2 instance on a regular interval.

##### Prerequisites
In order to scan instances for vulnerabilities, the instances should have the following;

- Correct tagging on the instances with ``Key: Patch Group`` and ``Value: (desired) Servers e.g Ubuntu Servers``
- EC2 role that enables the instances to communicate with Systems Manager
- SSM agent is installed in the instance
- Inspector agent is installed in the instance


##### Instance Tagging
In addition to the Name tagging, we require to have Patch Group tags for each instance we are going to scan. Refer to the image below.

![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/tagging.png)

##### IAM Role
The Iam role will have the following policies attached to it;

```
AmazonEC2RoleforSSM
AmazonSSMFullAccess

```

## 1. Install the Amazon Inspector.
Amazon Inspector can help you scan your EC2 instance using prebuilt rules packages, which are built and maintained by AWS. These prebuilt rules packages tell Amazon Inspector what to scan for on the EC2 instances you select. Amazon Inspector provides the following prebuilt packages

 - Common Vulnerabilities and Exposures
 - Security Best Practices
 - CIS Operating System Security Configuration Benchmarks
 - Runtime Behavior Analysis
 
 ![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/inspector_packages.png)
 
We are going to make sure we keep our EC2 instances inspected for common vulnerabilities and exposures (CVEs). As a result, we will focus on how to use the CVE rules package and use our instance tags to identify the instances on which to run the CVE rules. If our EC2 instance is fully patched using Systems Manager, we should not have any findings with the CVE rules package. Regardless, as a best practice AWS recommends that we use Amazon Inspector as an additional layer for identifying any unexpected failures. This involves using Amazon CloudWatch to set up weekly Amazon Inspector scans, and configuring Amazon Inspector to notify of any findings through SNS topics. By acting on the notifications we receive, we can respond quickly to any CVEs on any of our EC2 instances to help ensure that malware using known CVEs does not affect our EC2 instances.

 ### Install the Amazon Inspector agent
 
#### (a) Using EC2 userdata to install both Inspector agent and SSM agent

 Use the following text into the user data section before launching the instance:
 ##### ubuntu instance
 ```
#!/bin/bash
cd /tmp
wget https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/debian_amd64/amazon-ssm-agent.deb
dpkg -i amazon-ssm-agent.deb
curl -O https://d1wk0tztpsntt1.cloudfront.net/linux/latest/install
chmod a+x /tmp/install
bash /tmp/install
 ```
 
 ##### Centos Instance
 ```
#!/bin/bash
cd /tmp
yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
curl -O https://d1wk0tztpsntt1.cloudfront.net/linux/latest/install
chmod a+x /tmp/install
bash /tmp/install
 ```
 ##### Amazon Linux
 ```
#!/bin/bash
cd /tmp
yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
curl -O https://d1wk0tztpsntt1.cloudfront.net/linux/latest/install
chmod a+x /tmp/install
bash /tmp/install
 ```
 ##### RHEL Instance
 ```
#!/bin/bash
cd /tmp
yum install -y https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
curl -O https://d1wk0tztpsntt1.cloudfront.net/linux/latest/install
chmod a+x /tmp/install
bash /tmp/install
 ```
 ##### SUSE Linux Enterprise Server (SLES) 12
 ```
#!/bin/bash
cd /tmp
wget https://s3.amazonaws.com/ec2-downloads-windows/SSMAgent/latest/linux_amd64/amazon-ssm-agent.rpm
rpm --install amazon-ssm-agent.rpm
curl -O https://d1wk0tztpsntt1.cloudfront.net/linux/latest/install
chmod a+x /tmp/install
bash /tmp/install

 ```
#### (b)Installing Inspector Agent using EC2 SSM
To install the Amazon Inspector agent, you will use EC2 Run Command, which allows you to run any command on any of your EC2 instances that have the Systems Manager agent with an attached IAM role that allows access to Systems Manager.

1. Choose Run Command under Systems Manager Services in the navigation pane of the EC2 console. Then choose Run a command.

![Image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/runcommand.png)
   
2. To install the Amazon Inspector agent, you will use an AWS managed and provided command document that downloads and installs the agent for you on the selected EC2 instance. Choose AmazonInspector-ManageAWSAgent. To choose the target EC2 instance where this command will be run, use the tag you previously assigned to your EC2 instance, Patch Group, with a value of Windows Servers. For this example, set the concurrent installations to 1 and tell Systems Manager to stop after 5 errors.
![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/installinspector%20agentssm.png)
   
3. Retain the default values for all other settings on the Run a command page and choose Run. Back on the Run Command page, you can see if the command that installed the Amazon Inspector agent executed successfully on all selected EC2 instances.
![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/runcmdsuccess.png)
   
### Set up notifications using Amazon SNS

Now that you have installed the Amazon Inspector agent, you will set up an SNS topic that will notify you of any findings after an Amazon Inspector run.

To set up an SNS topic:

1. In the AWS Management Console, choose Simple Notification Service under Messaging in the Services menu.
2. Choose Create topic, name your topic (only alphanumeric characters, hyphens, and underscores are allowed) and give it a display name to ensure you know what this topic does. Choose Create topic.

![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/snstopic.png)

3. To allow Amazon Inspector to publish messages to your new topic, choose Other topic actions and choose Edit topic policy.
4. For Allow these users to publish messages to this topic and Allow these users to subscribe to this topic, choose Only these AWS users. Type the following ARN for the Region in which you are deploying the solution: ``arn:aws:iam::xxxxxxxxxxxxxxx:root. ``This is the ARN of Amazon Inspector itself.

![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/snspolicy.png)

5. To receive notifications from Amazon Inspector, subscribe to your new topic by choosing Create subscription and adding your email address. After confirming your subscription by clicking the link in the email, the topic should display your email address as a subscriber. Later, you will configure the Amazon Inspector template to publish to this topic.

![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/topic%20details.png)
 
### Define an Amazon Inspector target and template

Now that you have set up the notification topic by which Amazon Inspector can notify you of findings, you can create an Amazon Inspector target and template. A target defines which EC2 instances are in scope for Amazon Inspector. A template defines which packages to run, for how long, and on which target.

To create an Amazon Inspector target:
1. Navigate to the Amazon Inspector console and choose Get started.

2. For Amazon Inspector to be able to collect the necessary data from your EC2 instance, you must create an IAM service role for Amazon Inspector. We are going to use IAM service role which AWS has created for us.

![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/inspectorprerequisites.png)

3. Amazon Inspector also asks you to tag your EC2 instance and install the Amazon Inspector agent. You already performed these steps previously, so you can proceed by choosing Next. To define the Amazon Inspector target, choose the previously used Patch Group tag with the desired value. This is the same tag that you used to define the targets for patching. Then choose Next.
![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/assessment%20targets.png)

4. Now, define your Amazon Inspector template, and choose a name and the package you want to run. For this post, use the Common Vulnerabilities and Exposures package and choose the default duration of 1 hour. As you can see, the package has a version number, so always select the latest version of the rules package if multiple versions are available.
![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/assessment%20template.png)

5. Configure Amazon Inspector to publish to your SNS topic when findings are reported. You can also choose to receive a notification of a started run, a finished run, or changes in the state of a run. For this demo, you want to receive notifications if there are any findings. To start, choose Assessment Templates from the Amazon Inspector console and choose your newly created Amazon Inspector assessment template. Choose the icon below SNS topics (see the following screenshot).
![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/snsinspector.png)

6. A pop-up appears in which you can choose the previously created topic and the events about which you want SNS to notify you (choose Finding reported).
![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/snspopup.png)

### Schedule Amazon Inspector assessment runs]
The last step in using Amazon Inspector to assess for CVEs is to schedule the Amazon Inspector template to run using Amazon CloudWatch Events. This will make sure that Amazon Inspector assesses your EC2 instance on a regular basis. To do this, you need the Amazon Inspector template ARN, which you can find under Assessment templates in the Amazon Inspector console. CloudWatch Events can run your Amazon Inspector assessment at an interval you define using a Cron-based schedule. Cron is a well-known scheduling agent that is widely used on UNIX-like operating systems and uses the following syntax for CloudWatch Events.

![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/cron.png)

All scheduled events use a UTC time zone, and the minimum precision for schedules is one minute. For more information about scheduling CloudWatch Events, see Schedule Expressions for Rules.

To create the CloudWatch Events rule:
1. Navigate to the CloudWatch console, choose Events, and choose Create rule.

![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/cwconsole.png)

2. On the next page, specify if you want to invoke your rule based on an event pattern or a schedule. For this task, you will select a schedule based on a Cron expression.

3. You can schedule the Amazon Inspector assessment any time you want using the Cron expression, or you can use the Cron expression I used in the following screenshot, which will run the Amazon Inspector assessment every Sunday at 00:00 A.M. GMT.
![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/cwrule.png)

4. Choose Add target and choose Inspector assessment template from the drop-down menu. Paste the ARN of the Amazon Inspector template you previously created in the Amazon Inspector console in the Assessment template box and choose Create a new role for this specific resource. This new role is necessary so that CloudWatch Events has the necessary permissions to start the Amazon Inspector assessment. CloudWatch Events will automatically create the new role and grant the minimum set of permissions needed to run the Amazon Inspector assessment. To proceed, choose Configure details.

![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/insptarget.png)

5. Next, give your rule a name and a description. I suggest using a name that describes what the rule does, as shown in the following screenshot.
6. Finish the wizard by choosing Create rule. The rule should appear in the Events – Rules section of the CloudWatch console.

![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/cwdconfigurename.png)

7. To confirm your CloudWatch Events rule works, wait for the next time your CloudWatch Events rule is scheduled to run. For testing purposes, you can choose your CloudWatch Events rule and choose Edit to change the schedule to run it sooner than scheduled.

![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/cwrules.png)

8. Now navigate to the Amazon Inspector console to confirm the launch of our first assessment run. The Start time column shows the time each assessment started and the Status column the status of our assessment. In the following screenshot, you can see Amazon Inspector is busy Collecting data from the selected assessment targets.

![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/inspcollectingdata.png)

### Findings Report
This section shows the findings of the scanning
![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/Assessmentrpt.png)
![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/sec1.png)
![image](https://github.com/patrickmukumbu/DevOps/blob/master/Task%2014/Images/sec2.png)
