ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-10 14:55:00 +00:00
Code Issues Packages Projects Releases Wiki Activity

encryption of ebs volume

Browse Source
This commit is contained in:
Julio Delgado Jr
2020-05-06 10:55:42 -04:00
parent 49456424fa
commit d6033e287d
2 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
util/org-multi-account/ProwlerEC2.yaml
View File

@@ -108,6 +108,14 @@ Resources:
SubnetId: !Ref SubnetId SubnetId: !Ref SubnetId
SecurityGroupIds: SecurityGroupIds:
- !Ref ProwlerSecurityGroup - !Ref ProwlerSecurityGroup
BlockDeviceMappings:
- DeviceName: /dev/xvda
Ebs:
Encrypted: true
KmsKeyId: alias/aws/ebs
VolumeType: standard
DeleteOnTermination: true
VolumeSize: 8
Tags: Tags:
- Key: Name - Key: Name
Value: !Ref ProwlerEc2Name Value: !Ref ProwlerEc2Name

3
util/org-multi-account/README.md
View File

@@ -40,6 +40,7 @@ Deploys [Prowler](https://github.com/toniblyx/prowler) to assess all Accounts in
- Creates Prowler EC2 instance - Creates Prowler EC2 instance
- Uses the Latest Amazon Linux 2 AMI - Uses the Latest Amazon Linux 2 AMI
- Uses ```t2.micro``` Instance Type - Uses ```t2.micro``` Instance Type
- Encrypts Root Volume with AWS Managed Key "aws/ebs"
- Uses [cfn-init](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-init.html) for prepping the Prowler EC2 - Uses [cfn-init](https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/cfn-init.html) for prepping the Prowler EC2
- Installs necessary [packages](https://github.com/toniblyx/prowler#requirements-and-installation) for Prowler - Installs necessary [packages](https://github.com/toniblyx/prowler#requirements-and-installation) for Prowler
- Downloads [run-prowler-reports.sh](src/run-prowler-reports.sh) script from Prowler S3 from Component #1. - Downloads [run-prowler-reports.sh](src/run-prowler-reports.sh) script from Prowler S3 from Component #1.
@@ -47,7 +48,7 @@ Deploys [Prowler](https://github.com/toniblyx/prowler) to assess all Accounts in
- Creates cron job for Prowler to run on a schedule. - Creates cron job for Prowler to run on a schedule.
- Creates Prowler Security Group - Creates Prowler Security Group
- Denies inbound access. If using ssh to manage Prowler, then update Security Group with pertinent rule. - Denies inbound access. If using ssh to manage Prowler, then update Security Group with pertinent rule.
- Allows outbound 80/443 for updates, and Amazon S3 communications - Allows outbound 80/443 for updates, and Amazon S3 communications -
- Creates Instance Role that is used for Prowler EC2 - Creates Instance Role that is used for Prowler EC2
- Role has permissions for [Systems Manager Agent](https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent.html) communications, and [Session Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html) - Role has permissions for [Systems Manager Agent](https://docs.aws.amazon.com/systems-manager/latest/userguide/ssm-agent.html) communications, and [Session Manager](https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html)
- Role has rights to Prowler S3 from Component #1. - Role has rights to Prowler S3 from Component #1.