Male Speaker: So let's do a demo of the Inspector service
and this is a new iteration of the Inspector service.
So we get a 15-day trial for accounts new to Inspector
and then you have a Pricing
and the Pricing page is going to be right here.
And it's going to give you some information such
as the fact that you're going to get, for example,
a Pricing Table of $0.09 per image being scanned,
$0.01 per rescan,
and then a cost per instance.
Okay?
So, let's get started with Inspector
and for this we need to enable Service Permissions.
So there's a role.
The role has all these permissions to be able to
do what it needs to do.
So it's quite a lot
but it's only managed by the Inspector service.
So we just click on Enable Inspector
and that role is created for us.
So as we can see, we started Inspector
and a first scan is underway,
but for this I need to have EC2 instances.
So if we refresh this page, as we can see,
it goes into finding vulnerabilities for our ECR containers
finding vulnerabilities for EC2 instances
as well as Network reachability findings for EC2 instances.
Also, the best thing to do is to start an EC2 instance
and let's get started.
So the cool thing about EC2 instances is
that if you launch an instance, okay?
And you use, let's use the new UI by the way
just to try it out.
So we use a EC2 instance, I call this Demo EC2 Instance.
What you need to do is just use Amazon Linux
and Amazon Linux Why?
Well, because it comes
with the SSM Agent pre-installed and enabled on it.
So this image is launched.
We're going to use a Free tier eligible image.
We use a t2.micro, and we don't need a key pair and so on.
So I can just scroll down.
We don't need to do anything special.
Let's just launch that instance.
We can proceed without a key pair and be good to go.
Okay. So now the instance is launching.
And as we launch this instance
it is going to be scanned by the Inspector service.
So let me wait, and then I'll get back to you.
So my instance is now running, and if I go into Inspector
and refresh this page, as you can see, there is 0% coverage
but we have 0/1 instances.
So it's been detected, but let's troubleshoot a little bit.
So if I scroll down
and I go to Account Management,
I can see that I have my account enabled for
Amazon Inspector.
And by the way you could Enable Inspector
on your entire organization if you wanted to.
Then under Instances, we have one instance.
We put 0 because we have 0 ECR Repositories.
And then as images
we have 0 ECR container images, to scan.
So Instances we have 1, okay?
But Scanning 0, Not Scanning 1.
So the thing is, if we look at this instance and have a look
at it we scrolled right, it says "Unmanaged EC2 Instance."
So somehow something is wrong with this instance.
And so what we can do is click on this and it says
"follow these instructions to remediate the issue".
So we're going to follow these instructions,
and it takes me straight into the Systems Manager page.
And there is
a AWSSupport-TroubleshootManagedInstance document,
An Automation that we can run,
and we need to provide the Instance Id.
So to do so let's copy the Instance Id
and figure out what is wrong with it.
So we're going to execute this
and we're going to wait until we get the results.
And so it turns out that the instance is online.
So Ping Status is good
but then the GetEC2InstanceProperties fails.
And then the rest
of these things aws:executeScript are Pending.
And so I know what the issue is, of course.
So if you go into Systems Manager, I go in Quick Setup.
And then in Quick Setup, I'm going to get started.
So, we choose a home region for eu-west-1
which is where I am.
And it's going to create the Instance Roles
for me and everything that's needed, and then attach them
to my EC2 instances so that they are properly registered
within the AWS Systems Manager.
So we are going to do Host Management and
as we'll just click on it, and then we'll update the agent
we'll collect inventories kinda instances
and then we are good to go.
The targets are all the instances within my region.
Let's click on Create.
And now we just wait.
So, my Host Management Quick Setup was completed.
And then if we go into our Fleet Manager,
we can see that my instance is being detected by SSM.
So now this is good.
And if I go to my instance and refresh it
I can have a look at the Security tab.
And the fact that yes, an IAM Role was attached
to my instance to be registering it within SSM.
So back in Inspector
if I refresh this page and look at my instances
we can see that my Demo Instance is detected
and now it is in state scanning.
So it is continuously being monitored by Inspector.
And what I need to do now is just wait
for it to find vulnerability.
So as we can see, right now 0 critical findings
but I'm going to pause and come back to you in a few hours.
So I let it run for the whole weekend.
And there are no critical findings, which is good news
because I'm using an Amazon Linux AMI.
And I think they fix most of the issues.
But if you scroll down, you see, they have image
with most critical findings.
And they are all two findings in here.
So if I go into this EC2 Instance has been scanned.
There's been 1 Medium finding, which is something.
And that is that the port reachable,
the port 22 is reachable from an Internal Gateway.
So this is a security group issue,
and it's a Network Reachability type of issue.
So that's it for Inspector.
Obviously you get more findings, the more you run it.
And the more instances you have and the more stuff
you install onto your instances,
but I hope that was helpful.
And to finish, you need to just go into General
and Disable Inspector, because then
you will be billed after 14 days, and then
don't forget as well to terminate
your EC2 instance if you had one.
Okay, that's just for this lecture.
I hope you liked it.
And I will see you in the next lecture.