Scanning for AWS Security Issues with Trivy
1–10 of 16 posts
Re: Scanning for AWS Security Issues with Trivy
#2Re: Scanning for AWS Security Issues with Trivy
#3This doesn't make sense to me but probably because I've not understood trivy. Inspecting file type things (docker, file, terraform) was what trivy had been doing so far. This however is now a network inspection and doesn't feel like it fits?
Re: Scanning for AWS Security Issues with Trivy
#4Readers may also enjoy Steampipe [1]. It's an open source "ops as code" CLI to query 83+ services with SQL (AWS, GitHub, Terraform, etc) that comes with hundreds of ready to use benchmarks (CIS, NIST, Cost) and dashboards built in HCL. The AWS Compliance mod [2] and Trivy plugin [3] are specific examples. (Disclaimer - I'm a lead on the project.)
1 - https://steampipe.io 2 - https://hub.steampipe.io/mods/turbot/aws_compliance 3 - https://hub.steampipe.io/plugins/turbot/trivy
Re: Scanning for AWS Security Issues with Trivy
#5Also this https://www.fugue.co/ I learned about this tool by interviewing with them. Nice guys.
Re: Scanning for AWS Security Issues with Trivy
#6Just tried it
./trivy aws --region us-east-1
panic: runtime error: invalid memory address or nil pointer dereference
Posted a Github issue as well
Re: Scanning for AWS Security Issues with Trivy
#7Shameless plug, you can also enjoy CloudQuery (https://github.com/cloudquery/cloudquery) where we take a more ELT approach so you can use plain SQL for policies (https://github.com/cloudquery/cloudquery/tree/main/plugins/s...) and then use any BI tools for visualization and monitoring (https://github.com/cloudquery/cloudquery/tree/main/plugins/s...).
Shout out to steampipe bellow as a similar project though that takes a more real-time approach rather then ELT which has it's use-cases as well.
Re: Scanning for AWS Security Issues with Trivy
#8AWS has on it's one own native tool to scan the images.
Re: Scanning for AWS Security Issues with Trivy
#9Alternate tool in the same space: https://github.com/nccgroup/ScoutSuite
Re: Scanning for AWS Security Issues with Trivy
#10Why not use AWS Security Hub? It already supports reading in all your accounts into a centralized report and running it against multiple standards.
You do pay for it (~$30 a month for my job) but you quite literally check a box and have no setup.