OWASP + AWS user groups: Using the OWASP Top 10 in AWS Turbo talk 2: Event-based Scanning for AMI enforcement in AWS - Matt Badanes, Cloud Security Manager, Morningstar

1. ©2018 Morningstar, Inc. All rights reserved.
Matt Badanes
Event-based Scanning for AMI
Enforcement in AWS

2. Our Environment
2
g Decentralized, multi-accountapproach
g ~100 AWS Accounts
g 2 accountsper team (non-prod and prod)
g Support 7 regions. Most teams are in 2 US regions
g Foundational piecesmanaged by terraform (VPC, Cloudtrail,IAM basics, ETC)
/ Everything as code
g Federatedlogin with ADFS
/ Minimize use of IAM Users
g AMIs released on a monthlycadence. Shared from a central account
g Expect teams to fork our AMIs as needed

3. Our AMIs
3
g Built monthly using chef, packer and terraform
g 8 Different images
g Shared to all accounts and all regions
g Configurationmanagementbaked in
g CIS hardened
g Patched
g Not dependenton AWS generated keys for authentication
g On completion,send notifcation to SNS

4. The Problem
g Morningstar maintainsa set of base images for our teams to deploy
g This ensures we maintainassecure a configurationof our images as possible (A6-
Security Misconfiguration fromthe OWASP Top 10 in 2017)
g AWS makes it hard to find these images and defaultsto their own quickstart
g We need to controlwhat AMIs our developersuse from inceptionso they don’t make it
to prod
g IAM can handle this, but it doesn’t easily allow for exception handing
g Commercial products can handle some of this, but implementationis either incomplete,
not easily customizableand/or expensive
g Open-source solutions providea good foundation,but the actual AWS interactionsaren’t
the hard part, it’s the customizations

5. Our Requirements
5
g Minimalinfrastructure to maintain
g Modular
g Highly customizable
g Near “real-time”
g Cross-account and cross-regional support
g Varying levelsof remediation
g Easilyexpandableas new requirementscome in or new services need scanning

6. A Solution
6
g When any EC2 (or S3, secretsmanager, etc.) event is triggered, event is sent to a central
cloudwatchevent.
g Cloudwatch event triggers a routing lambdato determine if system has any actions
registered with the event
g If event exists (in this case, it does), a corresponding step function is executed. One of
these actions looks at the AMI that was launchedfor the instance (or will be launched if
it’s autoscale).
g If the AMI does not fit our criteria (check owner ID or a tag to a corresponding ticket for
an exception), remediate

7. 7
What does it look like?

8. 8

9. The Tool-kit (so far)
9
g CloudWatchEvents and Event Bus
g SNS
g Lambda
g Step-functions
g DynamoDB

10. Future Enhancements
10
g Scan more services
g Expand scan criteria for services we scan today
g Kill instances that are not compliant
g Complexanalysisand workflows
g Wider adoption