Find Public IPs of Resources – Use AWS Config for Vulnerability Assessment
AWS Architecture BlogFind Public IPs of Resources – Use AWS Config for Vulnerability Assessmentby Gurkamal Deep Singh Rakhra and Gilles-Kuessan Satchivi | on21 DEC 2021| inAmazon EventBridge,Amazon Simple Storage Service (S3),Architecture,AWS Config,AWS Lambda,AWS Organizations|Permalink|ShareSystems vulnerability management is a key component of your enterprise security program. Its goal is to remediate OS, software, and applications vulnerabilities. Scanning tools can help identify and classify these vulnerabilities to keep the environment secure and compliant.Typically, vulnerability scanning tools operate from internal or external networks to discover and report vulnerabilities. For internal scanning, the tools use private IPs of target systems in scope. For external scans, the public target system’s IP addresses are used. It is important that security teams always maintain an accurate inventory of all deployed resource’s IP addresses. This ensures a comprehensive, consistent, and effective vulnerability assessment.This blog discusses a scalable, serverless, and automated approach to discover public IP addresses assigned to resources in a single or multi-account environment in AWS, usingAWS Config.Single accountis when you have all your resources in a single AWS account. Amulti-accountenvironment refers to many accounts under the sameAWS Organization.Understanding scope of solutionYou may have good visibility into the private IPs assigned to your resources:Amazon Elastic Compute Cloud (Amazon EC2),Amazon Elastic Kubernetes Service (EKS)clusters,Elastic Load Balancing (ELB), andAmazon Elastic Container Service (Amazon ECS). But it may require some effort to establish a complete view of the existing public IPs. And these IPs can change over time, as new systems join and exit the environment.Anelastic network interfaceis a logical networking component in a Virtual Private Cloud (VPC) that represents a virtual network card. The elastic network interface routes traffic to other destinations/resources. Usually, you have to makeDescribe* API calls for the specific resource with anelastic network interfaceto get information about its configuration and IP address. This may throttle the resource-specific API calls, and result in higher costs. Additionally, if there are tens or hundreds of accounts, it becomes exponentially more difficult to get the information into a single inventory.AWS Config enables you to assess, audit, and evaluate the configurations of your AWS resources. Theadvanced queryfeature provides a single query endpoint and language to get current resource state metadata for a single account and Region, or multiple accounts and Regions. You can useconfiguration aggregatorsto run the same queries from a central account across multiple accounts andAWS Regions.AWS Config supports asubset of structured query language (SQL) SELECTsyntax, which enables you to perform property-based queries and aggregations on the currentconfiguration item (CI)data. Advanced query is available at no additional cost to AWS Config customers in all AWS Regions (except China Regions) and AWS GovCloud (US).AWS Organizations helps you centrally govern your environment. Its integration with other AWS services lets you define central configurations, security mechanisms, audit requirements, and resource sharing across accounts in your organization.Choosing scope of advanced queries in AWS ConfigWhen running advanced queries in AWS Config, you must choose the scope of the query. The scope defines the accounts you want to run the query against and is configured when you create an aggregator.Following are the three possible scopes when running advanced queries:Single account and single RegionMultiple accounts and multiple RegionsAWS Organization accountsSingle account and single RegionFigure 1. AWS Config workflow for single account and single RegionThe use case shown in Figure 1 addresses the need of customers operating within a single account and single Region. WithAWS Config enabledfor the individual account, you will use AWS Config advanced query feature to run SQL queries. These will give you resource metadata about associated public IPs. You do not require an aggregator for single-account and single Region.In Figure 1.1, the advanced query returned results from a single account and all Availability Zones within the Region in which the query was run.Figure 1.1 Advanced query returning results for a single account and single RegionQuery for referenceSELECTresourceId,resourceName,resourceType,configuration.association.publicIp,availabilityZone,awsRegionWHEREresourceType='AWS::EC2::NetworkInterface'AND configuration.association.publicIp>'0.0.0.0'This query is fetching the properties of all elastic network interfaces. The WHERE condition is used to list the elastic network interfaces using theresourceTypeproperty and find all public IPs greater than 0.0.0.0. This is because elastic network interfaces can exist with a private IP, in which case there will be no public IP assigned to it. For a list of supportedresourceType, refer tosupported resource typesfor AWS Config.Multiple accounts and multiple RegionsFigure 2. AWS Config monitoring workflow for multiple account and multiple Regions. The figure shows EC2, EKS, and Amazon ECS, but it can be any AWS resource having a public elastic network interface.AWS Config enables you to monitor configuration changes against multiple accounts and multiple Regions via anaggregator, see Figure 2. An aggregator is an AWS Config resource type that collects AWS Config data from multiple accounts and Regions. You can choose the aggregator scope when running advanced queries in AWS Config. Remember toauthorize the aggregator accountsto collect AWS Config configuration and compliance data.Figure 2.1 Advanced query returning results from multiple Regions (awsRegioncolumn) as highlighted in the diagramThis use case applies when you have AWS resources in multiple accounts (or span multiple organizations) and multiple Regions. Figure 2.1 shows the query results being returned from multiple AWS Regions.Accounts in AWS OrganizationFigure 3. The workflow of accounts in an AWS Organization being monitored by AWS Config. This figure shows EC2, EKS, and Amazon ECS but it can be any AWS resource having a public elastic network interface.An aggregator also enables you to monitor all the accounts in your AWS Organization, see Figure 3. When this option is chosen, AWS Config enables you to run advanced queries against theconfiguration historyin all the accounts in your AWS Organization. Remember that an aggregator will only aggregate data from the accounts and Regions that are specified when the aggregator is created.Figure 3.1 Advanced query returning results from all accounts (accountIdcolumn) under an AWS OrganizationIn Figure 3.1, the query is run against all accounts in an AWS Organization. This scope of AWS Organization is accomplished by the aggregator and it automatically accumulates data from all accounts under a specific AWS Organization.Common architecture workflow for discovering public IPsFigure 4. High-level architecture pattern for discovering public IPsThe workflow shown in Figure 4 starts with Amazon EventBridge triggering anAWS Lambdafunction. You can configure an Amazon EventBridgeschedule via rate or cron expressions, which define the frequency. This AWS Lambda function will host the code to make an API call to AWS Config that will run an advanced query. The advanced query will check for all elastic network interfaces in your account(s). This is because any public resource launched in your account will be assigned an elastic network interface.When the results are returned, they can be stored onAmazon S3. These result files can be timestamped (via naming orS3 versioning) in order to keep a history of public IPs used in your account. The result set can then be fed into or accessed by the vulnerability scanning tool of your choice.Note: AWS Config advanced queries can also be used to query IPv6 addresses. You can use the “configuration.ipv6Addresses” AWS Config property to get IPv6 addresses. When querying IPv6 addresses, remove “configuration.association.publicIp > ‘0.0.0.0’” condition from the preceding sample queries. For more information on available AWS Config properties and data types, refer toGitHub.ConclusionIn this blog, we demonstrated how to extract public IP information from resources deployed in your account(s) using AWS Config and AWS Config advanced query. We discussed how you can support your vulnerability scanning process by identifying public IPs in your account(s) that can be fed into your scanning tool. This solution is serverless, automated, and scalable, which removes the undifferentiated heavy lifting required to manage your resources.Learn more about AWS Config best practices:AWS Config best practicesQuery your resource configuration state using the advanced query feature of AWS ConfigTAGS:Vulnerability AssessmentGurkamal Deep Singh RakhraGurkamal Rakhra is an Enterprise Solutions Architect at Amazon Web Services. He helps customers bring their ideas to life by providing architectural guidance and optimization. He has 6+ years of AWS experience with focus in compute, big data and analytics domains. Outside of work, he likes to learn about blockchain technology, travel, and read books.Gilles-Kuessan SatchiviGilles-Kuessan Satchivi is an AWS Enterprise Solutions Architect with a background in Networking, Infrastructure, Security, and IT Operations. He is passionate about helping customers build Well-Architected systems on AWS. Before joining AWS, he worked in e-commerce for 17 years. Outside of work, he likes to spend time with his family, and cheer on his children’s soccer team.
Systems vulnerability management is a key component of your enterprise security program. Its goal is to remediate OS, software, and applications vulnerabilities. Scanning tools can help identify and classify these vulnerabilities to keep the environment secure and compliant. Typically, vulnerability scanning tools operate from internal or external networks to discover and report vulnerabilities. For internal […]
Gurkamal Deep Singh Rakhra
Amazon EventBridge Amazon Simple Storage Service (S3) Architecture AWS Config AWS Lambda AWS Organizations