{"action":"created","comment":{"url":"https://api.github.com/repos/guardian/security-hq/pulls/comments/189548443","pull_request_review_id":121746331,"id":189548443,"diff_hunk":"@@ -22,61 +35,14 @@ An application has been created, which will:\n       4. Start an Assessment run of one hour for each target\n   2. Schedule the lambda for 3am on Mondays and Thursdays.\n \n-### Repo\n-\n-See https://github.com/guardian/inspector-lambda\n-\n-### Artifact\n-\n-The artifact required by the lambda will be stored in a generic bucket owned by the `deployTools` account\n-for the purpose of distributing code used by multiple guardian accounts:\n-\n-```\n-s3://guardian-dist/guardian/PROD/inspectory-lambda.jar\n-```\n-\n-New versions of this application are published by pushing to that location.\n-\n-### Stack Set\n-\n-This lambda will be deployed into each account using a stackset.  The cloudformation is in the inspector-lambda repo \n-under /cloudformation\n-\n-## Output\n-\n-An AWS Inspector run will be started for every combination of app, stack and stage present in the account, \n-including 'not present', in the early hours of Mondays and Thursdays.\n-\n-The results can be inspected and mitigated by the teams responsible.\n-\n-## Implementation Details\n-\n-### Agent\n-\n-In order to track instance behaviour, an agent must be installed on the target instances.  \n-\n-In theory, Amigo could do this for you with the `aws-inspector` role.  However, it appears that\n-AWS Inspector's upgrade process does not cope with changing kernel versions (we have a support\n-request to examine and resolve this problem).  Therefore it is currently necessary to install \n-AWS Inspector as part of the cloud-init process by adding the following lines:\n-\n-```\n-/usr/bin/wget https://d1wk0tztpsntt1.cloudfront.net/linux/latest/install\n-/bin/bash install\n-```\n-\n-\n-Alternatively see [here](https://docs.aws.amazon.com/inspector/latest/userguide/inspector_installing-uninstalling-agents.html#install-linux).\n-\n ### Targeting\n \n-Instances are targeted based on tags.\n-\n-Currently, AWS have implemented a 'match any' strategy on tag filters, which is of course, insane. As a result, including\n-Stack=XXX, App=YYY, Stage==CODE will match all instances with Stage 'CODE' _even if they do not match the other tags_.\n+Instances are targeted based on their Stack, Stage and App tags. A scheduled assessment is created for every unique\n+combination of these tags.\n \n-As a result, the lambda will dynamically add another tag to each target instance with name `Inspection`, \n-and value 'AWSInspection-$stack-$app-$stage'. This is then used to target individual runs.\n+To work around limitations of AWS Inspector, the lambda dynamically adds a tag to each target instance with","path":"hq/markdown/aws-inspector.md","position":99,"original_position":99,"commit_id":"8fe1ae87377422f21c45af3a5f059a7b189f591c","original_commit_id":"8fe1ae87377422f21c45af3a5f059a7b189f591c","user":{"login":"aug24","id":5476326,"avatar_url":"https://avatars3.githubusercontent.com/u/5476326?v=4","gravatar_id":"","url":"https://api.github.com/users/aug24","html_url":"https://github.com/aug24","followers_url":"https://api.github.com/users/aug24/followers","following_url":"https://api.github.com/users/aug24/following{/other_user}","gists_url":"https://api.github.com/users/aug24/gists{/gist_id}","starred_url":"https://api.github.com/users/aug24/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/aug24/subscriptions","organizations_url":"https://api.github.com/users/aug24/orgs","repos_url":"https://api.github.com/users/aug24/repos","events_url":"https://api.github.com/users/aug24/events{/privacy}","received_events_url":"https://api.github.com/users/aug24/received_events","type":"User","site_admin":false},"body":"You didn't like my explanation of the need for us to add a tag?!","created_at":"2018-05-21T10:11:53Z","updated_at":"2018-05-21T10:15:42Z","html_url":"https://github.com/guardian/security-hq/pull/141#discussion_r189548443","pull_request_url":"https://api.github.com/repos/guardian/security-hq/pulls/141","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/guardian/security-hq/pulls/comments/189548443"},"html":{"href":"https://github.com/guardian/security-hq/pull/141#discussion_r189548443"},"pull_request":{"href":"https://api.github.com/repos/guardian/security-hq/pulls/141"}}},"pull_request":{"url":"https://api.github.com/repos/guardian/security-hq/pulls/141","id":189082118,"html_url":"https://github.com/guardian/security-hq/pull/141","diff_url":"https://github.com/guardian/security-hq/pull/141.diff","patch_url":"https://github.com/guardian/security-hq/pull/141.patch","issue_url":"https://api.github.com/repos/guardian/security-hq/issues/141","number":141,"state":"open","locked":false,"title":"Documentation update","user":{"login":"adamnfish","id":29761,"avatar_url":"https://avatars0.githubusercontent.com/u/29761?v=4","gravatar_id":"","url":"https://api.github.com/users/adamnfish","html_url":"https://github.com/adamnfish","followers_url":"https://api.github.com/users/adamnfish/followers","following_url":"https://api.github.com/users/adamnfish/following{/other_user}","gists_url":"https://api.github.com/users/adamnfish/gists{/gist_id}","starred_url":"https://api.github.com/users/adamnfish/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/adamnfish/subscriptions","organizations_url":"https://api.github.com/users/adamnfish/orgs","repos_url":"https://api.github.com/users/adamnfish/repos","events_url":"https://api.github.com/users/adamnfish/events{/privacy}","received_events_url":"https://api.github.com/users/adamnfish/received_events","type":"User","site_admin":false},"body":"## What does this change?\r\n\r\nMore focused documentation for our compliance tools.\r\n\r\nProvides a bespoke landing page for the documentation, removes now-redundant docs, and simplifies the individual documentation pages.\r\n\r\n<!-- Screenshots may be helpful to demonstrate -->\r\n\r\n## What is the value of this?\r\n\r\nThe audience for this documentation is busy teams that just need to adopt our tools. The existing documentation went into a lot of irrelevant technical detail and was quite out of date in some places.\r\n\r\nThis change focuses on what teams want from the documentation which has the following benefits:\r\n\r\n* the docs are more useful\r\n* these docs are simpler to maintain because they don't go into detail that will change\r\n\r\n<!-- Why are these changes being made? -->\r\n\r\nThis is being done to make my life easier - I'd like to be able to say to teams \"look at this page to see exactly what you need to do\".\r\n\r\nWe do lose a bit of technical detail from these changes, but in almost all cases that detail was duplicating more up-to-date information available on the README of the individual tools.\r\n\r\n## Will this require CloudFormation and/or updates to the AWS StackSet?\r\n\r\nNope.\r\n\r\n<!-- Have you committed your changes to the CloudFormation templates? -->\r\n\r\n<!-- Has the CloudFormation or StackSet update been completed? -->\r\n\r\n## Any additional notes?\r\n\r\nThis change introduces a new piece of configuration (the Snyk SSO URL). I have already updated the configuration file so this change is ready to go out.\r\n\r\n*Have CSS or JS changes been checked and fixed by Prettier?*\r\n\r\n`^- ` good question, I should check this before we merge it.\r\n\r\n<!-- Does this PR meet the contributing guidelines? https://git.io/vNUJt -->\r\n","created_at":"2018-05-18T16:56:41Z","updated_at":"2018-05-21T10:15:42Z","closed_at":null,"merged_at":null,"merge_commit_sha":"29e0e18acd835b3f9d5cfeebef66c6d9915cc43c","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/guardian/security-hq/pulls/141/commits","review_comments_url":"https://api.github.com/repos/guardian/security-hq/pulls/141/comments","review_comment_url":"https://api.github.com/repos/guardian/security-hq/pulls/comments{/number}","comments_url":"https://api.github.com/repos/guardian/security-hq/issues/141/comments","statuses_url":"https://api.github.com/repos/guardian/security-hq/statuses/8fe1ae87377422f21c45af3a5f059a7b189f591c","head":{"label":"guardian:documentation-index","ref":"documentation-index","sha":"8fe1ae87377422f21c45af3a5f059a7b189f591c","user":{"login":"guardian","id":164318,"avatar_url":"https://avatars0.githubusercontent.com/u/164318?v=4","gravatar_id":"","url":"https://api.github.com/users/guardian","html_url":"https://github.com/guardian","followers_url":"https://api.github.com/users/guardian/followers","following_url":"https://api.github.com/users/guardian/following{/other_user}","gists_url":"https://api.github.com/users/guardian/gists{/gist_id}","starred_url":"https://api.github.com/users/guardian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guardian/subscriptions","organizations_url":"https://api.github.com/users/guardian/orgs","repos_url":"https://api.github.com/users/guardian/repos","events_url":"https://api.github.com/users/guardian/events{/privacy}","received_events_url":"https://api.github.com/users/guardian/received_events","type":"Organization","site_admin":false},"repo":{"id":103662545,"name":"security-hq","full_name":"guardian/security-hq","owner":{"login":"guardian","id":164318,"avatar_url":"https://avatars0.githubusercontent.com/u/164318?v=4","gravatar_id":"","url":"https://api.github.com/users/guardian","html_url":"https://github.com/guardian","followers_url":"https://api.github.com/users/guardian/followers","following_url":"https://api.github.com/users/guardian/following{/other_user}","gists_url":"https://api.github.com/users/guardian/gists{/gist_id}","starred_url":"https://api.github.com/users/guardian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guardian/subscriptions","organizations_url":"https://api.github.com/users/guardian/orgs","repos_url":"https://api.github.com/users/guardian/repos","events_url":"https://api.github.com/users/guardian/events{/privacy}","received_events_url":"https://api.github.com/users/guardian/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/guardian/security-hq","description":"Centralised security information for AWS accounts","fork":false,"url":"https://api.github.com/repos/guardian/security-hq","forks_url":"https://api.github.com/repos/guardian/security-hq/forks","keys_url":"https://api.github.com/repos/guardian/security-hq/keys{/key_id}","collaborators_url":"https://api.github.com/repos/guardian/security-hq/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/guardian/security-hq/teams","hooks_url":"https://api.github.com/repos/guardian/security-hq/hooks","issue_events_url":"https://api.github.com/repos/guardian/security-hq/issues/events{/number}","events_url":"https://api.github.com/repos/guardian/security-hq/events","assignees_url":"https://api.github.com/repos/guardian/security-hq/assignees{/user}","branches_url":"https://api.github.com/repos/guardian/security-hq/branches{/branch}","tags_url":"https://api.github.com/repos/guardian/security-hq/tags","blobs_url":"https://api.github.com/repos/guardian/security-hq/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/guardian/security-hq/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/guardian/security-hq/git/refs{/sha}","trees_url":"https://api.github.com/repos/guardian/security-hq/git/trees{/sha}","statuses_url":"https://api.github.com/repos/guardian/security-hq/statuses/{sha}","languages_url":"https://api.github.com/repos/guardian/security-hq/languages","stargazers_url":"https://api.github.com/repos/guardian/security-hq/stargazers","contributors_url":"https://api.github.com/repos/guardian/security-hq/contributors","subscribers_url":"https://api.github.com/repos/guardian/security-hq/subscribers","subscription_url":"https://api.github.com/repos/guardian/security-hq/subscription","commits_url":"https://api.github.com/repos/guardian/security-hq/commits{/sha}","git_commits_url":"https://api.github.com/repos/guardian/security-hq/git/commits{/sha}","comments_url":"https://api.github.com/repos/guardian/security-hq/comments{/number}","issue_comment_url":"https://api.github.com/repos/guardian/security-hq/issues/comments{/number}","contents_url":"https://api.github.com/repos/guardian/security-hq/contents/{+path}","compare_url":"https://api.github.com/repos/guardian/security-hq/compare/{base}...{head}","merges_url":"https://api.github.com/repos/guardian/security-hq/merges","archive_url":"https://api.github.com/repos/guardian/security-hq/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/guardian/security-hq/downloads","issues_url":"https://api.github.com/repos/guardian/security-hq/issues{/number}","pulls_url":"https://api.github.com/repos/guardian/security-hq/pulls{/number}","milestones_url":"https://api.github.com/repos/guardian/security-hq/milestones{/number}","notifications_url":"https://api.github.com/repos/guardian/security-hq/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/guardian/security-hq/labels{/name}","releases_url":"https://api.github.com/repos/guardian/security-hq/releases{/id}","deployments_url":"https://api.github.com/repos/guardian/security-hq/deployments","created_at":"2017-09-15T13:50:57Z","updated_at":"2018-05-21T10:00:41Z","pushed_at":"2018-05-21T10:00:42Z","git_url":"git://github.com/guardian/security-hq.git","ssh_url":"git@github.com:guardian/security-hq.git","clone_url":"https://github.com/guardian/security-hq.git","svn_url":"https://github.com/guardian/security-hq","homepage":"https://security-hq.gutools.co.uk/","size":3107,"stargazers_count":4,"watchers_count":4,"language":"Scala","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":2,"mirror_url":null,"archived":false,"open_issues_count":3,"license":null,"forks":2,"open_issues":3,"watchers":4,"default_branch":"master"}},"base":{"label":"guardian:master","ref":"master","sha":"c4f957023c846e32139b494ee6b5580e817192a5","user":{"login":"guardian","id":164318,"avatar_url":"https://avatars0.githubusercontent.com/u/164318?v=4","gravatar_id":"","url":"https://api.github.com/users/guardian","html_url":"https://github.com/guardian","followers_url":"https://api.github.com/users/guardian/followers","following_url":"https://api.github.com/users/guardian/following{/other_user}","gists_url":"https://api.github.com/users/guardian/gists{/gist_id}","starred_url":"https://api.github.com/users/guardian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guardian/subscriptions","organizations_url":"https://api.github.com/users/guardian/orgs","repos_url":"https://api.github.com/users/guardian/repos","events_url":"https://api.github.com/users/guardian/events{/privacy}","received_events_url":"https://api.github.com/users/guardian/received_events","type":"Organization","site_admin":false},"repo":{"id":103662545,"name":"security-hq","full_name":"guardian/security-hq","owner":{"login":"guardian","id":164318,"avatar_url":"https://avatars0.githubusercontent.com/u/164318?v=4","gravatar_id":"","url":"https://api.github.com/users/guardian","html_url":"https://github.com/guardian","followers_url":"https://api.github.com/users/guardian/followers","following_url":"https://api.github.com/users/guardian/following{/other_user}","gists_url":"https://api.github.com/users/guardian/gists{/gist_id}","starred_url":"https://api.github.com/users/guardian/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/guardian/subscriptions","organizations_url":"https://api.github.com/users/guardian/orgs","repos_url":"https://api.github.com/users/guardian/repos","events_url":"https://api.github.com/users/guardian/events{/privacy}","received_events_url":"https://api.github.com/users/guardian/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/guardian/security-hq","description":"Centralised security information for AWS accounts","fork":false,"url":"https://api.github.com/repos/guardian/security-hq","forks_url":"https://api.github.com/repos/guardian/security-hq/forks","keys_url":"https://api.github.com/repos/guardian/security-hq/keys{/key_id}","collaborators_url":"https://api.github.com/repos/guardian/security-hq/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/guardian/security-hq/teams","hooks_url":"https://api.github.com/repos/guardian/security-hq/hooks","issue_events_url":"https://api.github.com/repos/guardian/security-hq/issues/events{/number}","events_url":"https://api.github.com/repos/guardian/security-hq/events","assignees_url":"https://api.github.com/repos/guardian/security-hq/assignees{/user}","branches_url":"https://api.github.com/repos/guardian/security-hq/branches{/branch}","tags_url":"https://api.github.com/repos/guardian/security-hq/tags","blobs_url":"https://api.github.com/repos/guardian/security-hq/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/guardian/security-hq/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/guardian/security-hq/git/refs{/sha}","trees_url":"https://api.github.com/repos/guardian/security-hq/git/trees{/sha}","statuses_url":"https://api.github.com/repos/guardian/security-hq/statuses/{sha}","languages_url":"https://api.github.com/repos/guardian/security-hq/languages","stargazers_url":"https://api.github.com/repos/guardian/security-hq/stargazers","contributors_url":"https://api.github.com/repos/guardian/security-hq/contributors","subscribers_url":"https://api.github.com/repos/guardian/security-hq/subscribers","subscription_url":"https://api.github.com/repos/guardian/security-hq/subscription","commits_url":"https://api.github.com/repos/guardian/security-hq/commits{/sha}","git_commits_url":"https://api.github.com/repos/guardian/security-hq/git/commits{/sha}","comments_url":"https://api.github.com/repos/guardian/security-hq/comments{/number}","issue_comment_url":"https://api.github.com/repos/guardian/security-hq/issues/comments{/number}","contents_url":"https://api.github.com/repos/guardian/security-hq/contents/{+path}","compare_url":"https://api.github.com/repos/guardian/security-hq/compare/{base}...{head}","merges_url":"https://api.github.com/repos/guardian/security-hq/merges","archive_url":"https://api.github.com/repos/guardian/security-hq/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/guardian/security-hq/downloads","issues_url":"https://api.github.com/repos/guardian/security-hq/issues{/number}","pulls_url":"https://api.github.com/repos/guardian/security-hq/pulls{/number}","milestones_url":"https://api.github.com/repos/guardian/security-hq/milestones{/number}","notifications_url":"https://api.github.com/repos/guardian/security-hq/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/guardian/security-hq/labels{/name}","releases_url":"https://api.github.com/repos/guardian/security-hq/releases{/id}","deployments_url":"https://api.github.com/repos/guardian/security-hq/deployments","created_at":"2017-09-15T13:50:57Z","updated_at":"2018-05-21T10:00:41Z","pushed_at":"2018-05-21T10:00:42Z","git_url":"git://github.com/guardian/security-hq.git","ssh_url":"git@github.com:guardian/security-hq.git","clone_url":"https://github.com/guardian/security-hq.git","svn_url":"https://github.com/guardian/security-hq","homepage":"https://security-hq.gutools.co.uk/","size":3107,"stargazers_count":4,"watchers_count":4,"language":"Scala","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":2,"mirror_url":null,"archived":false,"open_issues_count":3,"license":null,"forks":2,"open_issues":3,"watchers":4,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/guardian/security-hq/pulls/141"},"html":{"href":"https://github.com/guardian/security-hq/pull/141"},"issue":{"href":"https://api.github.com/repos/guardian/security-hq/issues/141"},"comments":{"href":"https://api.github.com/repos/guardian/security-hq/issues/141/comments"},"review_comments":{"href":"https://api.github.com/repos/guardian/security-hq/pulls/141/comments"},"review_comment":{"href":"https://api.github.com/repos/guardian/security-hq/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/guardian/security-hq/pulls/141/commits"},"statuses":{"href":"https://api.github.com/repos/guardian/security-hq/statuses/8fe1ae87377422f21c45af3a5f059a7b189f591c"}},"author_association":"MEMBER"}}
{"actor":{"display_login":"aug24"}}