Skip to content

Latest commit

 

History

History
47 lines (27 loc) · 1.43 KB

README.md

File metadata and controls

47 lines (27 loc) · 1.43 KB
Raw

ct-patching-scanning

Cornell University Cloud Team Patching and Scanning Automation

Scripts and templates relevant to patching and scanning EC2 instances

See https://confluence.cornell.edu/display/CLOUD/Beta+AWS+Inspector+and+Patching

Table of Contents

  • cloudformation contains CloudFormation templates for deploying this functionality.

  • lambda-unused contains a lambda function developed to catch Inspector notifications and send Inspector reports

  • scripts contains reporting scripts used by Jenkins jobs

Patch Baseline Testing

The patch baselines in cloudformation/15-patch-baselines.yaml are based on the AWS default patch baselines, but slightly modified to patch additional packages that Inspector would otherwise trigger on.

Docker

This repo comes with Dockerfile and docker-compose.yml files that can help provide an execution environment for running the scripts in scripts/.

Prerequisites

docker and docker-compose must be installed and configured. See https://docs.docker.com/install/.

Recommended Usage (docker-compose)

Bring container up (it will build if there isn't one locally already):

docker-compose up --detach

Attach to bash shell in container to run scripts:

docker-compose exec awspython bash

Stop Docker container and clean up after docker-compose:

docker-compose down