{"id":24511160,"url":"https://github.com/iknowjavascript/terraform-aws-vulne-soldier","last_synced_at":"2025-05-12T22:15:47.932Z","repository":{"id":272376142,"uuid":"916388257","full_name":"iKnowJavaScript/terraform-aws-vulne-soldier","owner":"iKnowJavaScript","description":"This Terraform module consists of the configuration for automating the remediation of AWS EC2 vulnerabilities using AWS Inspector findings. It provisions essential resources such as an SSM document, Lambda function, and CloudWatch event rules for automated vulnerability management.","archived":false,"fork":false,"pushed_at":"2025-01-25T23:44:32.000Z","size":675,"stargazers_count":46,"open_issues_count":0,"forks_count":4,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-05-12T22:15:37.385Z","etag":null,"topics":["aws","ec2-remediation","infrastructure-as-code","remediation","vulnerability"],"latest_commit_sha":null,"homepage":"https://registry.terraform.io/modules/iKnowJavaScript/vulne-soldier/aws/latest","language":"HCL","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/iKnowJavaScript.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2025-01-14T01:56:46.000Z","updated_at":"2025-03-31T10:01:24.000Z","dependencies_parsed_at":"2025-01-14T03:19:05.560Z","dependency_job_id":"3a645c25-ee4a-465f-92bc-6ca4199a6335","html_url":"https://github.com/iKnowJavaScript/terraform-aws-vulne-soldier","commit_stats":null,"previous_names":["iknowjavascript/vulne-soldier-compliance-remediate"],"tags_count":3,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iKnowJavaScript%2Fterraform-aws-vulne-soldier","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iKnowJavaScript%2Fterraform-aws-vulne-soldier/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iKnowJavaScript%2Fterraform-aws-vulne-soldier/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/iKnowJavaScript%2Fterraform-aws-vulne-soldier/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/iKnowJavaScript","download_url":"https://codeload.github.com/iKnowJavaScript/terraform-aws-vulne-soldier/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":253831009,"owners_count":21971008,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["aws","ec2-remediation","infrastructure-as-code","remediation","vulnerability"],"created_at":"2025-01-22T00:36:31.154Z","updated_at":"2025-05-12T22:15:47.908Z","avatar_url":"https://github.com/iKnowJavaScript.png","language":"HCL","funding_links":[],"categories":[],"sub_categories":[],"readme":"# vulne-soldier: A Modern Day AWS EC2 Vulnerability Remediation Tool\n\n[![Terraform registry](https://img.shields.io/badge/Terraform_Registry-0.0.2-blue)](https://registry.terraform.io/modules/iKnowJavaScript/vulne-soldier/aws/latest)\n[![Terraform](https://img.shields.io/badge/Terraform-0.0.2-623CE4)](https://www.terraform.io)\n[![License](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)\n\nThis Terraform module consists of the configuration for automating the remediation of AWS EC2 vulnerabilities using AWS Inspector findings. It provisions essential resources such as an SSM document, Lambda function, and CloudWatch event rules for automated vulnerability management.\n\n## Description\n\nThis Terraform module sets up an automated vulnerability remediation environment optimized for production use. By creating an SSM document to define the remediation steps, setting up a Lambda function to execute the remediation, and establishing CloudWatch event rules to trigger the process based on AWS Inspector findings, the module offers a straightforward approach to managing EC2 vulnerabilities on AWS.\n\nThis module provisions:\n\n- AWS SSM documents\n- AWS Lambda functions\n- AWS CloudWatch event rules\n- IAM roles and policies\n\n\n![Architecture](assets/component-overview.png)\n\n## Usage\n\n### Setup terraform module\n\n#### Download lambda\n\nTo apply the terraform module, the compiled lambdas (.zip files) need to be available locally. They can either be downloaded from the GitHub release page or built locally.\n\n\u003e **Info**\n\n\u003e The lambdas can be downloaded from the [release page](https://github.com/iKnowJavaScript/terraform-aws-vulne-soldier/releases) or by building the Lambda folder using Node.\n\nFor local development you can build the lambdas at once using `/lambda` or individually using `npm zip`.\n\n### Example Configuration\n\nTo deploy the `vulne-soldier` module, you can use the following configuration in your Terraform setup:\n\n```hcl\nmodule \"remediation\" {\n  source = \"../../\"\n\n  name             = \"vulne-soldier-compliance-remediate\"\n  environment      = \"dev\"\n  aws_region       = \"us-east-1\"\n  account_id       = \"2123232323\"\n  lambda_log_group = \"/aws/lambda/vulne-soldier-compliance-remediate\"\n  lambda_zip       = \"./lambda.zip\"\n  remediation_options = {\n    region                                     = \"us-east-1\"\n    reboot_option                              = \"NoReboot\"\n    # You need to specify the tag name and value of the EC2 instances you want to remediate\n    target_ec2_tag_name                        = \"AmazonECSManaged\"\n    target_ec2_tag_value                       = \"true\"\n    # You can specify the vulnerability severities to filter findings: default is CRITICAL and HIGH vulnerabilities\n    vulnerability_severities                   = [\"CRITICAL, HIGH\"]\n    override_findings_for_target_instances_ids = []\n  }\n}\n\nprovider \"aws\" {\n  region = \"us-east-1\"\n}\n```\n\n### Triggers Remediation Process\n![Vulnerability Remediation Trigger](assets/document-screenshot.png)\nOn successful deployment, navigate to the AWS Systems Manager console and search for the SSM document created by the module (vulne-soldier-compliance-remediate-inspector-findings) or similar. You can trigger the remediation process by running the document on the affected EC2 instances. You can also create an AWS CloudWatch event rule to automate the process based on AWS Inspector findings.\n\n\n## Inputs\n\n| Name                                     | Description                                                                 | Type          | Default                                    | Required |\n|------------------------------------------|-----------------------------------------------------------------------------|---------------|--------------------------------------------|:--------:|\n| `name`                                   | Name of the application                                                     | `string`      | n/a                                        | yes      |\n| `environment`                            | Name of the environment                                                     | `string`      | n/a                                        | yes      |\n| `aws_region`                             | AWS region where the resources will be created                              | `string`      | n/a                                        | yes      |\n| `account_id`                             | AWS account ID                                                              | `string`      | n/a                                        | yes      |\n| `lambda_log_group`                       | Name of the CloudWatch Log Group for the Lambda function                    | `string`      | n/a                                        | yes      |\n| `lambda_zip`                             | File location of the lambda zip file for remediation                                                              | `string`      | `lambda.zip`                                        | yes      |\n| `remediation_options`                    | Options for the remediation document                                        | `object`      | n/a                                        | yes      |\n| `remediation_options.region`             | The region to use                                                           | `string`      | `us-east-1`                                | no       |\n| `remediation_options.reboot_option`      | Reboot option for patching                                                  | `string`      | `NoReboot`                                 | no       |\n| `remediation_options.target_ec2_tag_name`| The tag name to filter EC2 instances                                        | `string`      | `AmazonECSManaged`                         | no       |\n| `remediation_options.target_ec2_tag_value`| The tag value to filter EC2 instances                                       | `string`      | `true`                                     | no       |\n| `remediation_options.vulnerability_severities`| Comma separated list of vulnerability severities to filter findings                        | `string`| `\"CRITICAL, HIGH\"`                       | no       |\n| `remediation_options.override_findings_for_target_instances_ids`| Comma separated list of instance IDs to override findings for target instances              | `string`| `\"\"`                                       | no       |\n\n## Outputs\n\n| Name                  | Description                  | Sensitive |\n|-----------------------|------------------------------|:---------:|\n| `lambda_function_arn` | Lambda function ARN          | No        |\n| `lambda_function_name`| Lambda function name         | No        |\n| `ssm_document_name`   | SSM document name            | No        |\n\nTo retrieve outputs, use the `terraform output` command, for example: `terraform output lambda_function_arn`.\n\n## License\n\nThis project is licensed under the MIT License - see the LICENSE.md file for details.","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fiknowjavascript%2Fterraform-aws-vulne-soldier","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fiknowjavascript%2Fterraform-aws-vulne-soldier","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fiknowjavascript%2Fterraform-aws-vulne-soldier/lists"}