1 Answer
- Newest
- Most votes
- Most comments
0
Hello.
To cost-effective solution within your budget, you can combine AWS native tools and open-source tools that provide wide coverage without requiring complex setup or management.
AWS Inspector EC2, Lambda, Containers
- What it does Automatically scans EC2 instances, Lambda functions, and containers (ECS) for vulnerabilities and misconfigurations.
Setup
- Go to AWS Inspector in the AWS Management Console.
- Enable the service for your environment (EC2, Lambda, ECS).
- Set up periodic scans for your instances.
- Cost: Pay-as-you-go, likely under $5,000 per year depending on usage.
Prowler Free Open-Source Tool for Broader Coverage
- What it does Scans for AWS security best practices and compliance across services like IAM, S3, RDS, CloudTrail, etc.
Setup
- Install Prowler on your local machine or an EC2 instance.
- Run the following command to scan your AWS environment.
- Review the findings and address critical vulnerabilities.
- Cost Free.
prowler -M csv -p <AWS Profile>
AWS Security Hub Central Dashboard for Findings
- What it does Aggregates security findings from AWS Inspector, Prowler, GuardDuty, and other security services into one dashboard for easier management.
Setup
- Enable AWS Security Hub from the AWS Console.
- Integrate it with AWS Inspector and Prowler for centralized reporting.
- Cost Pay based on the number of findings; likely under $2,000 annually.
Relevant content
- asked 3 years ago
- asked 3 years ago
- asked a year ago
AWS OFFICIALUpdated 3 years ago- AWS OFFICIALUpdated 5 months ago
A word of warning about Security Hub: it does most of its posture assessments with AWS Config rules. They can get excessively expensive, particularly in the continuous recording mode that is normally recommended, when a large number of changes happens in the environment. For example, ECS and EKS environments often create and destroy tasks/pods at a high frequency, causing a cascading effect on the CIs in Config and excessive costs. For example, an ENI is connected to a security group and subnet and VPC, so creation and removal causes changes to be recorded to all the linked resources.