nuclei-templates/cloud/aws/inspector2/inspector2-disabled.yaml

id: inspector2-disabled

info:
  name: Amazon Inspector 2 - Disabled
  author: DhiyaneshDK
  severity: info
  description: |
    Ensure that the new version of Amazon Inspector is enabled in order to help you improve the security and compliance of your AWS cloud environment.
  impact: |
    Amazon Inspector 2 disabled increases the risk of unaddressed vulnerabilities in your EC2 instances, Lambda functions, and container images, leaving your environment exposed to potential security threats.
  remediation: |
    Enable Amazon Inspector 2 to automatically scan for vulnerabilities in EC2 instances, Lambda functions, and container images by using the AWS Management Console or using the AWS CLI.
  reference:
    - https://www.trendmicro.com/cloudoneconformity-staging/knowledge-base/aws/Inspector2/enable-amazon-inspector2.html
    - https://aws.amazon.com/about-aws/whats-new/2021/11/amazon-inspector-continual-vulnerability-management/
  tags: cloud,devops,aws,amazon,inspector2,aws-cloud-config

variables:
  region: "us-west-2"

self-contained: true

code:
  - engine:
      - sh
      - bash

    source: |
      aws inspector2 batch-get-account-status --region $region --query 'accounts[*].[accountId,state.status]' --output json

    matchers:
      - type: word
        words:
          - '"DISABLED"'

    extractors:
      - type: dsl
        dsl:
          - '"Amazon Inspector 2 " + region + " is Disabled"'
# digest: 4a0a0047304502204c395c8b6be9e20ec59536a0e23e6563659d5b7bd5e33d711610bff4c9f04d67022100ba18cd98feeefa78561f5b09c4771df6f68c6f4f03784dc57d8b2073a61129d2:922c64590222798bb761d5b6d8e72950