Agentless Workload Scanning for AWS - Single Account Integration (CloudFormation)
Overview
This article describes how to integrate your AWS single account with Lacework's Agentless Workload Scanning. The high-level steps are summarized below:
- Configure your integration in the Lacework Console.
- Choose and execute your CloudFormation integration method.
- Delete the default inbound rule for the default security group.
- Verify your Agentless Workload Scanning integration.
Configure the Integration in Lacework Console
- Log in to the Lacework Console.
- Select Settings > Integrations > Cloud accounts.
- Click Add New.
- Click Amazon Web Services and select CloudFormation.
- Click Next.
- Click the Choose integration type dropdown and select Agentless Workload Scanning (Single account).
- Fill in the settings as described in Configuration Settings.
- Click Save.
- Once the integration is created, the Status displays as Pending.
Choose a CloudFormation integration method to continue the integration.
Configuration Settings
Setting | Description | Example |
---|---|---|
Name | The name for the integration (as it will be displayed in the Lacework Console). | myAgentlessIntegration |
Scanning AWS Account ID | The AWS Account ID where the scanning resources will be created. | 123456789012 |
Limit Scanned Workloads | Use an LQL key and value to constrain the Agentless Workload Scanning to specific resources. If left blank, Lacework will scan all resources available to the account or organization. See Limit Scanned Workloads for further guidance. | |
Scan Frequency (hours) | How often your images, containers, and hosts are scanned for vulnerabilities (in hours). This option can be changed at any time. The scan frequency can be 6, 12, or 24 hours. | 24 |
Scan containers | Clear the checkbox if you don't want to scan containers for vulnerabilities. This option can be changed at any time. | |
Scan host vulnerabilities | Clear the checkbox if you don't want to scan hosts for vulnerabilities. This option can be changed at any time. | |
Scan secondary volumes | Select the checkbox if you want to scan additional volumes on hosts (other than the root or primary volume). This option can be changed at any time. | |
Scan stopped instances | Clear the checkbox if you don't want to scan stopped instances in your environment. This option can be changed at any time. |
Once created, you can view all the Agentless Workload Scanning integration details in the Lacework Console.
Choose a CloudFormation Integration Method
Choose one of the following options to integrate with an AWS account using CloudFormation:
- Option 1: Run CloudFormation script
- For the initial setup, Lacework recommends this method as it requires fewer steps and less user interaction.
- Option 2: Download CloudFormation script
- This method requires more user interaction, but may be useful if you have multiple accounts with distributed ownership.
Option 1: Run CloudFormation Script
For this option, disable your browser pop-up blocker, otherwise you may not be redirected to the AWS user portal during the initial steps.
In the Lacework Console, go to Settings > Integrations > Cloud accounts, and select the integration that you created using the Configure the Integration in Lacework Console procedure. This displays the details of the integration.
Under Install using CloudFormation, click Run CloudFormation Template.
This redirects you to the AWS Create stack > Specify Template page in a new tab. The Lacework script populates the Amazon S3 URL in Specify template for you.
Review the page and click Next.
On the Specify stack details page, enter a Stack name (for example: Lacework-AWS-Agentless-Config).
Check that the Regions list contains the appropriate regions for your account.
- A VPC and Internet Gateway will be created in each region, please verify resource quotas have not been reached using the Service Quotas tool.
- Regional STS must be enabled in each region selected.
infoLacework checks your account and populates the Regions list automatically. If the check fails, all regions will be listed by default.
For Quota Check: Can a new VPC and VPC Internet Gateway be created in each selected Region?
- See Access and Resource Requirements for guidance on how to check if the required VPC resources can be created.
- Select Yes once you have completed the quotas check.
Review the page and click Next.
On Configure stack options, review the page and click Next (no changes are required).
- If you would like to add custom Tags, use the option here. These tags will be propagated to all resources created by the agentless scanner.
On the Review page, check the acknowledgements in the Capabilities section:
- I acknowledge that AWS CloudFormation might create IAM resources with custom names.
- I acknowledge that AWS CloudFormation might require the following capability:
CAPABILITY_AUTO_EXPAND
Click Create stack.
You are then redirected to the CloudFormation > Stacks page. Select your stack to see the event log as it is being created. If you do not see your new stack in the table, refresh the page.
When the Status of the stack reaches CREATE_COMPLETE, the Agentless Workload Scanning integration for this AWS account is complete.
Option 2: Download CloudFormation Script
You can use the AWS Console or the AWS CLI to run the CloudFormation script to integrate with an AWS account. For more information, see the following sections:
Use AWS Console to Run CloudFormation Script
In the Lacework Console, go to Settings > Integrations > Cloud accounts, and select the integration that you created using the Configure the Integration in Lacework Console procedure. This displays the details of the integration.
Under Install using CloudFormation, click Download CloudFormation Template.
When prompted, choose a suitable location to save the JSON file on your local machine.
Log in to your AWS account.
Select the CloudFormation service and click Create stack > With new resources (standard).
Under Specify template, select Upload a template file. Click Choose file and upload the CloudFormation script that was downloaded earlier.
Click Next.
On the Specify stack details page, enter a Stack name (for example: Lacework-AWS-Agentless-Config).
Check that the Regions list contains the appropriate regions for your account.
- A VPC and Internet Gateway will be created in each region, please verify resource quotas have not been reached using the Service Quotas tool.
- Regional STS must be enabled in each region selected.
infoLacework checks your account and populates the Regions list automatically. If the check fails, all regions will be listed by default.
For Quota Check: Can a new VPC and VPC Internet Gateway be created in each selected Region?
- See Access and Resource Requirements for guidance on how to check if the required VPC resources can be created.
- Select Yes once you have completed the quotas check.
Review the page and click Next.
On Configure stack options, review the page and click Next (no changes are required).
- If you would like to add custom Tags, use the option here. These tags will be propagated to all resources created by the agentless scanner.
- On the Review page, check the acknowledgements in the Capabilities section:
- I acknowledge that AWS CloudFormation might create IAM resources with custom names.
- I acknowledge that AWS CloudFormation might require the following capability:
CAPABILITY_AUTO_EXPAND
- Click Create stack.
- You are then redirected to the CloudFormation > Stacks page. Select your stack to see the event log as it is being created. If you do not see your new stack in the table, refresh the page.
Use AWS CLI to Run CloudFormation Script
In the Lacework Console, go to Settings > Integrations > Cloud accounts, and select the integration that you created using the Configure the Integration in Lacework Console procedure. This displays the details of the integration.
Under Install using CloudFormation, click Download CloudFormation Template.
When prompted, choose a suitable location to save the JSON file on your local machine.
Run the downloaded CloudFormation template JSON file using the following AWS CLI command.
aws cloudformation create-stack --profile YOUR_AWS_PROFILE_NAME --region REGION_FOR_STACK \
--stack-name lacework-agentless-scanning \
--capabilities CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND \
--template-body file://path/to/lacework-agentless-step1.json \
--parameters \
ParameterKey=VPCQuotaCheck,ParameterValue=Yes \
ParameterKey=Regions,ParameterValue=\"us-east-1,us-west-1\"Where:
--profile
specifies the profile you want to use from your AWS credential file.--region
specifies the region in which you want to create the CloudFormation stack.--stack-name
specifies the name of the CloudFormation stack you want to create.--template-body
specifies the path to the CloudFormation template JSON file you downloaded from the Lacework Console.Regions
parameter specifies the comma-separated list of regions in which you want to enable agentless scanning.
Delete the Default Inbound Rule for the Default Security Group
As part of the Agentless deployment in CloudFormation, a VPC and security group are created. Due to AWS limitations with CloudFormation, the VPCs created for each region during Agentless deployment are assigned default security groups with a default inbound rule that only allows traffic within the subnet. While no external traffic is allowed through this rule, it is still unnecessary and can be removed.
If you have the CIS AWS 1.4.0 benchmark and/or Lacework AWS Security Addendum 1.0 enabled in your environment, lacework-global-87 may trigger alerts for the security group that Agentless uses. To resolve the alert, delete the default inbound rule in the security group using the instructions in Alerts Triggering for lacework-global-87 after Deployment.
Verify your Agentless Workload Scanning Integration
Verify CloudFormation StackSet Instances Completed
These steps will verify that CloudFormation installed a StackSet for each Region selected in the Stack Regions. Note that it is possible that the CloudFormation Stack completed successfully but one or more regional StackSet Instances failed.
- In the AWS Console open the CloudFormation page. Make sure you have selected the AWS region where the Agentless Scanning template was installed.
- On the left-hand side menu click StackSets.
- Click on the link for the StackSet matching the name of the CloudFormation Stack created above.
- Click on the Stack Instances tab.
- Review each Instance and check that the Detailed Status is "Success", if there is an error then the Status Reason will provided a detailed error message.
Verify Lacework Integration Completed
In the Lacework console, the status of the integration at Settings > Integrations > Cloud accounts will update from Pending to Success if all resources are installed correctly.
You may need to refresh the page when returning from the AWS Console after completing the integration steps.
If the periodic scanning encounters an error, the status will display the error details.
Remove an Agentless Workload Scanning Integration
Follow these steps if you want to remove your single account integration.
Start in the Lacework console.
- In Settings > Integrations > Cloud accounts, find the integration that you would like to remove.
- Note the name of the integration, this will be used to locate the CloudFormation Stack later.
- Toggle the integration State to disabled, or Delete the integration using the actions menu on the right.
Once complete, remove the integration within AWS using the AWS Console.
- Log in to your AWS account.
- Select the CloudFormation service and find the Stack with the associated name from the integration.
- Click the Delete button then Delete stack to confirm deleting.
Next Steps
- View scanning results in the Lacework Console.
- Read FAQs on Agentless Workload Scanning.