AWS Inspector匯出問題發現報告

AWS Inspector exports problem discovery report

首先附上官方教學

從 Amazon Inspector 匯出發現報告

步驟1：

打開S3服務，並建立儲存桶

選中儲存桶，點擊「許可」分頁

在「儲存體策略」貼上官方教學的內容

{
 "Version": "2012-10-17",
 "Statement": [
  {
   "Sid": "allow-inspector",
   "Effect": "Allow",
   "Principal": {
    "Service": "inspector2.amazonaws.com"
   },
   "Action": [
    "s3:PutObject",
    "s3:PutObjectAcl",
    "s3:AbortMultipartUpload"
   ],
   "Resource": "arn:aws:s3:::DOC-EXAMPLE-BUCKET/*",
   "Condition": {
    "StringEquals": {
     "aws:SourceAccount": "111122223333"
    },
    "ArnLike": {
     "aws:SourceArn": "arn:aws:inspector2:Region:111122223333:report/*"
    }
   }
  }
 ]
}

步驟2：

打開KMS服務，新增金鑰

在「金鑰政策」貼上官方教學的內容

{
    "Sid": "Allow Amazon Inspector to use the key",
    "Effect": "Allow",
    "Principal": {
        "Service": "inspector2.amazonaws.com"
    },
    "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey*"
    ],
    "Resource": "*",
    "Condition": {
        "StringEquals": {
            "aws:SourceAccount": "111122223333"
        },
        "ArnLike": {
            "aws:SourceArn": "arn:aws:inspector2:Region:111122223333:report/*"
        }
    }
}        

回到Inspector > 問題清單 > 匯出問題清單

選中剛才建立的S3儲存桶，以及KMS金鑰

即可匯出報告

注意點：

1. Region：改為地區，例如us-east-1
2. 111122223333：改為右上角的AWS帳戶編號，非個人用戶名稱
3. report/*：問題清單報告的預設路徑，“不需更改”
4. DOC-EXAMPLE-BUCKET：改為剛才建立的S3儲存桶名稱