1

I have two separate AWS accounts and I would like to a Vuln scanner/IDS on one to scan another.

One environment is a regular AWS account and the other is in AWS Gov Cloud. Due to limitations within Gov Cloud I was only able to install my IDS on the regular AWS account. I would like to scan my machines within the Gov Cloud from the regular account.

What's the best way to do this?

I was thinking about attaching public IP addresses to my Gov Cloud instances and creating a SG to only allow my IDS access. What is the best practice here? Is this an acceptable solution?

Note: I realize installing the IDS within Gov Cloud is ideal but the IDS license is already purchased and the AMI can only be shared with a regular account.

Rodia
  • 105
  • 4
에이바
  • 58
  • 6
  • 2
    you might want to look into the AWS docs about setting up such a thing. I think you have to tell them your running stuff like this on the servers. – OliverBS Oct 31 '14 at 15:37

2 Answers2

2

I would first try to contact the vendor and explain to them what occurred so that they would re-do your license to allow you to move your scanner to where it should be. Most, if not all would do this.

Secondly, I don’t want to misinterpret things here, but when you state “due to limitations on Gov cloud” I am interpreting this to mean you do not have appropriate permissions. I am going to err on the side of caution with this statement: Make sure you have full authority, rights, and permissions to install something on this instance otherwise you are likely breaking laws. I can see no reason for you not to have permissions if it is part of your role.

Now on to the IDS question/portion. Most IDS portions rely on logging information (event logs, syslogs, etc) to generate “events.” These events are thereby acted on (an alert is sent, alarms triggered, etc). Your goal seems to be to get this data from point A to point B. The optimal of doing this would be to create some form of encrypted communication session to transport data to and from each machine. To do this, I would use a VPN session/tunnel as opposed to putting a public address on a machine that likely shouldn’t have a public address.

The downsides of putting on a public address is that you make your machine a target. In doing so (configuring a public address) you would then need to create two firewall rules on each location to minimize connectivity from unauthorized locations. This creates more work, more configuring, more room for error.

If you CANNOT get the vendor to address changing the vulnscanner/IDS licensing, I would do the following:

IDS SYSTEM —> VPN TUNNEL —> GOV MACHINE

This encrypts data to and from, and depending on how you configure your connection (site to site, roaming) will allow you to avoid creating firewall rules on both ends. Determine what it is the IDS is looking for (syslog, event logs, etc) and configure the client to send those to the IDS server in a secure fashion (via VPN). It is not that complicated.

munkeyoto
  • 8,682
  • 16
  • 31
0

It looks more like a question you should be doing to AWS support staff, since any possible solution will be more limited by your plan's contract restrictions than by technical constraints.

DarkLighting
  • 1,523
  • 11
  • 16