Skip to main content

Create AWS SSM Service Account for Scanning Linux Endpoints

  • Updated

To scan AWS EC2(Linux) instances leveraging AWS SSM, you require AWS IAM user credentials(Access key ID, Secret access key) having the following AWS permissions:

  • ssm:SendCommand
  • ssm:ListCommandInvocations
  • ssm:DescribeInstanceInformation

You can refer to this article to create an AWS user account with the required permissions for SSM based scans:

Create SSM AWS Policy for CAM Scanning:

1.png

Sample: Minimum privileges & all resources2.png

Sample Policy JSON:

{

   "Version": "2012-10-17",

   "Statement": [

       {

           "Sid": "CAMSSMPrivileges",

           "Effect": "Allow",

           "Action": [

               "ssm:SendCommand",

               "ssm:ListCommandInvocations",

                "ssm:DescribeInstanceInformation"

            ],

            "Resource": "*"

        }

    ]

}

3.png

 

Create SSM AWS User for CAM scanning

4.png

Sample User with only ‘programmatic access’.5.png

 

Attach the policy to the SSM User directly or via a group:

6.png

 

Create the access key & download the .csv file: 

NOTE: These credentials(Access Key ID & Access key ID) are to be used while creating ‘AWS SSM keychain’.7.png