Scanning via SSM Integration

By using the AWS integration, you can select EC2 instances from the FutureVuls console and scan them on-demand. This simplifies the process, which would normally require you to connect to EC2 instances via SSH or other methods before scanning.

Supported Environments

Only servers registered in FutureVuls via "Vuls Scan" are supported. For supported OSes, please refer to "System Requirements".

SSM scanning is only possible with scanner version vuls v0.7.0 or later. If you are using an older version, please update the scanner. See "Update the Scanner".

SSM Integration Scan Setup

Please complete the "AWS Authentication Settings" beforehand.

Configuration for AWS EC2 Instances

This operation must be performed for each EC2 instance you want to integrate with SSM.

Create and Attach a Role

• Create an IAM role with the AmazonSSMManagedInstanceCore policy attached. (Reference)
• Attach the created IAM role to the target EC2 instances.

Configure and Register the SSM Agent

Install the SSM Agent according to your target AWS environment. (Reference)

Confirm SSM Registration

Confirm that the instances are registered in the AWS console under Systems Manager > Fleet Manager > Managed nodes.

Configuration for the AWS Account

This setup is required for the AWS account containing the EC2 instances you want to integrate with SSM.

Check if FutureVuls Integration is Complete

If SSM integration is already configured in other groups, the setup is straightforward.

• In the FutureVuls console, navigate to Group Settings > External Integration > AWS and click the "Configure" button for Scanning with SSM.

  

• Ignore the displayed command and click the "Next" button.

If Scanning with SSM shows "Configured", the setup is complete. If an error is displayed, follow the steps below.

Prepare the Environment to Create the SSM Document

To allow FutureVuls to scan EC2 instances via SSM, first prepare an environment to create an SSM Document.

• Install the AWS CLI in your preferred environment by following the "Help" guide.
• Ensure the createDocument and deleteDocument permissions are available in the environment.
  • Authenticate as a user who has permissions for these actions in the target AWS account. (Reference)
  • Alternatively, attach policies with these permissions to an EC2 instance within the target AWS account.

Create the SSM Document

• In the FutureVuls console, navigate to Group Settings > External Integration > AWS and click the "Configure" button for Scanning with SSM.

  

• Run the displayed command in the environment you prepared above.

  

• After execution, click the "Next" button. If Scanning with SSM shows "Configured", the setup is complete.

  

Automatic Integration with SSM

After completing the SSM integration setup, when the scanner runs on a target server, information about whether each server can integrate with SSM is imported into FutureVuls. The setup is complete when the SSM Integration column in the server list shows a ✓ as follows.

If you add new servers managed by SSM after configuring the AWS integration, they will be automatically integrated with FutureVuls during the next scan.

Running an SSM Scan

A button to run a scan via SSM will appear on the server details screen. You can scan the target server by clicking this button.

The execution history and status of SSM commands can be viewed in the AWS tab > SSM Command History.

Scan results can be found in the SSM Command History or Group Settings > Scan History.

If an SSM Scan Fails

If a message like the following is displayed in the SSM command history details, please follow the steps below to check the results.

• To check the result (success/failure) of the SSM command
  • Log in to the target AWS account and navigate to AWS Systems Manager > Run Command > Command history.
  • Search for the Command ID on the command history screen.
• To check detailed logs of the command execution
  • Please refer to the "Viewing SSM Agent logs" documentation.