Does cnspec have the ability to scan multiple AWS accounts?

[chris-rock]

Question from John Anderson in Slack:

We are evaluating this as alternative to what we do with cloud custodian. Custodian has a tool c7n-org that allows us to run the policies against multiple AWS accounts. But I don't see a way to say "Run this against all of these accounts", I only see a way to run it against one.

[chris-rock]

We have different ways to scan multiple AWS accounts:

1. cnspec scan aws which uses your default AWS configuration to connect to the AWS account
2. We support inventories to scan multiple AWS accounts
3. Mondoo SaaS Platform ships with a full AWS Org and Account Integration

If you want to configure an inventory that scans multiple AWS accounts, use the following setup with an aws-inventory.yml:

apiVersion: v1
kind: Inventory
metadata:
  name: mondoo-inventory
  labels:
    environment: production
spec:
  assets:
    - id: account-1
      connections:
        - backend: aws
          options:
            profile: example-dev
          discover:
            targets:
              - "accounts"
      annotations:
        owner: [email protected]
    - id: account-2
      connections:
        - backend: aws
          options:
            profile: example-demo
          discover:
            targets:
              - "accounts"
      annotations:
        owner: [email protected]

Then you scan the system via:

# run aws inventory
cnquery scan --inventory-file aws-inventory.yml

# run aws security scan
cnspec scan --inventory-file aws-inventory.yml 

[chris-rock]

I updated the example above. It includes references to the aws config of the profiles to use its credentials. The example uses the accounts discovery target which focuses purely on the AWS account. You can extend the list with the following entries:

apiVersion: v1
kind: Inventory
metadata:
  name: mondoo-inventory
  labels:
    environment: production
spec:
  assets:
    - id: account-1
      connections:
        - backend: aws
          options:
            profile: example-dev
          discover:
            targets:
              - "accounts" # aws account
              - "instances" # ec2 instances
              - "ssm-instances" # ec2 instances with ssm
              - "ecr" # elastic container registry
              - "ecs" # elastic container services