aws security hub integration

[javixeneize]

Hi

Is there any native integration between starboard and aws security hub? I have seen plugins both for kube-bench and trivy to

https://aquasecurity.github.io/trivy/v0.18.3/integrations/aws-security-hub/
https://aws.amazon.com/about-aws/whats-new/2020/12/aws-security-hub-adds-open-source-tool-integration-with-kube-bench-and-cloud-custodian/

Is there any out of the box integration in starboard to feed those reports directly to aws? It would be great to have this as an option in the helm chart :)

Thanks

[akerge]

I don't think there is at the moment. I have a similar need – to be able to automatically scan deployed container images after n time or continuously and send the report to AWS Security Hub.

It looks like there are steps taken to move in the general direction but no roadmap yet.

There are couple of options:

• write an operator yourself (container with trivy and awscli with appropriate role to push the report to AWS Sec Hub)
• wait and see

Would be great to hear input from Aqua Security. @danielpacak, you've been most helfpul, care to chime in? :)

[danielpacak]

That's an interesting idea and I do confirm that it's currently not supported.

Like @akerge said it also depends what would be the future of Starboard Operator and its integration with kube-bench.

More fundamental decision is whether we keep Starboard (or Trivy-Operator) cloud provider agnostic or not. IMHO we should focus on generating security reports with most accurate data in the most efficient way in vanilla (upstream) clusters. And then have another operator (or a bunch of controllers) that can get security reports (i.e. VulnerabilityReport, ConfigAuditReport, ClusterConfigAuditReport, and CISKubeBenchReport instances) and push them forward to Security Hub or other places. This concept would be similar to (generic) kube-controller-manager and (cloud-provider-specific) Cloud Controller Manager. At lest logically splitting such use cases can be helpful in structuring and maintaining all the integrations.

[javixeneize]

I agree, it might not be a native part of starboard out of the box, it can be an external operator but with integration in starboard via helm chart for example, something that you can configure there

I will try to build something with kopf to see if it would be easy to implement this

[akerge]

@danielpacak I agree, that keeping Starboard/Trivy* keeping cloud agnostic is best for all.

Maybe I'm stuck on the notion that by adding an output format template option (like in trivy docs), it would solve some problems. I am most probably mistaken :)

@javixeneize, please do keep us updated if you find a way to share the results :)

[javixeneize]

I have done some good progress, i can send data to security hub now for the initial scan, when the CRD is created, but i would need a bit more of info on how starboard/kube-bench works when there are config changes.

I can take an action when the CRD changes, but, i dont know how it will change.

For example:

          test_number: 5.7.3
        - remediation: >
            Ensure that namespaces are created to allow for appropriate
            segregation of Kubernetes

            resources and that all new resources are created in a specific
            namespace.
          scored: false
          status: WARN

If this issue is solved, will it change to PASS? Will it be a totally new scan?

Also, how should this be updated in security hub? Will it change the status of the finding in security hub or this is not expected to be changed by kube-bench?

Thanks