Amazon Inspector
User Guide (Version Latest)

The AWS Documentation website is getting a new look!
Try it now and let us know what you think. Switch to the new look >>

You can return to the original look by selecting English in the language selector above.

Installing Amazon Inspector Agents

You can install the Amazon Inspector agent using the Systems Manager Run Command on multiple instances (including both Linux-based and Windows-based instances). Alternatively, you can install the agent individually by signing in to each EC2 instance. The procedures in this chapter provide instructions for both methods.

As another option, you can quickly install the agent on all Amazon EC2 instances included in an assessment target by selecting the Install Agents check box on the Define an Assessment target page on the console.

Note

The procedures in this chapter apply to all AWS Regions that are supported by Amazon Inspector.

Amazon Linux AMI with the Amazon Inspector Agent

To skip the manual Amazon Inspector agent installation on the Amazon Linux EC2 instances that you want to include in your assessment targets, you can use the Amazon Linux AMI with Amazon Inspector Agent. This AMI has the agent preinstalled and requires no additional steps to install or set up the agent. To start using Amazon Inspector with these EC2 instances, tag them to match the assessment target that you want. The configuration of Amazon Linux AMI with Amazon Inspector Agent enhances security by focusing on two main security goals: limiting access and reducing software vulnerabilities.

This is the only currently available EC2 instance AMI with the preinstalled Amazon Inspector agent. For the EC2 instances that run Ubuntu Server or Windows Server, you must complete the manual agent installation steps.

The Amazon Linux AMI with Amazon Inspector Agent is available on the EC2 console and also at the AWS Marketplace.

Installing the Agent on Multiple EC2 Instances Using the Systems Manager Run Command

You can install the Amazon Inspector agent on your EC2 instances using the Systems Manager Run Command. This enables you to install the agent remotely and on multiple instances (both Linux-based and Windows-based instances with the same command) at once.

Important

Agent installation using the Systems Manager Run Command is not currently supported for the Debian operating system.

Important

To use this option, make sure that your EC2 instance has the SSM Agent installed and has an IAM role that allows Run Command. The SSM Agent is installed, by default, on Amazon EC2 Windows instances and Amazon Linux instances. Amazon EC2 Systems Manager requires an IAM role for EC2 instances that processes commands and a separate role for users executing commands. For more information, see Installing and Configuring SSM Agent and Configuring Security Roles for System Manager.

To install the agent on multiple EC2 instances using the Systems Manager Run Command

  1. Open the Amazon EC2 console at https://console.aws.amazon.com/ec2/.

  2. In the navigation pane under Systems Manager Services, choose Run Command.

  3. Choose Run a command.

  4. For Command document, choose the document named AmazonInspector-ManageAWSAgent that is owned by Amazon. This document contains the script for installing the Amazon Inspector agent on EC2 instances.

  5. For Select targets by, specify your EC2 instances either by choosing the Specifying a Tag option or by choosing Manually Selecting Instances. Then choose Select instances. To install the agent on all the instances in the assessment target, you can specify the same tags that are used for creating the assessment target.

  6. Provide your choices for the rest of the available options using the instructions in Executing Commands from the EC2 Console, and then choose Run.

Note

You can also install the agent on multiple EC2 instances (both Linux-based and Windows-based) when you create an assessment target, or you can use the Install Agents with Run Command button for an existing target. For more information, see Creating an Assessment Target.

Installing the Agent on a Linux-based EC2 Instance

Perform the following procedure to install the Amazon Inspector agent on a Linux-based EC2 instance.

To install the agent on a Linux-based EC2 instance

  1. Sign in to your EC2 instance running a Linux-based operating system where you want to install the Amazon Inspector agent.

    Note

    For information about the operating systems that Amazon Inspector supports, see Amazon Inspector Supported Operating Systems and Regions.

  2. Download the agent installation script by running one of the following commands:

    • wget https://inspector-agent.amazonaws.com/linux/latest/install

    • curl -O https://inspector-agent.amazonaws.com/linux/latest/install

  3. (Optional) Verify that the agent installation script is not altered or corrupted. For more information, see (Optional) Verify the Signature of the Amazon Inspector Agent Installation Script on Linux-based Operating Systems.

  4. To install the agent, run sudo bash install.

    Note

    As updates for the agent become available, they are automatically downloaded from Amazon S3 and applied. For more information, see Amazon Inspector Agent Updates.

    If you want to skip this auto-update process, run the following command when you install the agent:

    sudo bash install -u false

    Note

    (Optional) To remove the agent installation script, run rm install.

  5. Verify that the following files required for the agent to be successfully installed and functioning properly are installed:

    • libcurl4 (required to install the agent on Ubuntu 18.04)

    • libcurl3

    • libgcc1

    • libc6

    • libstdc++6

    • libssl1.0.1

    • libssl1.0.2 (required to install the agent on Debian 9)

    • libpcap0.8

Installing the Agent on a Windows-based EC2 Instance

Perform the following procedure to install the Amazon Inspector agent on a Windows-based EC2 instance.

To install the agent on a Windows-based EC2 instance

  1. Sign in to your EC2 instance running a Windows-based operating system where you want to install the agent.

    Note

    For more information about the operating systems that Amazon Inspector supports, see Amazon Inspector Supported Operating Systems and Regions.

  2. Download the following .exe file:

    https://inspector-agent.amazonaws.com/windows/installer/latest/AWSAgentInstall.exe

  3. Open a command prompt window (with administrative permissions), navigate to the location where you saved the downloaded AWSAgentInstall.exe, and run the .exe file to install the agent.

    Note

    As updates for the agent become available, they are automatically downloaded from Amazon S3 and applied. For more information, see Amazon Inspector Agent Updates.

    If you want to skip this auto-update process, run the following command when you install the agent:

    AWSAgentInstall.exe AUTOUPDATE=No