Compliance Report too big to be compatible with AWS SSM #121
Comments
|
The problem is that the
|
nickumia-reisys
changed the title
|
Upon testing from using a smaller repo, the error still persisted. So we have determined that there is a control that is getting tested or a set of controls that is getting grouped that generates a Compliance Report that is too big to be exported by AWS SSM (for the same service quota limit). Thanks to @mogul for helping to clarify the issue! With the new results, it seems like it is also an issue that is irrespective of the operating environment. Does anyone know which report may be greater than |
|
Hi @nickumia-reisys, I think I know what the problem is, but I literally haven't touched a keyboard in the last couple months so my memory could be off:
It's not the size of the Ruby Script to format InSpec output and post to SSM: # trimmed for brevity
...
execution_id = pwd.parent.basename.to_s;
ssm = Aws::SSM::Client.new(region: region);
results = JSON.parse(STDIN.read);
# initialize compliance object
comp = {
resource_id: instance_id,
resource_type: 'ManagedInstance',
compliance_type: 'Custom:InSpec',
execution_summary: {
execution_time: Time.now,
execution_id: execution_id,
execution_type: 'Command'
},
items: Array.new()
};
...
results['profiles'].each do |profile|
profile['controls'].each do |control|
if(control.has_key?('results'))
control['results'].each do |result|
severity = impact_to_severity(control['impact']);
item = {
id: "#{control['id']}-#{comp[:items].length}",
severity: severity,
title: "#{control['title']} : #{result['code_desc']}"
};
status = result['status'];
if(status == 'passed')
item[:status] = 'COMPLIANT';
compliant += 1;
compliant_by_sev[severity] += 1;
elsif(status == "failed")
item[:status] = 'NON_COMPLIANT';
non_compliant += 1;
non_compliant_by_sev[severity] += 1;
else
next;
end
comp[:items].push(item);
end
end
end
end
resp = ssm.put_compliance_items(comp); ### <- CULPRIT
...
The reason the There's definitely more than a few warts when using the The quickest/dirtiest thing would prob be to make a clone of the All that said, I don't see an easy/simple fix that wouldn't break workflows for existing consumers of the profile. I think the only option in the near term is to open an AWS support ticket requesting better support for InSpec configuration/options. @schurzi @micheelengronne thoughts? cc: @amlodzianowsk |
|
I agree with everything you said @deric4 😄 Sorry for not updating this ticket earlier, but we actually did end up submitting an AWS Support Ticket to try and increase the Quota Limit,
We were able to manually run the baseline by I suppose at the minimal, may I ask that this just be documented for other people who try to run the baseline and hit this issue? |
|
Hmm.. so it took some time; however, AWS emailed us back saying that they were able to increase our quota to 1200KB. Upon trying to run it again, it seems AWS SSM gave this error.. any insights? @deric4 I'm still able to run it manually by ssh'ing. This only happens when SSM tries to RunCommand. |
Describe the bug
Hi!
We configured a workload on AWS EC2s and configured AWS SSM to run a baseline check of the EC2 AMIs using this repo. SSM failed to run the command due to its inability to download the baseline.
Expected behavior
Successful run of baseline which returns results.
Actual behavior
Example code
Follow the example provided by AWS. It was a manual setup, so no code to paste 😞
OS / Environment
Not relevant for this issue (see below).
Inspec Version
Not sure how to get this, but not relevant for this issue (see below).
Baseline Version
Additional context
AWS throws a
Compliance item can have up to 800 KB in total.error which is outlined in their documentation as a service quota.Per AWS Service Quota documentation, adjustments can be made. However, this particular item is not yet available in their automated service quota requests (through console) nor in the aws request-service-quota-increase (through the cli) and there is no guarantee that there is software in place to handle a request if one is made to customer service.
This issue was not hit by the linux-baseline because the total repo size is less than the
800KBrequirement.There is an option to set a path in the configuration of the AWS RunCommand,
However, it seems like there are a few directories and files that are relevant. Can consolidating the code into a single directory and then specifying that work for AWS SSM?
The text was updated successfully, but these errors were encountered: