CisScanConfiguration

Source: src/AWS/Inspector2/CisScanConfiguration.ts

An Amazon Inspector CIS scan configuration — schedules CIS Benchmark scans of SSM-managed EC2 instances selected by resource tags. Name, level, schedule, and targets are all updatable in place; identity is the configuration’s ARN.

Scheduling CIS Scans

Daily Level 1 scan of production instances

const scan = yield* AWS.Inspector2.CisScanConfiguration("NightlyCis", {
  securityLevel: "LEVEL_1",
  schedule: {
    daily: { startTime: { timeOfDay: "02:00", timezone: "UTC" } },
  },
  targets: {
    accountIds: ["SELF"],
    targetResourceTags: { Environment: ["production"] },
  },
});

One-time Level 2 audit

const audit = yield* AWS.Inspector2.CisScanConfiguration("Level2Audit", {
  scanName: "level2-audit",
  securityLevel: "LEVEL_2",
  schedule: { oneTime: {} },
  targets: {
    accountIds: ["SELF"],
    targetResourceTags: { Audit: ["true"] },
  },
});