Ansible-Lockdown でEC2インスタンスをCISベンチマークに準拠させ、Amazon Inspector v2 で評価してみる

$ sudo yum install -y ansible

$ git clone https://github.com/ansible-lockdown/AMAZON2023-CIS.git
$ cd AMAZON2023-CIS

vi inventory.yml
---                   
all:                   
  hosts:                 
    target-amzn2023:     
      ansible_host: <target-amzn2023 のプライベートIPV4アドレス>
      ansible_user: ec2-user
      ansible_ssh_private_key_file: ~/.ssh/ansible.key
      ansible_port: 22

ansible-playbook -vv -i inventory.yml site.yml

TASK [/home/ec2-user/ansible/AMAZON2023-CIS : Ensure root password is set] ****************************************************************************************
task path: /home/ec2-user/ansible/AMAZON2023-CIS/tasks/main.yml:26
fatal: [target-amzn2023]: FAILED! => {"changed": false, "cmd": "passwd -S root | grep \"Password set, SHA512 crypt\"", "delta": "0:00:00.009311", "end": "2025-06-01 01:23:45.796025", "msg": "non-zero return code", "rc": 1, "start": "2025-06-01 01:23:45.796025", "stderr": "", "stderr_lines": [], "stdout": "", "stdout_lines": []}

PLAY RECAP ***********************************************************************************************************************************************
target-amzn2023            : ok=3    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0

task path: /home/ec2-user/ansible/AMAZON2023-CIS/tasks/main.yml:26

- name: Ensure root password is set
  when:
      - amzn2023cis_rule_4_6_6
  block:
      - name: Ensure root password is set
        ansible.builtin.shell: passwd -S root | grep "Password set, SHA512 crypt"
        changed_when: false
        register: root_passwd_set

      - name: Ensure root password is set
        ansible.builtin.assert:
            that: root_passwd_set.rc == 0
            fail_msg: "You have rule 4.6.6 enabled this requires that you have a root password set"
            success_msg: "You have a root password set"
  tags:
      - level1-server
      - patch
      - accounts
      - root
      - rule_4.6.6

ansible-playbook -vv -i inventory.yml -e '{ "amzn2023cis_rule_4_6_6":false }' site.yml

TASK [/home/ec2-user/ansible/AMAZON2023-CIS : 1.3.1 | PATCH | Ensure AIDE is installed | Install AIDE] ************************************************************
task path: /home/ec2-user/ansible/AMAZON2023-CIS/tasks/section_1/cis_1.3.x.yml:5
fatal: [target-amzn2023]: FAILED! => {"changed": false, "failures": ["No package aide available."], "msg": "Failed to install some of the specified packages", "rc": 1, "results": []}

PLAY RECAP ***********************************************************************************************************************************************
target-amzn2023            : ok=84   changed=22   unreachable=0    failed=1    skipped=36   rescued=0    ignored=0

ansible-playbook -vv -i inventory.yml -e '{ "amzn2023cis_rule_4_6_6":false, "amzn2023cis_config_aide": false, "amzn2023cis_rule_3_4_1_2": false, "amzn2023cis_rule_3_4_2_1": false, "amzn2023cis_rule_3_4_2_4": false, "amzn2023cis_rule_5_1_1_1": false, "amzn2023cis_rule_5_1_1_2": false,"amzn2023cis_rule_5_1_1_4": false, "amzn2023cis_rule_5_1_1_5": false, "amzn2023cis_rule_5_1_1_7": false, "amzn2023cis_rule_5_3": false }' site.yml

TASK [/home/ec2-user/ansible/AMAZON2023-CIS : If Warnings found Output count and control IDs affected] ************************************************************
task path: /home/ec2-user/ansible/AMAZON2023-CIS/tasks/main.yml:207
ok: [target-amzn2023] => {
    "msg": "You have 12 Warning(s) that require investigating that are related to the following benchmark ID(s)  [1.1.2.1] [1.1.3.1] [1.1.4.1] [1.1.5.1] [1.1.6.1] [1.1.7.1] [1.1.8.1] [1.2.3] [1.6.1.6] [2.4] [6.1.9] [6.1.12]"
}

PLAY RECAP ***********************************************************************************************************************************************
target-amzn2023            : ok=326  changed=2    unreachable=0    failed=0    skipped=211  rescued=0    ignored=0