# Secure Deployment Guide - Container Image Scanner

## Overview

This guide provides step-by-step instructions for securely deploying the Container Image Scanner in enterprise AWS environments following security best practices.

## Pre-Deployment Security Checklist

### ✅ Environment Preparation
- [ ] VPC with private subnets configured
- [ ] NAT Gateway or VPC endpoints for AWS API access
- [ ] Security groups with minimal required access
- [ ] CloudTrail enabled for audit logging
- [ ] AWS Config enabled for compliance monitoring

### ✅ IAM Configuration
- [ ] Dedicated IAM roles created with minimal permissions
- [ ] Cross-account roles configured for multi-account scanning
- [ ] External ID configured for cross-account access
- [ ] Permission boundaries applied where required

### ✅ Network Security
- [ ] Private subnets for scanner deployment
- [ ] Security groups allowing only required traffic
- [ ] NACLs configured for additional network protection
- [ ] VPC Flow Logs enabled

## Deployment Options

### Option 1: EC2 Instance Deployment (Recommended)

#### 1. Create IAM Role
```bash
# Create the IAM role
aws iam create-role \
  --role-name ContainerImageScannerRole \
  --assume-role-policy-document file://security/ec2-trust-policy.json

# Attach the minimal policy
aws iam attach-role-policy \
  --role-name ContainerImageScannerRole \
  --policy-arn arn:aws:iam::ACCOUNT:policy/ContainerImageScannerPolicy

# Create instance profile
aws iam create-instance-profile \
  --instance-profile-name ContainerImageScannerProfile

# Add role to instance profile
aws iam add-role-to-instance-profile \
  --instance-profile-name ContainerImageScannerProfile \
  --role-name ContainerImageScannerRole
```

#### 2. Launch Secure EC2 Instance
```bash
# Launch instance in private subnet
aws ec2 run-instances \
  --image-id ami-0abcdef1234567890 \
  --instance-type t3.medium \
  --key-name your-key-pair \
  --security-group-ids sg-12345678 \
  --subnet-id subnet-12345678 \
  --iam-instance-profile Name=ContainerImageScannerProfile \
  --user-data file://security/user-data.sh \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=ContainerImageScanner},{Key=Environment,Value=Production}]'
```

#### 3. User Data Script (user-data.sh)
```bash
#!/bin/bash
yum update -y
yum install -y nodejs npm docker

# Install scanner
npm install -g container-image-scanner@2.4.1

# Create non-root user
useradd -m scanner
usermod -aG docker scanner

# Create systemd service
cat > /etc/systemd/system/container-scanner.service << EOF
[Unit]
Description=Container Image Scanner
After=network.target

[Service]
Type=simple
User=scanner
WorkingDirectory=/home/scanner
ExecStart=/usr/bin/cis ui --host 0.0.0.0 --port 3000
Restart=always
RestartSec=10

[Install]
WantedBy=multi-user.target
EOF

systemctl enable container-scanner
systemctl start container-scanner
```

### Option 2: Lambda Deployment

#### 1. Create Lambda Function
```bash
# Package the application
npm run build
zip -r scanner-lambda.zip dist/ node_modules/

# Create Lambda function
aws lambda create-function \
  --function-name container-image-scanner \
  --runtime nodejs18.x \
  --role arn:aws:iam::ACCOUNT:role/ContainerImageScannerLambdaRole \
  --handler dist/lambda-handler.handler \
  --zip-file fileb://scanner-lambda.zip \
  --timeout 900 \
  --memory-size 512
```

### Option 3: ECS Fargate Deployment

#### 1. Create Task Definition
```json
{
  "family": "container-image-scanner",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "512",
  "memory": "1024",
  "executionRoleArn": "arn:aws:iam::ACCOUNT:role/ecsTaskExecutionRole",
  "taskRoleArn": "arn:aws:iam::ACCOUNT:role/ContainerImageScannerRole",
  "containerDefinitions": [
    {
      "name": "scanner",
      "image": "your-account.dkr.ecr.region.amazonaws.com/container-image-scanner:latest",
      "portMappings": [
        {
          "containerPort": 3000,
          "protocol": "tcp"
        }
      ],
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/container-image-scanner",
          "awslogs-region": "us-east-1",
          "awslogs-stream-prefix": "ecs"
        }
      },
      "environment": [
        {
          "name": "NODE_ENV",
          "value": "production"
        }
      ]
    }
  ]
}
```

## Security Configuration

### 1. Network Security Groups

#### Scanner Security Group
```bash
# Create security group
aws ec2 create-security-group \
  --group-name container-scanner-sg \
  --description "Security group for Container Image Scanner"

# Allow HTTPS outbound for AWS APIs
aws ec2 authorize-security-group-egress \
  --group-id sg-12345678 \
  --protocol tcp \
  --port 443 \
  --cidr 0.0.0.0/0

# Allow HTTP inbound from ALB only
aws ec2 authorize-security-group-ingress \
  --group-id sg-12345678 \
  --protocol tcp \
  --port 3000 \
  --source-group sg-alb-12345678
```

### 2. Application Load Balancer (Optional)

#### ALB Configuration
```bash
# Create ALB
aws elbv2 create-load-balancer \
  --name container-scanner-alb \
  --subnets subnet-12345678 subnet-87654321 \
  --security-groups sg-alb-12345678 \
  --scheme internal

# Create target group
aws elbv2 create-target-group \
  --name container-scanner-tg \
  --protocol HTTP \
  --port 3000 \
  --vpc-id vpc-12345678 \
  --health-check-path /api/health
```

### 3. SSL/TLS Configuration

#### Certificate Manager
```bash
# Request certificate
aws acm request-certificate \
  --domain-name scanner.internal.company.com \
  --validation-method DNS \
  --subject-alternative-names "*.scanner.internal.company.com"
```

## Monitoring and Logging

### 1. CloudWatch Configuration

#### Log Groups
```bash
# Create log group
aws logs create-log-group \
  --log-group-name /aws/container-image-scanner/application

# Set retention policy
aws logs put-retention-policy \
  --log-group-name /aws/container-image-scanner/application \
  --retention-in-days 30
```

#### CloudWatch Alarms
```bash
# Create alarm for high error rate
aws cloudwatch put-metric-alarm \
  --alarm-name "ContainerScanner-HighErrorRate" \
  --alarm-description "High error rate in container scanner" \
  --metric-name ErrorRate \
  --namespace AWS/ApplicationELB \
  --statistic Average \
  --period 300 \
  --threshold 5.0 \
  --comparison-operator GreaterThanThreshold \
  --evaluation-periods 2
```

### 2. AWS Config Rules

#### Compliance Monitoring
```bash
# Deploy Config rule for security group compliance
aws configservice put-config-rule \
  --config-rule '{
    "ConfigRuleName": "scanner-security-group-compliance",
    "Source": {
      "Owner": "AWS",
      "SourceIdentifier": "INCOMING_SSH_DISABLED"
    }
  }'
```

## Security Hardening

### 1. Operating System Hardening

#### CIS Benchmarks
```bash
# Install and run CIS benchmark scanner
wget https://downloads.cisecurity.org/tools/cis-cat-lite.zip
unzip cis-cat-lite.zip
./cis-cat-lite/cis-cat-lite.sh -b benchmarks/CIS_Amazon_Linux_2_Benchmark_v1.0.0-xccdf.xml
```

### 2. Container Security (if using containers)

#### Dockerfile Security
```dockerfile
# Use minimal base image
FROM node:18-alpine

# Create non-root user
RUN addgroup -g 1001 -S scanner && \
    adduser -S scanner -u 1001

# Set working directory
WORKDIR /app

# Copy package files
COPY package*.json ./

# Install dependencies
RUN npm ci --only=production && npm cache clean --force

# Copy application code
COPY dist/ ./dist/

# Change ownership
RUN chown -R scanner:scanner /app

# Switch to non-root user
USER scanner

# Expose port
EXPOSE 3000

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=5s --retries=3 \
  CMD curl -f http://localhost:3000/api/health || exit 1

# Start application
CMD ["node", "dist/cli.js", "ui"]
```

### 3. Runtime Security

#### Security Scanning
```bash
# Scan for vulnerabilities
npm audit --audit-level moderate

# Container image scanning (if using containers)
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
  aquasec/trivy image your-scanner-image:latest
```

## Backup and Recovery

### 1. Configuration Backup
```bash
# Backup IAM policies
aws iam get-role-policy \
  --role-name ContainerImageScannerRole \
  --policy-name ScannerPolicy > scanner-policy-backup.json

# Backup security group rules
aws ec2 describe-security-groups \
  --group-ids sg-12345678 > security-group-backup.json
```

### 2. Disaster Recovery
- Document all configuration steps
- Maintain Infrastructure as Code (CloudFormation/Terraform)
- Regular testing of deployment procedures
- Automated backup of configurations

## Compliance and Auditing

### 1. Audit Logging
- All AWS API calls logged via CloudTrail
- Application logs sent to CloudWatch
- Access logs from load balancer
- VPC Flow Logs for network traffic

### 2. Compliance Reports
```bash
# Generate compliance report
aws configservice get-compliance-details-by-config-rule \
  --config-rule-name scanner-security-group-compliance \
  --output table
```

## Incident Response

### 1. Security Incident Procedures
1. Isolate affected systems
2. Preserve evidence (logs, configurations)
3. Assess impact and scope
4. Implement containment measures
5. Eradicate threats
6. Recover systems
7. Document lessons learned

### 2. Emergency Contacts
- Security Team: security@company.com
- AWS Support: Enterprise Support Case
- On-call Engineer: +1-xxx-xxx-xxxx

## Maintenance and Updates

### 1. Regular Security Tasks
- [ ] Weekly vulnerability scans
- [ ] Monthly security patches
- [ ] Quarterly security reviews
- [ ] Annual penetration testing

### 2. Update Procedures
```bash
# Update scanner application
npm update -g container-image-scanner

# Update system packages
yum update -y

# Restart services
systemctl restart container-scanner
```

---

**Security Contact**: security@container-scanner.com  
**Last Updated**: August 22, 2025  
**Next Review**: November 22, 2025