Publish OpenSCAP scan metrics to CloudWatch and optionally send SNS notifications
Switch branches/tags
Nothing to show
Clone or download
Pull request Compare This branch is even with ICFI:master.
Fetching latest commit…
Cannot retrieve the latest commit at this time.
Type Name Latest commit message Commit time
Failed to load latest commit information.


This openscap-aws rpm is intended to be used on CentOS or Red Hat AWS instances and will configure them to self-scan each day, publish score metrics to CloudWatch and optionally report any failures to an SNS topic. As the scan score is a percentage of pass/fail findings and some tests may not be applicable to your environment the use of a tailoring file to specify which failures have been accepted by your organization makes this much more effective because then you can require that scans have a 100% score.

RPM Creation

The project contains a Makefile which uses a CentOS 7 docker container to create the rpm package

Create the RPM

make rpm

Clean up the artifacts

make clean


The rpm requires that the AWS CLI be installed but does not require that you do it using the official rpms. If you don't have a preference then ensuring you have the EPEL repo configured and installing using commands like the following is the easiest method to install.

yum -y install epel-release
yum -y install awscli openscap-aws


The generated rpm file installs the OpenSCAP content to /opt/openscap-aws along with a configuration file and a script to execute the scan. The example below is one option to schedule the scan runs at random times throughout your fleet of instances.

echo "$(shuf -i 0-59 -n 1) $(shuf -i 0-23 -n 1) * * * root /opt/openscap-aws/" > /etc/cron.d/openscap-aws


An example CloudFormation deployment template is provided as a quick demo and for ideas as to how you could integrate these concepts into your architecture.