steampipe plugin install aws

Table: aws_ec2_ssl_policy - Query AWS EC2 SSL Policies using SQL

The AWS EC2 SSL Policies are predefined security policies that determine the SSL/TLS protocol that an AWS EC2 instance uses when it's communicating with clients. These policies help to establish the ciphers and protocols that services like Elastic Load Balancing use when negotiating SSL/TLS connections. They can be customized to meet specific security requirements, ensuring secure and reliable client-to-server communications.

Table Usage Guide

The aws_ec2_ssl_policy table in Steampipe provides you with information about SSL policies used in AWS Elastic Compute Cloud (EC2) Load Balancers. This table allows you as a developer or cloud architect to query SSL policy-specific details, including the policy name, the SSL protocols, and the cipher suite configurations. You can utilize this table to gather insights on the SSL policies, such as enabled SSL protocols, preferred cipher suites, and more. The schema outlines the various attributes of the SSL policy for you, including the policy name, the SSL protocols, the SSL ciphers, and the server order preference.

Examples

Basic info

Determine the areas in which your AWS EC2 instances are using certain SSL protocols. This can be beneficial for identifying potential security risks and ensuring that your instances are configured to use the most secure protocols.

select
name,
ssl_protocols
from
aws_ec2_ssl_policy;
select
name,
ssl_protocols
from
aws_ec2_ssl_policy;

List load balancer listeners that use an SSL policy with weak ciphers

Identify the load balancer listeners that are using an SSL policy with weak ciphers. This is beneficial for enhancing the security of your applications by pinpointing potential vulnerabilities.

select
arn,
ssl_policy
from
aws_ec2_load_balancer_listener listener
join aws_ec2_ssl_policy ssl_policy on listener.ssl_policy = ssl_policy.Name
where
ssl_policy.ciphers @> '[{"Name":"DES-CBC3-SHA"}]';
select
arn,
ssl_policy
from
aws_ec2_load_balancer_listener listener
join aws_ec2_ssl_policy ssl_policy on listener.ssl_policy = ssl_policy.Name
where
json_extract(ssl_policy.ciphers, '$[*].Name') LIKE '%DES-CBC3-SHA%';

Schema for aws_ec2_ssl_policy

NameTypeOperatorsDescription
_ctxjsonbSteampipe context in JSON form.
account_idtext=, !=, ~~, ~~*, !~~, !~~*The AWS Account ID in which the resource is located.
akasjsonbArray of globally unique identifier strings (also known as) for the resource.
ciphersjsonbA list of ciphers.
nametext=The name of the policy.
partitiontextThe AWS partition in which the resource is located (aws, aws-cn, or aws-us-gov).
regiontext=The AWS Region in which the resource is located.
sp_connection_nametext=, !=, ~~, ~~*, !~~, !~~*Steampipe connection name.
sp_ctxjsonbSteampipe context in JSON form.
ssl_protocolsjsonbA list of protocols.
supported_load_balancer_typesjsonbThe supported load balancers.
titletextTitle of the resource.

Export

This table is available as a standalone Exporter CLI. Steampipe exporters are stand-alone binaries that allow you to extract data using Steampipe plugins without a database.

You can download the tarball for your platform from the Releases page, but it is simplest to install them with the steampipe_export_installer.sh script:

/bin/sh -c "$(curl -fsSL https://steampipe.io/install/export.sh)" -- aws

You can pass the configuration to the command with the --config argument:

steampipe_export_aws --config '<your_config>' aws_ec2_ssl_policy