<p>You could do a vulnerability scan with AWS Inspector and look for CVE vulnerabilities. Inspector has a CloudWatch metric to cause an action when there are findings. Would be tricky to determine WHICH packages need to be updated, but you could just update everything.  You don’t have to use Inspector, any vulnerability scanning tool you can hook into would work. Vulnerability scanning is a best practice in general. </p>

<p>Another idea would be to setup a cron job that does apt-get update &amp;&amp; apt-get upgrade —dry-run > stuff-that-should-be-updated.txt and parse the text file for a list of packages to be updated and feed that back into your build process. </p>

CC BY-SA 3.0
2018-01-10T22:40:14.647Z
2018-01-12T20:29:39.300Z
2018-01-12T20:29:39.300Z
myron-semack
<p>This approach looks to solve your purpose using Chef audit but it has got it's own problems.
<a href="https://joshuakugler.com/using-chef-zero-audit-mode-and-packer.html" rel="nofollow noreferrer">https://joshuakugler.com/using-chef-zero-audit-mode-and-packer.html</a></p>

<p>A custom solution -
If you want to use a Compliance Policy ( for example , CIS, HIPPA ), create a job which will run audit parser on running package images and notify a update task upon non-complaint status.
There are OVAL parser and OVAL definition available for free for above policies. For custom aduit policies you can write your own parser and audit the image.</p>

CC BY-SA 3.0
2018-01-10T07:14:48.563Z
Audit mode in chef is deprecated in favor of the audit cookbook and using inspec for which there's multiple CIS profiles available.
Tensibai
CC BY-SA 3.0
2018-01-10T06:40:04.830Z
2018-01-10T06:40:04.830Z
prashant tyagi
<p>Part of adopting the Immutable Infrastructure Pattern is decomposing your system into small manageable pieces that can move through CI/CD Pipeline very quickly, this means that OS patches can be done quickly and in a controlled manner.  I often see clients ending up with a halfway house where infrastructure is mostly immutable.</p>

<p>However, there are a few approaches to this which I have used in large-scale deployments of cloud architecture, typically I implement more than one as part of a <a href="https://security.stackexchange.com/questions/121905/defense-in-depth-with-common-security-controls">Defense in Depth strategy</a>:</p>

<ul>
<li><p><strong><a href="https://security.stackexchange.com/questions/4357/enterprise-security-incident-response-and-detection/4742#4742">Security Information and Event Management (SIEM)</a></strong>: These products, for example, LogRhythm Security Intelligence Platform and more generic products such as ElasticStack take feeds from the operating system, which includes the output from a frequent check for updates.  The trick here is to get the information about what to patch quickly and automatically to inform decisions about when to roll those through your pipeline.</p></li>
<li><p><strong><a href="https://security.stackexchange.com/questions/126360/vulnerability-management-solution-evaluation-criteria">Vulnerability Management</a></strong> systems are more tailored than SIEM in that they are only focusing on vulnerabilities across the system so could catch issues with libraries installed as part of the software deployed to the system but not managed by the Operating System.  This might highlight vulnerabilities for which there is no patch (yet... hopefully).</p></li>
<li><p><strong><a href="https://techbeacon.com/13-tools-checking-security-risk-open-source-dependencies-0" rel="noreferrer">Dependency Check</a></strong> tools form part of your pipeline and can be configured to fail the build if check-ins add vulnerabilities, this also works if a new vulnerability is added to the tool since the last check-in.</p></li>
</ul>

CC BY-SA 3.0
2018-01-11T10:43:49.393Z
2018-01-11T10:43:49.393Z
Richard Slater
<p>We're going to be using Terraform to automate our infrastructure deployment and Packer to create the machine images deployed by Terraform. By following immutable infrastructure design principles, we will implement patching by creating a new image with the patch applied and then redeploy our infrastructure.</p>

<p>With this setup, are there any additional tools we can use to automatically detect when a package or the OS itself in our base image needs updating and trigger the build pipeline? </p>

<p>Chef Automate seems close to what I'm looking for, however, it seems to scan running nodes for compliance rather than analyze the image manifest itself.</p>

<p>Thanks!</p>

CC BY-SA 3.0
2018-01-09T23:10:18.653Z
`machine images`, `By following immutable infrastructure design principles`, `Chef Automate seems close to what I'm looking for`, `base image`. Please clarify.
030
CC BY-SA 3.0
2018-01-10T07:16:42.797Z
Yep, scan a node using the image, if the node fail then the image is outdated also... Automate brings workflow which can be triggered also to rebuild the base image and redeploy
Tensibai
<chef><terraform><infrastructure-as-code><packer><immutable-servers>
How should we automatically rebuild immutable infrastructure when new packages are available?
Thuy Guevarra
# How should we automatically rebuild immutable infrastructure when new packages are available?

(Asked by: username_0 on 2018-01-09)

We're going to be using Terraform to automate our infrastructure deployment and Packer to create the machine images deployed by Terraform. By following immutable infrastructure design principles, we will implement patching by creating a new image with the patch applied and then redeploy our infrastructure.

With this setup, are there any additional tools we can use to automatically detect when a package or the OS itself in our base image needs updating and trigger the build pipeline?

Chef Automate seems close to what I'm looking for, however, it seems to scan running nodes for compliance rather than analyze the image manifest itself.

Thanks!

**Tags:** chef, terraform, infrastructure-as-code, packer, immutable-servers

> **Comments:**
> **username_1**: `machine images`, `By following immutable infrastructure design principles`, `Chef Automate seems close to what I'm looking for`, `base image`. Please clarify.  
> **username_2**: Yep, scan a node using the image, if the node fail then the image is outdated also... Automate brings workflow which can be triggered also to rebuild the base image and redeploy  

---

## 3 answers

### Answer by username_5 on 2018-01-11. Score: 6 | Accepted answer

Part of adopting the Immutable Infrastructure Pattern is decomposing your system into small manageable pieces that can move through CI/CD Pipeline very quickly, this means that OS patches can be done quickly and in a controlled manner. I often see clients ending up with a halfway house where infrastructure is mostly immutable.

However, there are a few approaches to this which I have used in large-scale deployments of cloud architecture, typically I implement more than one as part of a [Defense in Depth strategy](https://security.stackexchange.com/questions/121905/defense-in-depth-with-common-security-controls):

* **[Security Information and Event Management (SIEM)](https://security.stackexchange.com/questions/4357/enterprise-security-incident-response-and-detection/4742#4742)**: These products, for example, LogRhythm Security Intelligence Platform and more generic products such as ElasticStack take feeds from the operating system, which includes the output from a frequent check for updates. The trick here is to get the information about what to patch quickly and automatically to inform decisions about when to roll those through your pipeline.
* **[Vulnerability Management](https://security.stackexchange.com/questions/126360/vulnerability-management-solution-evaluation-criteria)** systems are more tailored than SIEM in that they are only focusing on vulnerabilities across the system so could catch issues with libraries installed as part of the software deployed to the system but not managed by the Operating System. This might highlight vulnerabilities for which there is no patch (yet... hopefully).
* **[Dependency Check](https://techbeacon.com/13-tools-checking-security-risk-open-source-dependencies-0)** tools form part of your pipeline and can be configured to fail the build if check-ins add vulnerabilities, this also works if a new vulnerability is added to the tool since the last check-in.


---

### Answer by username_3 on 2018-01-10. Score: 1

You could do a vulnerability scan with AWS Inspector and look for CVE vulnerabilities. Inspector has a CloudWatch metric to cause an action when there are findings. Would be tricky to determine WHICH packages need to be updated, but you could just update everything. You don’t have to use Inspector, any vulnerability scanning tool you can hook into would work. Vulnerability scanning is a best practice in general.

Another idea would be to setup a cron job that does apt-get update && apt-get upgrade —dry-run > stuff-that-should-be-updated.txt and parse the text file for a list of packages to be updated and feed that back into your build process.


---

### Answer by username_4 on 2018-01-10. Score: 0

This approach looks to solve your purpose using Chef audit but it has got it's own problems.
<https://joshuakugler.com/using-chef-zero-audit-mode-and-packer.html>

A custom solution -
If you want to use a Compliance Policy ( for example , CIS, HIPPA ), create a job which will run audit parser on running package images and notify a update task upon non-complaint status.
There are OVAL parser and OVAL definition available for free for above policies. For custom aduit policies you can write your own parser and audit the image.

> **Comments:**
> **username_2**: Audit mode in chef is deprecated in favor of the audit cookbook and using inspec for which there's multiple CIS profiles available.  

---

