nessus-packer - Create machine images containing the Nessus vulner

项目说明

nessus-packer ⚠️📦 #

![GitHub Build Status]()
![License]()
![CodeQL]()

This project can be used to create machine images that include
Tenable's Nessus Professional
scanner.

Pre-requisites ##

This project requires a build user to exist in AWS. The accompanying Terraform
code will create the user with the appropriate name and permissions. This only
needs to be run once per project, per AWS account. This user will also be used
by GitHub Actions.

Before the build user can be created, the following profile must exist in
your AWS credentials file:

The easiest way to set up that profile is to use our
aws-profile-sync utility.
Follow the usage instructions in that repository before continuing with the
next steps. Note that you will need to know where your team stores their
remote profile data in order to use
aws-profile-sync.

Creating a build user ###

You will need to create a build user for each en that you use. The
following steps show how to create a build user for an en named "dev".
You will need to repeat this process for any additional en.

1. Change into the terraform-build-user directory:

1. Create a backend configuration file named de containing the
name of the bucket where "dev" en Terraform state is stored - this file
is required to initialize the Terraform backend in each en:

1. Initialize the Terraform backend for the "dev" en using your backend
configuration file:

> [!NOTE]
> When performing this step for additional en (i.e. not your first
> en), use the -reconfigure flag:
>
>

1. Create a Terraform file named de containing all
required (currently only terraform_state_bucket):

1. Create a Terraform workspace for the "dev" en:

1. Initialize and upgrade the Terraform workspace, then apply the configuration
to create the build user in the "dev" en:

Once the build user is created you will need to update the
repository's secrets
with the new encrypted en . This should be done using the
terraform-to-secrets
tool a in the
de guide. Instructions
for how to use this tool can be found in the
"Terraform IAM Credentials to GitHub Secrets" section.
of the Project Setup README.

If you ha permissions for the repository you can view existing
secrets on the
appropriate page
in the repository's settings.

IMPORTANT: The account where your images will be built must have a VPC and
a public subnet both tagged with the name "AMI Build", otherwise packer
will not be able to build images.

Building the image ##

Using GitHub Actions ###

1. Create a new release
in GitHub.
1. There is no step 2!

GitHub Actions can build this project in three different modes depending on
how the build was triggered from GitHub.

1. De release: After a normal commit and also on a pull request,
GitHub Actions will run tests and on the Packer template, and then
build the project. An image will be built and deployed using the
build workflow. This should be configured
to deploy the image to a single region using a de account.
1. Pre-release: Publish a GitHub release with the "This is a pre-release"
checkbox checked. An image will be built and deployed using the
prerelease workflow. This should be
configured to deploy the image to a single region using a non-production
account (e.g. "staging").
1. Production release: Publish a GitHub release with the "This is a
pre-release" checkbox unchecked. An image will be built and deployed using
the release workflow. This should be
configured to deploy the image to multiple regions using a production
account.

Using your local en ###

Packer will use your
standard AWS en
to build the image, however you will need to set up one profile for the
pre build user and another profile to assume the associated
EC2AMICreate role. You will need the aws_access_key_id and
aws_secret_access_key that you set as GitHub secrets earlier.

Add the following blocks to your AWS credentials file (be sure to replace the
dummy account ID in the role_arn with your own):

This Packer template defines a number of whose defaults can be changed
through a .pkrvars.hcl file:

Here is an example of how to kick off a pre-release build:

> [!NOTE]
> Note that we use --force-with-deps here since the user's Ansible
> setup, unlike when we run in GitHub Actions, may not start from a
> pristine state. We want to make sure that the latest of
> all Ansible roles and collections, along with their dependencies, are
> installed by forcing their reinstallation even if they are already present.

If you are satisfied with your pre-release image, you can easily create a release
that deploys to all regions by adding additional regions to the Packer template.
This can be done by using a .pkrvars.hcl for example with release.pkrvars.hcl:

Giving other AWS accounts permission to launch the image ###

After the AMI has been successfully created, you may want to allow other
accounts in your AWS organization permission to launch it. The following steps
show how to do this for an en named "dev". You will need to repeat this
process for any additional en.

> [!NOTE]
> Refer to the ami_share_account_name_regex if you want to customize
> which accounts in your AWS organization to share your AMI with.

1. Change into the terraform-post-packer directory:

1. Create a backend configuration file named de containing the
name of the bucket where "dev" en Terraform state is stored - this file
is required to initialize the Terraform backend in each en:

1. Initialize the Terraform backend for the "dev" en using your backend
configuration file:

> [!NOTE]
> When performing this step for additional en (i.e. not your first
> en), use the -reconfigure flag:
>
>

1. If not already created, create a Terraform workspace for the "dev" en:

Otherwise, switch to the existing "dev" workspace:

1. Initialize and upgrade the Terraform workspace, then apply the configuration
to share the AMI with accounts in the "dev" en:

<!-- BEGIN_TF_DOCS -->

Requirements ##

No requirements.

Pro ##

| Name | |
| ---- | ------- |
| amazon-ami | n/a |

Modules ##

No modules.

Resources ##

| Name | Type |
| ---- | ---- |
| amazon-ami_amazon-ami.ubuntu_noble_arm64 | data source |
| amazon-ami_amazon-ami.ubuntu_noble_x86_64 | data source |

Inputs ##

| Name | Description | Type | Default | Required |
| ---- | ----------- | ---- | ------- | :------: |
| ami\_regions | The list of AWS regions to copy the AMI to once it has been created. Example: ["us-east-1"] | list(string) | [] | no |
| build\_bucket | The name of the S3 bucket containing the Nessus package file. | string | "" | no |
| build\_region | The region in which to retrieve the base AMI from and build the new AMI. | string | "us-east-1" | no |
| build\_region\_kms | The ID or ARN of the KMS key to use for AMI encryption. | string | "alias/cool-amis" | no |
| force\_install\_ansible\_requirements | Indicate if the Ansible requirements should be force installed. | bool | false | no |
| force\_install\_ansible\_requirements\_with\_dependencies | Indicate if the Ansible requirements *and* their dependencies should be force installed. | bool | false | no |
| github\_ref\_name | The GitHub short ref name to use for the tags applied to the created AMI. | string | "" | no |
| github\_sha | The GitHub commit SHA to use for the tags applied to the created AMI. | string | "" | no |
| is\_prerelease | The pre-release status to use for the tags applied to the created AMI. | bool | false | no |
| region\_kms\_keys | A map of regions to copy the created AMI to and the KMS keys to use for encryption in that region. The keys for this map must match the provided to the aws\_regions . Example: {"us-east-1": "alias/example-kms"} | map(string) | {} | no |
| release\_tag | The GitHub release tag to use for the tags applied to the created AMI. | string | "" | no |
| release\_url | The GitHub release URL to use for the tags applied to the created AMI. | string | "" | no |
| skip\_create\_ami | Indicate if Packer should not create the AMI. | bool | false | no |

Outputs ##

No outputs.
<!-- END_TF_DOCS -->

Contributing ##

We welcome contributions! Please see CONTRIBUTING.md for
details.

License ##

This project is in the worldwide public domain.

This project is in the public domain within the United States, and
copyright and related rights in the work worldwide are wai
the CC0 1.0 Uni public domain
dedication.

All contributions to this project will be released under the CC0
dedication. By submitting a pull request, you are agreeing to comply
with this waiver of copyright interest.

项目信息

开发语言：HCL

Star 数：13

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Create machine images containing the Nessus vulnerability scanner展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。