Discover and Manage Amazon EC2 Assets with xAssets ITAM

Introduction

EC2 server instances are assets which need the same management, security, and controls as any server, desktop or laptop, and so should be in the same asset register as your physical assets. The AWS console has some similarities to an asset register, and it shows what is running, but each region has a separate console making overall visibility difficult, and it does not tell you who owns an instance, what cost centre it belongs to, or whether anyone is still using it.

xAssets ITAM gets all your EC2 instances and adds them to the asset register as asset records. This enables the workflows you use for laptops and servers to cover EC2 cloud assets. Workflows typically include:

• Procurement
• Receiving
• Deployment
• Ownership
• RMA
• Cost Recovery
• Obsolescence and Disposal
• Audits
• Security
• Endpoint Management
• Software Compliance

What Gets Imported

For each EC2 instance, the integration picks up the ID, type, IP addresses, MAC address, DNS names, availability zone, launch time, and status (running or not). It also pulls attached EBS volumes (size and type), the AMI name (instance type), and the CPU and memory specs from the AWS instance type catalogue.

EC2 doesn't store the same depth of information that a discovery tool can gather, so it is also possible to run discovery tools such as xAssets Discovery on each instance to get detailed asset and software information.

AWS Tags

AWS does not expose the Windows or Linux hostname through any EC2 API, and it does not know who owns each instance. However, these can be stored in AWS tags. The integration reads the Name tag for the computer name, and the Owner tag (or one of several equivalents) for the user (custodian), then xAssets matches this against its custodian list. Every other tag on the instance is preserved on the asset record and tags can be used to match other fields later.

So if you already use tags for FinOps, chargebacks, or other business functions, the data is available and can be mapped according to your business rules.

Setup

• Create an IAM user with the AmazonEC2ReadOnlyAccess policy and generate an Access Key
• Create a credential pack in your xAssets instance called Amazon. Then fill in as follows:
• Domain Name: DNS root such as eu-north-1.amazonaws.com
• Username: Access Key ID
• Password: Secret
• Run the AWS Integration from the Integrations menu
• Schedule the integration to run every few hours or daily

No software agents are installed on the instances and no ports are opened. The IAM user has read-only permissions, so it cannot make changes to instances.

For multi-region accounts, clone the integration, one per region, and each clone can use it's own credential pack and will appear in the Integrations query.

Data Sources

EC2 asset records sit in the same asset register that holds the laptops, servers, mobile devices and network equipment from the other discovery sources including Intune, JAMF, SCCM, ServiceNow, and xAssets Network Discovery.

When an instance is terminated in AWS the asset record stays in xAssets and goes through the disposal process. That keeps the audit trail intact so a complete history of AWS spending and instances is available.

Management

Once you have centralized your cloud and on-premises assets into a central repository, the reports and workflows will work for both sources of asset data and you can map interdependencies between them.

Further Reading

• Centralize Tanium Data with xAssets IT Asset Management
• Modernise ServiceNow Asset Workflows with xAssets ITAM and SAM
• Tracking Dell and Lenovo Warranty Information