OWASP Amass Attack Surface Discovery

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

OWASP Amass is the OWASP Foundation's open-source, Apache-2.0 licensed tool for attack-surface mapping and external asset discovery, and one of the most widely adopted open-source attack-surface-mapping tools. This AMI delivers Amass fully configured as a ready-to-run asset-inventory appliance - SSH in and start discovering subdomains, DNS records, TLS certificates, netblocks and autonomous systems within minutes of launch.

## Why This AMI Instead of a Bare Install

Installing Amass from source or Docker gives you a binary, not a production-ready scanning host. With a manual approach you still need to research configuration options, set up a persistent asset database, build scheduling plumbing, harden the instance, and wire output into your pipeline. This AMI eliminates that work entirely:

• No configuration research - system config and OSINT data-source template are pre-built at /etc/amass/
• No database setup - a persistent OWASP Open Asset Model (OAM) database is ready at /var/lib/amass
• No scheduling plumbing - a daily systemd timer runs passive enumeration automatically
• No hardening steps - SSH-only access, loopback-firewalled engine port, unattended security updates, fully patched OS
• No credential risk - ships with zero baked API keys and no default credentials of any kind

The result: you go from EC2 launch to your first asset-discovery report without writing a single line of configuration.

## What Is Included

• Pinned scanner - the upstream OWASP Amass release binary, verified against published SHA256 checksums
• Ready-to-use configuration - system config at /etc/amass/config.yaml and an OSINT data-source template at /etc/amass/datasources.yaml. Certificate-transparency and several sources work with no API keys; add your keys to unlock more than sixty data sources
• Persistent asset database - findings accumulate in the OAM database and are queryable with amass subs at any time
• Scheduled enumeration - a daily systemd timer passively enumerates your configured domains and writes text reports with stable latest-domain symlinks
• Self-test included - run amass-selftest to confirm the scanner works end to end before pointing it at your own domains

## CI and SIEM Integration

Text reports are written with stable symlinks under /var/lib/amass/reports, making them straightforward to pick up with common automation and monitoring tools. Feed the plain-text reports into Jenkins or GitLab CI pipelines for continuous asset-inventory checks, or ship them to Splunk or Elastic SIEM for correlation with your security event data. The plain-text format works with any log shipper or file-based integration.

## Authorised Use Only

Amass is a defensive asset-inventory tool for domains you own or are permitted to assess. Enumerating third-party infrastructure you are not authorised to test may be illegal. The image ships with no targets configured; you add only the domains you are authorised to enumerate, and the default mode is passive open-source-intelligence collection that sends no packets to your targets.

## How Asset Discovery Works

1. Add the domains you are authorised to enumerate to /etc/amass/scan.conf (empty by default)

2. The daily systemd timer runs a passive enumeration of those domains

3. Findings are persisted to the OAM asset database and written as text reports

4. Query accumulated results at any time with amass subs

5. Switch to active mode with one edit when you want DNS resolution and light active recon on assets you own

## Getting Started

1. Launch the AMI on your preferred EC2 instance type

2. Connect over SSH using your key pair

3. Prove the scanner works with amass-selftest owasp.org

4. Add your authorised domains to /etc/amass/scan.conf and, optionally, API keys to /etc/amass/datasources.yaml

5. Review reports under /var/lib/amass/reports and query results with amass subs

## Secure by Default

SSH with your launch key is the only open port. The embedded collection-engine port is firewalled to loopback. No default credential of any kind, no baked API keys, and unattended security upgrades are enabled. The operating system is fully patched at capture.

## 24/7 cloudimg Support

Technical support by email and live chat covers configuring authorised targets, adding OSINT data-source API keys, interpreting the asset database and reports, wiring the schedule into your CI or SIEM pipeline, and switching between passive and active modes. Critical issues receive a one-hour average response. Contact support@cloudimg.co.uk with any pre-purchase or configuration questions.

OWASP Amass is Apache-2.0 licensed free software. All product and company names are trademarks or registered trademarks of their respective holders; use of them does not imply any affiliation with or endorsement by them, including the OWASP Foundation.