# Run InSpec on each instance?

**URL:** <https://discourse.chef.io/t/run-inspec-on-each-instance/13126>\
**Category:** Chef InSpec\
**Created:** [May 30, 2018, 2:52am UTC](https://discourse.chef.io/t/run-inspec-on-each-instance/13126 "2018-05-30T02:52:16Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![dcadwallader](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/dcadwallader/32/2268_2.png) [@dcadwallader](https://discourse.chef.io/u/dcadwallader)\
**Post date:** [May 30, 2018, 2:52am UTC](https://discourse.chef.io/t/run-inspec-on-each-instance/13126/1 "2018-05-30T02:52:16Z")

</div>

We’re evaluating InSpec, but the notion of a central Chef Compliance server remotely executing code via ssh on every VM might be a hard sell for my Security team.

Is it possible to run InSpec locally on each instance, _and also_ have each instance run scheduled scans and report results to the Compliance server?

This way, I understand there would be more work since we’d have to deploy the InSpec scripts using Chef, etc.

Thanks for any advice!  
Dave

---

<div class="post-metadata">

**Author:** ![MattRay](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.chef.io/mattray/32/47_2.png) [@MattRay](https://discourse.chef.io/u/MattRay)\
**Post date:** [May 30, 2018, 3:56am UTC](https://discourse.chef.io/t/run-inspec-on-each-instance/13126/2 "2018-05-30T03:56:30Z")

</div>

You’ve clearly identified why the remote scanner isn’t for everyone, what you want is to use the Audit cookbook. Chef client will run your audits with each scheduled run and report back the state of your compliance directly to Chef Automate or to your Chef server which will forward to Automate. InSpec scripts may be stored on the Automate server, in Git, deployed on the local filesystem (possibly managed with Chef), or fetched remotely over http. Good luck!

[https://github.com/chef-cookbooks/audit](https://github.com/chef-cookbooks/audit)