Security considerations for running containers on Amazon ECS

In case you’re trying to improve the safety of your containers on Amazon Elastic Container Service (Amazon ECS), you may start with the six ideas that we’ll cowl on this weblog submit. These curated greatest practices are really helpful by Amazon Internet Companies (AWS) container and safety subject material specialists so as to assist increase your container safety posture.

Earlier than we bounce into greatest practices, let’s take a look at the how the shared duty mannequin works for Amazon ECS hosted on Amazon Elastic Compute Cloud (Amazon EC2) infrastructure in comparison with AWS Fargate. The safety and compliance of a managed service like Amazon ECS is a shared duty between you and AWS. Usually talking, AWS is liable for safety of the cloud whereas you, the client, are liable for safety within the cloud. AWS is liable for the administration of the Amazon ECS management aircraft, together with the infrastructure that’s wanted to ship a safe and dependable service. On this submit, we’re going to concentrate on the areas of ECS safety that you’ll be liable for and supply steerage on what you’ll want to do to stick to those ECS safety greatest practices.

Determine 1 reveals the shared duty mannequin for Amazon ECS hosted on an EC2 occasion, during which the client has extra safety duty to cowl than when utilizing ECS on Fargate. For instance, the ECS agent and the employee node configuration is the client’s duty to control, as a result of the client is managing the EC2 occasion. Due to this fact, the client should handle the ECS agent and employee node as a part of their configuration and administration operations.

Determine 1: Duty mannequin for Amazon ECS hosted on an Amazon EC2 occasion

AWS assumes higher duty for infrastructure safety for Fargate, as proven in Determine 2.

Determine 2: Duty mannequin for Amazon ECS hosted on Fargate

In Fargate, every process runs in its personal digital machine (VM). No two duties share the working system or kernel assets. With Fargate, AWS manages the safety of the underlying occasion within the cloud and the runtime that’s used to run your duties. It additionally robotically scales your infrastructure in your behalf, which is one thing it’s best to think about if you happen to’re beginning your container journey and deciding in your infrastructure choices.

With that, let’s undergo these six Amazon ECS safety greatest practices.

1 – Handle ECS entry with IAM insurance policies and roles

AWS Id and Entry Administration (IAM) insurance policies can assist you management entry to Amazon ECS. For this we suggest that you just do the next:

Implement least privilege when establishing insurance policies for Amazon ECS assets – Use resource-level permissions to specify upon which assets you wish to enable explicit actions. For instance, solely enable a particular IAM person to cease a process that makes use of a particular process definition household on a particular ECS cluster.
Specify your process’s position – Be certain to outline the suitable process position in your ECS process definition. The duty position is utilized by your utility within the process to make API calls to AWS companies like Amazon Easy Storage Service (Amazon S3). This lets you run your duties by utilizing an IAM position that has solely the mandatory permissions, with out full entry to all companies and assets inside your account.
Create automated pipelines – Use Amazon CodePipeline or one among your different most popular steady integration and steady supply (CI/CD) options to create pipelines that bundle and deploy your purposes into ECS clusters. This fashion, you restrict the customers’ actions and delegate them to the automated pipeline. For an instance of easy methods to create pipelines, see Robotically construct CI/CD pipelines and Amazon ECS clusters for microservices utilizing AWS CDK.
Audit Amazon ECS API entry – Observe and monitor your AWS CloudTrail logs to determine who has entry to your Amazon ECS APIs and whether or not that entry continues to be warranted. You’ll be able to then delete the IAM customers, roles, and teams that aren’t in use and evaluation the insurance policies which can be in place. For extra info, see the AWS safety audit tips.

2 – Safe your ECS community

Community safety is a vital merchandise to work on as a part of making use of greatest practices to safe your Amazon ECS setting. This space consists of a number of sub-areas reminiscent of firewalling, site visitors routing, and community observability. Right here’s what we suggest:

Community segmentation and isolation – Amazon ECS duties are configured to function in several community modes. AWS recommends the usage of awsvpc as the popular community mode. It is because it’s the one mode that you should use to assign safety teams to duties. After you configure your process to make use of this mode, the ECS agent robotically provisions and attaches an elastic community interface (ENI) to the duty. When the ENI is provisioned, the duty is enrolled in an AWS safety group. The safety group acts as a digital firewall that you should use to regulate inbound and outbound site visitors. It’s additionally the one mode that’s accessible for Fargate duties on ECS if you happen to select to go that route.
Use community encryption the place relevant – Encrypting community site visitors helps forestall unauthorized customers from intercepting and studying information when that information is transmitted throughout a community. With Amazon ECS, you may implement community encryption in several methods, reminiscent of with a service mesh (TLS), utilizing AWS Nitro system cases, utilizing server title indication (SNI) with an utility load balancer, or end-to-end encryption with TLS certificates. In case your service is fronted by a public-facing load balancer, use TLS/SSL to encrypt the site visitors from the consumer’s browser to the load balancer and re-encrypt site visitors to the backend if warranted. For extra info, see Amazon ECS encryption in transit.
Create clusters in separate VPCs when community site visitors must be strictly remoted – It is best to create clusters in separate digital personal clouds (VPCs) when community site visitors must be strictly remoted. Keep away from working workloads which have strict safety necessities on clusters with workloads that don’t have to stick to these necessities. When strict community isolation is obligatory, create clusters in separate VPCs and selectively expose companies to different VPCs by utilizing VPC endpoints. For extra info, see VPC endpoints.
Configure AWS PrivateLink endpoints when doable – AWS PrivateLink is a networking expertise that means that you can create personal endpoints for various AWS companies, together with Amazon ECS. It is best to configure AWS PrivateLink endpoints when doable. In case your safety coverage prevents you from attaching an web gateway to your Amazon VPCs, then configure PrivateLink endpoints for ECS and different companies reminiscent of Amazon Elastic Container Registry (Amazon ECR), AWS Secrets and techniques Supervisor, and Amazon CloudWatch. For extra particulars, see the Amazon ECS Greatest Practices Information.

3 – ECS secrets and techniques administration

Secrets and techniques, reminiscent of API keys and database credentials, are regularly utilized by purposes to realize entry to different techniques. They usually include a username and password, a certificates, or an API key. Entry to those secrets and techniques ought to be restricted to particular IAM principals which can be utilizing IAM and injected into containers at runtime. Right here’s what we suggest:

Use Secrets and techniques Supervisor or Amazon EC2 Programs Supervisor Parameter Retailer for storing secret supplies – Securely storing API keys, database credentials, and different secret supplies is essential to assist forestall unintended publicity and unauthorized entry. AWS recommends that you just retailer these secrets and techniques in Secrets and techniques Supervisor or as an encrypted parameter in Amazon EC2 Programs Supervisor Parameter Retailer. These companies are related as a result of they’re each managed key-value shops that use AWS Key Administration Service (AWS KMS) to encrypt delicate information. Secrets and techniques Supervisor, nonetheless, additionally consists of the power to robotically rotate secrets and techniques, generate random secrets and techniques, and share secrets and techniques throughout AWS accounts. Moreover, Amazon ECS doesn’t assist versioned parameters in Parameter Retailer. If you’ll want to implement any of those options, use Secrets and techniques Supervisor; in any other case, use encrypted parameters. Additionally, you should use instruments like Chamber to handle secrets and techniques. For extra info, see this Information Middle article.
Mount the key to a quantity by utilizing a sidecar container – Contemplating the elevated danger of knowledge leakage with environmental variables, it’s really helpful that you just run a sidecar container that reads your secrets and techniques from Secrets and techniques Supervisor and writes them to a shared quantity. This container can run and exit earlier than the applying container by utilizing Amazon ECS container ordering. Once you do that, the applying container subsequently mounts the amount the place the key was written. It will assist isolate secret administration issues and facilitates dynamic secret dealing with. For instance, your utility ought to be written to learn the key from the shared quantity. Then, as a result of the amount is scoped to the duty, the amount is robotically deleted after the duty stops. For extra particulars about sidecar containers, see the aws-secret-sidecar-injector mission in GitHub.

4 – Safe the ECS process and runtime

It is best to contemplate the container picture as your first line of protection. An insecure, poorly constructed picture can enable customers to flee the bounds of the container and acquire entry to the host. It is best to do the next to mitigate the probabilities of this occurring:

Safe your container’s photos – Escape to host is a well known container risk method the place dangerous actors use unsecured container photos to flee the bounds of a container and acquire entry to the underlying host. We suggest that you just scan your container’s photos earlier than deployment. For photos saved on Amazon ECR, you should use Amazon Inspector to scan your photos, together with Amazon EventBridge to be notified to take actions to both delete or rebuild insecure photos. This course of is proven within the structure in Determine 3. You will discover extra particulars on easy methods to create customized responses to Amazon Inspector findings with Amazon EventBridge within the Amazon Inspector Person Information.

Determine 3: Pattern structure displaying easy methods to get notified of Amazon Inspector findings on a container’s picture

Allow the ECR tag immutability function – Menace actors may additionally attempt to push a compromised model of a container picture into your Amazon ECR repository with an similar tag. An answer for that is to drive a brand new tag for every new model of your picture. You are able to do this by enabling the picture tag mutability function in your ECR repositories. You will discover the Tag immutability setting on the Create repository web page within the Amazon ECR console, beneath Normal settings, as proven in Determine 4.

Determine 4: Enabling the tag immutability function in your Amazon ECR repository

Safe your containers and duties

Outline the USER parameter to make use of inside your container – Containers run by default as the foundation person, which doesn’t adhere to the precept of least privilege and might be misused. One advice is to ensure to run your containers as a non-root person by specifying the USER directive in your Dockerfile. You’ll be able to implement this when utilizing a CI/CD pipeline by configuring the pipeline to fail the construct if the USER directive is lacking.
Don’t run your containers in privileged mode – Be certain to not run your containers in privileged mode, which is usually a potential hole that permits unauthorized customers to run instructions inside a container. You should use AWS Safety Hub to detect containers which can be working in privileged mode. Alternatively, you should use AWS Lambda to scan your process definitions for the usage of the privileged parameter. Safety Hub has a built-in management (ECS.4) to test whether or not the privileged parameter within the container definition of Amazon ECS process definitions is ready to true.

Disable ECS Exec – Prospects ought to disable the ECS Execute situation key for manufacturing environments. Disabling the important thing supplies entry management that may assist forestall SSH entry into working containers. You are able to do this by disabling the ECS:Allow-Execute-Command situation key.
Safe runtime – For Linux containers, be certain so as to add or drop Linux kernel capabilities within the process definition. You are able to do this both by utilizing linuxParameters and making use of SELinux labels or by utilizing the AppArmor profile, which is a Linux safety module that restricts a container’s capabilities, reminiscent of accessing components of the file system. Once you’re utilizing the Fargate launch kind, every Fargate process has its personal isolation boundary and doesn’t share the underlying kernel, CPU assets, reminiscence assets, or elastic community interface with one other process.

5 – ECS logging and monitoring

Logging and monitoring your container’s exercise can assist you rapidly determine and examine safety incidents in your AWS environments. For instance, risk actors may need escalated permissions and have entry to your root person. Right here’s what we suggest:

Monitor your root-user actions – Configure an Amazon EventBridge rule that detects root-user actions primarily based on Amazon CloudTrail logs. For extra particulars, see this weblog submit.
Monitor adjustments to your duties and containers – Put applicable occasions guidelines in place in Amazon EventBridge for the creation of and adjustments to your duties and containers.
Monitor Amazon ECS scheduled duties – If risk actors have sufficient privileges, they will abuse the ECS process scheduling function to deploy containers that might run malicious code. Monitor such a exercise by utilizing Amazon CloudTrail logs and get notifications. For extra details about scheduling ECS duties, see the Amazon ECS Developer Information.
Monitor your container’s exercise metrics – One other advice is to allow logging in your container and use Amazon CloudWatch to trace exercise metrics in your containers, reminiscent of CPU and reminiscence utilization. This can assist you detect in case your assets are accessed and getting used for malicious actions, reminiscent of launching DoS assaults. See Amazon ECS CloudWatch Container Insights for extra info.
Use Amazon VPC Stream Logs to research the site visitors to and from long-running duties – It is best to use Amazon VPC Stream Logs to research the site visitors to and from long-running duties. Duties that use awsvpc community mode get their very own ENI. By setting duties to make use of this mode, you should use VPC move logs to watch site visitors that goes to and from particular person duties. A current replace to Amazon VPC Stream Logs (v3) enriches the logs with site visitors metadata, together with the VPC ID, subnet ID, and the occasion ID. You should use this metadata to assist slim an investigation. For extra info, see Amazon VPC Stream Logs. AWS cloud-native instruments like Amazon GuardDuty examine VPC move logs and generate alerts and findings if uncommon exercise is detected.

6 – ECS safety compliance

When utilizing Amazon ECS, your compliance duty is set by the sensitivity of your information, the compliance goals of your organization, and relevant legal guidelines and rules. For instance, as regards to the Cost Card Business Knowledge Safety Normal (PCI-DSS), it’s necessary that you just perceive the entire move of cardholder information (CHD) inside your setting.

The short-term nature of containerized purposes supplies extra complexities when auditing configurations. In consequence, clients want to take care of an consciousness of all container configuration parameters, to be sure that compliance necessities are addressed all through the phases of a container lifecycle. For added info on adhering to PCI DSS compliance on Amazon ECS, see the Architecting on Amazon ECS for PCI DSS Compliance whitepaper.

One service that may assist with monitoring Amazon ECS compliance is AWS Safety Hub. You should use this service to watch your utilization of ECS because it pertains to safety greatest practices. Safety Hub makes use of controls to guage useful resource configurations and safety requirements that will help you adjust to numerous compliance frameworks. For extra details about utilizing Safety Hub to guage ECS assets, see Amazon ECS controls within the AWS Safety Hub Person Information.

Conclusion

On this weblog submit, we offered a curated record of greatest practices for securing your Amazon ECS implementation. You should use these greatest practices as a place to begin to extend the safety posture of your ECS setting. You’ll be able to all the time add, take away, or prioritize the very best follow objects primarily based on what you are promoting wants and necessities. In case you’re on the lookout for extra detailed steerage on securing ECS in your setting, we recommend that you just check out Amazon ECS Safety Greatest Practices.

You probably have suggestions about this submit, submit feedback within the Feedback part beneath. You probably have questions on this submit, begin a brand new thread on AWS re:Publish or contact AWS Assist.

Mutaz Hajeer

Mutaz is a Senior Safety Options Architect on the AWS Worldwide Business Sector Safety Specialist group, working with clients in North America. Mutaz has been working inside the cybersecurity discipline for 14 years and now focuses on risk detection and incident response companies inside AWS. Exterior of labor, he likes to educate, play, and watch soccer, together with spending time along with his spouse and three youngsters.

Ibtissam Liedri

Ibtissam is a Options Architect for AWS Monetary Companies. She assists monetary companies clients all through their cloud journeys, serving to them craft scalable, versatile, and resilient architectures. Ibtissam has an curiosity in cloud safety with a concentrate on risk detection and incident response companies inside AWS and enjoys serving to clients perceive easy methods to higher construct and safe their workloads.

Temi Adebambo

Temi is the pinnacle of Safety Options Structure at AWS, with in depth expertise main technical groups and delivering enterprise-wide expertise transformation applications. He has assisted Fortune 500 firms with cloud safety structure, cyber danger administration, compliance, IT safety technique, and governance. Previous to AWS, Temi served in numerous roles at Deloitte and PwC, offering consulting companies in cybersecurity throughout industries.