- Hello everyone.
This demo will cover how
to activate Amazon Guard Duty ECS Runtime Monitoring
for instances running on Fargate.
This protection plan extends your runtime threat detection
to Amazon Elastic Container Service, Amazon ECS
workloads running on Amazon Elastic Compute Cloud
EC2 instances.
And on AWS Fargate Guard duty is a threat detection service
that protects your AWS accounts, workloads,
and data by continuously monitoring AWS log
and networking activity
to identify malicious behavior using machine
learning anomaly detection.
And AWS developed an industry leading third
party threat intelligence.
- Amazon ECS is a fully managed container orchestration
service that helps customers more efficiently deploy,
manage, and scale containerized applications.
Guardee supports ECS deployments running on Amazon EC2
as well as fargate.
Amazon EC2 delivers secure, reliable, high-performance
and cost-effective compute infrastructure.
West Fargate is a serverless compute engine for containers
that works with Amazon ECS
and Amazon Elastic Kubernetes EKS.
Amazon ECS is secure by design with resource isolation
and native integration with AWS security,
identity management and governance tools.
However, like any compute workload container applications
can run potentially vulnerable software
or be misconfigured leaving them susceptible to attack
guard duty ECS Runtime monitoring deploys a
lightweight, fully managed
- Security agent that analyzes operating system level
behavior such as file access, process
- Execution, - And network connections.
- Guard duty combines the newly added runtime visibility
with existing control plane
and network visibility to help customers identify
and respond to threats targeting applications
and data running in containerized workloads.
- Guard duty ECS Runtime monitoring allows security
and application teams
to uniquely detect sophisticated attacks
that can occur across containers,
underlying compute resources,
and more broadly throughout a containerized environment.
A modern security event could start with a compromise
of a single container running a vulnerable web application
with access permissions to underlying compute
or Amazon ECS task resources
where misconfigured credentials could allow
for broader access to the account
and ultimately the valuable data stored within it.
Guard duty ECS runtime monitoring can be enabled
with a few clicks in the guard duty console leveraging a DS
organizations for multi account management
and ECS for automated resource discovery
and agent deployment.
Now the switch to the console for a brief demonstration,
- Runtime - Monitoring can be enabled for a
- Standalone account or being able
to monitor multiple accounts within your environment.
To start off, we are going
to enable runtime monitoring for a standalone account.
So we've navigated to the guard duty console
and selected runtime monitoring within the left
hand navigation panel.
If we go under the configuration tab
and scroll down, you'll have choices
to enable runtime monitoring.
First we will select runtime monitoring
and this will enable runtime monitoring.
For this account, select confirm,
and now that that is enabled, as we can see from the banner
above, we want
to enable ECS runtime monitoring specifically.
So if you also wanted,
we're interested in enable Amazon EKAS runtime,
you can enable that here.
But for this demonstration, we are only enabling AWS Fargate
for ECS only runtime configuration,
and we'll simply select enable
and confirm that we do want
to have the automated agent configuration
for a OS Fargate ECS only for this account.
And now runtime monitoring has been enabled. Now
- Let's go over how to enable runtime monitoring
for multiple account environments.
So we're still in the guard duty console.
We're underneath the Runtime Monitoring protection plan,
but this time we have logged into the Delegated
Administrator account, a foreign organization.
So in a multiple account environment,
only the guard duty Delegated Administrator account can
enable or disable runtime monitoring for member accounts.
So as we slow down under runtime monitoring configuration,
we see that we have a few more options.
So let's select edit.
So the first step is to enable runtime monitoring.
And you have two options.
We can see that configure accounts manually has been
preselected and so this is in case you would only want
to enable runtime monitoring
for very selective accounts within your organizational unit,
such as your delegated administrative account,
which you can easily decide to only enable
or disable runtime monitoring for that account.
You can also decide whether
or not you want to automatically enable runtime monitoring
for new member accounts.
This would mean that all member accounts that are added
to this specific organizational unit will automatically have
runtime monitoring enabled.
You also have the option to enable for all accounts.
And so all accounts that currently have guard duty activated
and are are in your organization.
They will automatically have runtime monitoring enabled
and all future member accounts will have it
automatically enabled as well.
We are gonna select Enable for all accounts for this demo.
Then we want to scroll down
to the automated agent configuration for a WSS Fargate.
So you see that you have these same options as you did
above, giving you the ability
to either configure the automated agent configuration
for very selective accounts within the organizational unit,
or automatically enable for all accounts in order
to have full coverage and not have to worry about whether
or not new accounts have the
automated agent configuration enabled.
We are gonna enable for all accounts for this demo
and then select save.
Now that you have runtime monitoring enabled for Amazon ECS,
you can navigate to runtime coverage
and underneath ECS cluster runtime coverage,
you have the ability to see the coverage statistics
for your AWS Fargate resources that are associated
with your own accounts or your member accounts.
And it shows the percentage of healthy
Amazon ECS clusters over all
of the Amazon ECS clusters in the selected region.
Now that we have guard duty runtime monitoring enabled
for a DS Fargate, let's look at a few findings.
So I've navigated
to the finding section within the guard duty console
and here under resource type I've already filtered
for the ECS clusters.
And as we scroll down,
we can take a look at this cryptocurrency finding.
So I'm gonna select the finding.
We are going to be
provided with a bit more context, so you have your overview
information about the region severity,
but as we scroll down,
we can also see some ECS cluster details.
So you have the task ID
as well as the specific name of the ECS cluster.
You also have the specific container.
So this is going to help when your task has multiple
containers associated with it
to really pinpoint which container.
You also have information on the tags as well as action
as you scroll down a bit more.
You also see under runtime details,
you have process level information.
So this is going to give you the executable path.
You also have the hash associated with this finding.
So this is something that you can run against known virus
or malware databases,
and you also have the ability to see all lineage.
And that's just gonna provide you a bit more information on
how this threat got into your container.
Now if we switch over
and let's look at this execution runtime reverse shell.
This is another finding.
It's you're going to have the same information given,
but if we scroll down to that process level information
that we've been provided, now you have the name
of the binary and the associated ex executable path,
and you can also see the lineage.
And here we have three different levels, thus providing you
with more information on how this finding came to be.
We can select level three,
which is the earliest line of lineage.
We can see we have the start time name space process,
as well as the executable path.
When we go to level two, we can see
that there was a bash associated with the finding.
And level one you have the binary file.
So all of this information
that you're given on the guard duty runtime monitoring
findings related to ECS clusters, it's going to allow you
to respond faster
and with a lot more precision
to threats detected within your account.
- In this video, we demonstrated the guard duty runtime
protection for ECS feature to teach you how
to expand your runtime threat detection
for a CS workloads running on EC2 instances
and on a DS Fargate.
For more information and
to try guard duty EECS runtime monitoring at no cost
for 30 days, please visit
www.aws.amazon.com/guard duty.