Deaktiviert automatische ECS Fargate-Patches

Voraussetzungen

• Ein Amazon ECS Fargate-Cluster, der mit TrendAI Vision One™ verbunden ist.
• Laufzeitsicherheit für den ECS-Cluster in der TrendAI Vision One™-Konsole aktiviert.
• IAM-Berechtigungen zum Erstellen und Ändern von ECS-Aufgabendefinitionen und IAM-Rollen.
• Eine ECS-Aufgaben-Ausführungsrolle mit Berechtigungen zum Abrufen von Container-Images und zum Schreiben in CloudWatch Logs.

Hinweis Wenn die Ausführungsrolle nicht über die Berechtigung logs:CreateLogGroup verfügt, erstellen Sie die CloudWatch-Loggruppe vorab, bevor Sie die Aufgabenbeschreibung bereitstellen (wie im Terraform-Beispiel in Schritt 3 gezeigt).

Schritt 1: Deaktivieren Sie die automatische Patch-Verarbeitung

Schritt 2: Aktuelle Container-Image-Versionen abrufen

• CloudPdigVersion
• CloudScoutVersion
• CloudFalcoVersion

Schritt 3: Aufgabenbeschreibung erstellen oder aktualisieren

• PID-Modus (Aufgabe): Ermöglicht Sicherheitscontainern, Anwendungsprozesse über die gesamte Aufgabe hinweg zu überwachen.
• Gemeinsames Volume (trendmicro-Komponente): Ermöglicht Init-Containern, Binärdateien zu kopieren, die der Runtime-Sicherheitscontainer ausführt.
• SYS_PTRACE-Fähigkeit: Erforderlich für sowohl Anwendungs- als auch Sicherheitscontainer, um Prozessverfolgung und Sicherheitsüberwachung zu ermöglichen.
• Container-Abhängigkeiten: Stellt sicher, dass Sicherheitscontainer vor der Anwendung und in der richtigen Reihenfolge starten.
• Gesundheitsprüfungen: Bestätigt, dass Sicherheitskomponenten laufen, bevor die Aufgabe als nicht infiziert markiert wird.
• IAM-Berechtigungen: Ermöglicht Sicherheitscontainern, Authentifizierungstoken aus AWS Secrets Manager und SSM Parameter Store abzurufen und Sicherheitsereignisse zu melden.

# Data sources to get current AWS region and account ID
data "aws_region" "current" {}
data "aws_caller_identity" "current" {}

# Variables
variable "log_group" {
  description = "CloudWatch log group name for ECS containers"
  type        = string
  default     = "/ecs/your-task-definition-family-name"
}

variable "cluster_name" {
  description = "Name of your existing ECS cluster"
  type        = string
  default     = "your-cluster-name"
}

variable "execution_role_arn" {
  description = "ARN of the existing ECS task execution role"
  type        = string
}

# Pre-create CloudWatch log group
resource "aws_cloudwatch_log_group" "ecs_logs" {
  name              = var.log_group
  retention_in_days = 7

  tags = {
    Name        = "ECS Task Logs"
    ManagedBy   = "Terraform"
    Application = "Vision One Container Security"
  }
}

resource "aws_ecs_task_definition" "this" {
  family                   = "your-task-definition-family-name"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  cpu                      = "512"
  memory                   = "1024"

  # Task role - for runtime permissions (SSM, Secrets Manager, ECS TagResource)
  task_role_arn      = aws_iam_role.container_security_role.arn
  # Execution role - for pulling images and writing logs
  execution_role_arn = var.execution_role_arn

  # Required for Vision One Container Security
  pid_mode = "task"
  volume { name = "trendmicro-component" }

  container_definitions = jsonencode([
    # Your application container
    {
      name             = "your-app"
      image            = "your-app-image:tag"
      essential        = true

      # Application must depend on security container and have SYS_PTRACE capability
      dependsOn        = [{ condition = "START", containerName = "trendmicro-security" }]
      linuxParameters  = { capabilities = { add = ["SYS_PTRACE"] } }
      logConfiguration = {
        logDriver = "awslogs",
        options = {
          "awslogs-group" = var.log_group,
          "awslogs-create-group" = "true",
          "awslogs-region" = data.aws_region.current.id,
          "awslogs-stream-prefix" = "ecs"
        }
      }
    },

    # Vision One Container Security: Init container for PDIG
    {
      name             = "trendmicro-init-pdig"
      image            = "public.ecr.aws/trendmicro/container-security/cloud-pdig:<CloudPdigVersion>"
      essential        = false
      user             = "0"  # Required for FIPS images - runs as root to write to shared volume
      entryPoint       = ["/bin/sh"]
      command          = ["-c", "set -e; attempt=0; until [ $attempt -ge 3 ]; do attempt=$((attempt+1)); if timeout 30 sh -c 'cp -fv /usr/bin/pdig /var/TrendMicro/ && cp -fv /*.sh /var/TrendMicro/'; then exit 0; fi; sleep 2; done; exit 1"]
      mountPoints      = [{ sourceVolume = "trendmicro-component", containerPath = "/var/TrendMicro/" }]
      logConfiguration = {
        logDriver = "awslogs",
        options = {
          "awslogs-group" = var.log_group,
          "awslogs-create-group" = "true",
          "awslogs-region" = data.aws_region.current.id,
          "awslogs-stream-prefix" = "ecs"
        }
      }
    },

    # Vision One Container Security: Init container for Scout
    {
      name             = "trendmicro-init-scout"
      image            = "public.ecr.aws/trendmicro/container-security/cloud-scout:<CloudScoutVersion>"
      essential        = false
      user             = "0"  # Required for FIPS images - runs as root to write to shared volume
      entryPoint       = ["/bin/sh"]
      command          = ["-c", "set -e; attempt=0; until [ $attempt -ge 3 ]; do attempt=$((attempt+1)); if timeout 30 sh -c 'cp -fv /*.sh /var/TrendMicro/ && cp -fv /service /var/TrendMicro/ && cp -fv /ecs_entry /var/TrendMicro/ && cp -fv /MQTT_config.yaml /var/TrendMicro/ && chmod -v 755 /var/TrendMicro/*.sh'; then exit 0; fi; sleep 2; done; exit 1"]
      mountPoints      = [{ sourceVolume = "trendmicro-component", containerPath = "/var/TrendMicro/" }]
      dependsOn        = [{ condition = "SUCCESS", containerName = "trendmicro-init-pdig" }]
      logConfiguration = {
        logDriver = "awslogs",
        options = {
          "awslogs-group" = var.log_group,
          "awslogs-create-group" = "true",
          "awslogs-region" = data.aws_region.current.id,
          "awslogs-stream-prefix" = "ecs"
        }
      }
    },

    # Vision One Container Security: Runtime security container
    {
      name             = "trendmicro-security"
      image            = "public.ecr.aws/trendmicro/container-security/cloud-falco:<CloudFalcoVersion>"
      essential        = false
      user             = "0"  # Required - runs as root for PDIG and Falco operations
      entryPoint       = ["/bin/sh"]
      command          = ["-c", "cp -f /var/TrendMicro/* / && /start_ecs_fargate.sh"]

      # Environment variables - adjust VISION_ONE_ENDPOINT for your region
      environment = [
        { name = "PARAMETER_PREFIX", value = "/V1CS" },
        { name = "SPC_MODE", value = "false" },
        { name = "FILE_INTEGRITY_MONITORING", value = "true" },
        { name = "VISION_ONE_ENDPOINT", value = "<VISION_ONE_ENDPOINT>" },
        { name = "LOG_LEVEL", value = "info" }
      ]

      dependsOn        = [
        { condition = "SUCCESS", containerName = "trendmicro-init-pdig" },
        { condition = "SUCCESS", containerName = "trendmicro-init-scout" }
      ]
      mountPoints      = [{ sourceVolume = "trendmicro-component", containerPath = "/var/TrendMicro/", readOnly = true }]
      linuxParameters  = { capabilities = { add = ["SYS_PTRACE"] } }

      # Health check ensures security components are running properly
      healthCheck = {
        command     = ["CMD-SHELL", "pgrep -f falco >/dev/null && pgrep -f '/service.*grpc-socket-path' >/dev/null || exit 1"]
        interval    = 30
        timeout     = 5
        retries     = 3
        startPeriod = 60
      }
      logConfiguration = {
        logDriver = "awslogs",
        options = {
          "awslogs-group" = var.log_group,
          "awslogs-create-group" = "true",
          "awslogs-region" = data.aws_region.current.id,
          "awslogs-stream-prefix" = "ecs"
        }
      }
    }
  ])
}

# IAM role for the task
resource "aws_iam_role" "container_security_role" {
  name = "container-security-task-role"
  assume_role_policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole",
      Effect = "Allow",
      Principal = { Service = "ecs-tasks.amazonaws.com" }
    }]
  })
}

# IAM policy with required permissions for Vision One Container Security
resource "aws_iam_role_policy" "container_security_role_policy" {
  name = "container-security-task-role-policy"
  role = aws_iam_role.container_security_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = "ssm:GetParameter"
        Resource = "arn:aws:ssm:${data.aws_region.current.id}:${data.aws_caller_identity.current.account_id}:parameter/V1CS/*"
      },
      {
        Effect   = "Allow"
        Action   = "secretsmanager:GetSecretValue"
        Resource = "arn:aws:secretsmanager:${data.aws_region.current.id}:${data.aws_caller_identity.current.account_id}:secret:/V1CS/${var.cluster_name}/AuthToken-*"
      },
      {
        Effect   = "Allow"
        Action   = "ecs:TagResource"
        Resource = "arn:aws:ecs:${data.aws_region.current.id}:${data.aws_caller_identity.current.account_id}:task/*"
      },
      {
        Effect   = "Allow"
        Action   = "sqs:SendMessage",
        Resource = "arn:aws:sqs:${data.aws_region.current.id}:${data.aws_caller_identity.current.account_id}:trendmicro-container-security-*"
      }
    ]
  })
}

Schritt 4: Bereitstellen und überprüfen

1. Wenden Sie die Terraform-Konfiguration an:

   terraform plan
   terraform apply

2. Überprüfen Sie, ob die Aufgabendefinition im AWS ECS-Console korrekt erstellt wurde.
3. Bereitstellen Sie einen Dienst mit dieser Aufgabenbeschreibung.
4. Überprüfen Sie die CloudWatch Logs, um zu bestätigen, dass alle Container erfolgreich gestartet sind.
5. Überprüfen Sie in der TrendAI Vision One™-Konsole, ob die Arbeitslast angezeigt wird und Sicherheitsereignisse erfasst werden.

Wichtige Informationen