6 ms·
For people who worry about security (either sincere or tick the box types): what are the pros and cons of managed containers? It seems like you get a reduction
by fovc 7y ago
For people who worry about security (either sincere or tick the box types): what are the pros and cons of managed containers? It seems like you get a reduction in attack surface but also have fewer tools at your disposal
- amsully 7y agoDon't know from a Fargate perspective but Elastic Container Service (ECS) deploys EC2 servers that do not pass the CIS Benchmark. I don't believe you gain much from a security perspective.
- x3n0ph3n3 7y agoYou can roll out your own EC2 instances and Auto Scaling Group for ECS and control the security on them yourself.
- OhSoHumble 7y agoThis is incredibly true. The only requirement for an ECS cluster member is to be running the ECS agent - which is a Golang binary. You're free to run a CIS hardened image if you desire to do so.
- ed6612 7y agoThis is how we roll. CIS as base, Packer to customize (ecs agent, docker) into own AMIs.
- fovc 7y agoAre there OSS or commercial AMIs that have been hardened? Maybe some RHEL or CentOS?
- OhSoHumble 7y agoYeah, if you look at the AWS image marketplace then you'll find some.
- zo1 7y agoFor some odd reason, I find the AWS marketplace a bit suspect looking. Not saying that it is, just that that's my impression of it.
- bbgm 7y agoOne of the key things to remember about Fargate is the following. Each Fargate task has its own isolation boundary and does not share the underlying kernel, CPU resources, memory resources, or elastic network interface with another task. (Source: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/AWS_Fargate.html https://docs.aws.amazon.com/AmazonECS/latest/developerguide/...) The other part is patching. We are (I work at AWS) responsible for patching the underlying hosts. More details at https://docs.aws.amazon.com/AmazonECS/latest/developerguide/platform_versions.html https://docs.aws.amazon.com/AmazonECS/latest/developerguide/...
- nnx 7y ago> Each Fargate task has its own isolation boundary and does not share the underlying kernel, CPU resources, memory resources, or elastic network interface with another task. Isn't Lambda the same as they're both using Firecracker under the hood isn't it?
- bbgm 7y agoWith or without Firecracker the isolation models are similar.
- dodobirdlord 7y agoYes
- staticassertion 7y agoFargate solves problems like patch management, but there are other issues. If an attacker were to compromise a Fargate service they'd have less to work with, but otherwise there are a lot of advantages they'd have over EC2. On EC2 I can deploy monitoring tools like OSQuery, or rely on audit/ other OS subsystems to monitor for suspicious behavior. On Fargate I don't think anything like this is possible.
- tptacek 7y agoWhat security problem would you be addressing with osquery that Fargate doesn't already address? If you're worried that AWS is owned up, it doesn't matter which AWS service you use.
- fovc 7y agoI was thinking of this very limitation when posting the original Q. If e.g., there a RCE issue with my PHP server on Fargate, as the attacker I have a foothold and there's no monitoring inside the container as I try to move laterally. I guess the same is true with EC2 backed containers though
- tptacek 7y agoYou can instrument the container itself (the environment in which RCE against PHP would provide an attacker). You can't instrument the container engine or the host server, because AWS owns the security of those. But AWS will do a better job with those than you will, or at least, your whole usage of AWS is premised on that.