4 ms·
I was thinking of this very limitation when posting the original Q. If e.g., there a RCE issue with my PHP server on Fargate, as the attacker I have a foothold
by fovc 7y ago
I was thinking of this very limitation when posting the original Q. If e.g., there a RCE issue with my PHP server on Fargate, as the attacker I have a foothold and there's no monitoring inside the container as I try to move laterally. I guess the same is true with EC2 backed containers though
- tptacek 7y agoYou can instrument the container itself (the environment in which RCE against PHP would provide an attacker). You can't instrument the container engine or the host server, because AWS owns the security of those. But AWS will do a better job with those than you will, or at least, your whole usage of AWS is premised on that.
- fovc 7y agoHow often do people actually instrument their containers? I guess my original premise is wrong if you can simply set up the same monitoring inside your container
- tptacek 7y agoYou can't do the same things; for instance, some container instrumentation schemes want an LKM to be resident, and that obviously won't work on Fargate. But you can generally accomplish the same goals.