Configurar App and API Protection para .NET en AWS Fargate

Documentos > Datadog Security > App and API Protection > Enabling App and API Protection > Enabling AAP for .NET > Configurar App and API Protection para .NET en AWS Fargate

Overview

App and API Protection leverages the Datadog .NET library to monitor and secure your .NET service. The library integrates seamlessly with your existing application without requiring code changes.

For detailed compatibility information, including supported DOTNET versions, frameworks, and deployment environments, see .NET Compatibility Requirements.

This guide explains how to set up App and API Protection (AAP) for .NET applications. The setup involves:

Installing the Datadog Agent.
Enabling App and API Protection monitoring.
Running your .NET application with the Datadog Agent.
Verifying the setup.

Requisitos previos

Entorno de AWS Fargate
Aplicación .NET en contenedores con Docker
AWS CLI configurado con los permisos adecuados
Tu clave de API Datadog
Biblioteca de rastreo .NET de Datadog (consulta requisitos de la versión)

1. Instalación del Datadog Agent

Instala el Datadog Agent en la definición de tu tarea de Fargate:

{
  "containerDefinitions": [
    {
      "name": "datadog-agent",
      "image": "public.ecr.aws/datadog/agent:latest",
      "environment": [
        {
          "name": "DD_API_KEY",
          "value": "<YOUR_API_KEY>"
        },
        {
          "name": "DD_APM_ENABLED",
          "value": "true"
        },
        {
          "name": "DD_APM_NON_LOCAL_TRAFFIC",
          "value": "true"
        }
      ]
    }
  ]
}

2. Activación de la monitorización de App and API Protection

Automatically enabling App and API Protection through Remote Configuration

You can enable remote configuration on your services dashboard. Simply check the box for the service you want to enable App and API Protection for under "Activate on your APM services".

Activación manual de la monitorización de App and API Protection

Asegúrate de que tu archivo Docker incluye la biblioteca .NET de Datadog:

# Download and install Datadog .NET Tracer
ENV DD_TRACE_VERSION=3.20.0
RUN curl -sSL https://github.com/DataDog/dd-trace-dotnet/releases/download/v${DD_TRACE_VERSION}/datadog-dotnet-apm-${DD_TRACE_VERSION}.linux-x64.tar.gz \
    | tar -xz -C /opt/datadog

# Set environment variables for Datadog automatic instrumentation
ENV CORECLR_ENABLE_PROFILING=1 \
    CORECLR_PROFILER="{846F5F1C-F9AE-4B07-969E-05C26BC060D8}" \
    CORECLR_PROFILER_PATH=/opt/datadog/Datadog.Trace.ClrProfiler.Native.so \
    DD_DOTNET_TRACER_HOME=/opt/datadog \

Rastreo de APM activado

Actualiza la definición de la tarea para incluir el agent .NET y la configuración de App and API Protection:

{
  "containerDefinitions": [
    {
      "name": "your-dotnet-app",
      "image": "your-dotnet-app-image",
      "environment": [
        {
          "name": "DD_APPSEC_ENABLED",
          "value": "true"
        },
        {
          "name": "DD_SERVICE",
          "value": "<YOUR_SERVICE_NAME>"
        },
        {
          "name": "DD_ENV",
          "value": "<YOUR_ENVIRONMENT>"
        }
      ]
    }
  ]
}

Rastreo de APM desactivado

Para deshabilitar el rastreo de APM mientras se mantiene habilitada App and API Protection, debes establecer la variable de rastreo de APM en false (falso).

Actualiza la definición de la tarea para incluir el agent .NET y la configuración de App and API Protection con el rastreo de APM desactivado:

{
  "containerDefinitions": [
    {
      "name": "your-dotnet-app",
      "image": "your-dotnet-app-image",
      "environment": [
        {
          "name": "DD_APPSEC_ENABLED",
          "value": "true"
        },
        {
          "name": "DD_APM_TRACING_ENABLED",
          "value": "false"
        },
        {
          "name": "DD_SERVICE",
          "value": "<YOUR_SERVICE_NAME>"
        },
        {
          "name": "DD_ENV",
          "value": "<YOUR_ENVIRONMENT>"
        }
      ]
    }
  ]
}

3. Ejecuta tu aplicación

Despliega tu tarea de Fargate con la configuración actualizada:

aws ecs register-task-definition --cli-input-json file://task-definition.json
aws ecs run-task --cluster your-cluster --task-definition your-task-definition