--- title: Setting up Workload Protection on AWS Fargate description: Enable Workload Protection on AWS Fargate ECS and EKS workloads. breadcrumbs: >- Docs > Datadog Security > Workload Protection > Setting up Workload Protection > Setting up Workload Protection on AWS Fargate --- > For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt). # Setting up Workload Protection on AWS Fargate Use the following instructions to enable Workload Protection. {% alert level="info" %} Collecting events using Workload Protection will affect your billing. For more information, see [Datadog Pricing](https://www.datadoghq.com/pricing/?product=cloud-security-management#products). {% /alert %} ## Prerequisites{% #prerequisites %} - The Datadog AWS integration is installed and configured for your AWS accounts - Access to AWS Management Console - AWS Fargate ECS or EKS workloads ## Images{% #images %} On AWS Fargate, Workload Protection cannot use eBPF because Fargate does not provide access to the host kernel. The Datadog Agent alone cannot trace your application containers in this environment. In addition to the Agent, we use the `cws-instrumentation` image to instrument your workload with ptrace and collect runtime security events. - `cws-instrumentation-init`: `public.ecr.aws/datadog/cws-instrumentation:latest` - `datadog-agent`: `public.ecr.aws/datadog/agent:latest` ## Installation{% #installation %} {% tab title="Amazon ECS" %} ### AWS Console{% #aws-console %} 1. Sign in to [AWS Management Console](https://aws.amazon.com/console). 1. Navigate to the ECS section. 1. On the left menu, select **Task Definitions**, and then select **Create new Task Definition with JSON**. Alternatively, choose an existing Fargate task definition. 1. To create a task definition, use the [Datadog ECS task patcher](https://github.com/DataDog/datadog-agent-ecs-task-patcher) to patch an existing task definition automatically. Alternatively, manually author the JSON definition or use the AWS CLI method. 1. Click **Create** to create the task definition. ### AWS CLI{% #aws-cli %} 1. Download [datadog-agent-cws-ecs-fargate.json](https://docs.datadoghq.com/resources/json/datadog-agent-cws-ecs-fargate.json.md). In the `datadog-agent-cws-ecs-fargate.json` file: ```json { "family": "", "cpu": "256", "memory": "512", "networkMode": "awsvpc", "pidMode": "task", "requiresCompatibilities": [ "FARGATE" ], "containerDefinitions": [ { "name": "cws-instrumentation-init", "image": "public.ecr.aws/datadog/cws-instrumentation:latest", "essential": false, "user": "0", "command": [ "/cws-instrumentation", "setup", "--cws-volume-mount", "/cws-instrumentation-volume" ], "mountPoints": [ { "sourceVolume": "cws-instrumentation-volume", "containerPath": "/cws-instrumentation-volume", "readOnly": false } ] }, { "name": "datadog-agent", "image": "public.ecr.aws/datadog/agent:latest", "essential": true, "environment": [ { "name": "DD_API_KEY", "value": "" }, { "name": "DD_SITE", "value": "datadoghq.com" }, { "name": "ECS_FARGATE", "value": "true" }, { "name": "DD_RUNTIME_SECURITY_CONFIG_ENABLED", "value": "true" }, { "name": "DD_RUNTIME_SECURITY_CONFIG_EBPFLESS_ENABLED", "value": "true" } ], "healthCheck": { "command": [ "CMD-SHELL", "/probe.sh" ], "interval": 30, "timeout": 5, "retries": 2, "startPeriod": 60 } }, { "name": "", "image": "", "entryPoint": [ "/cws-instrumentation-volume/cws-instrumentation", "trace", "--", "" ], "mountPoints": [ { "sourceVolume": "cws-instrumentation-volume", "containerPath": "/cws-instrumentation-volume", "readOnly": true } ], "linuxParameters": { "capabilities": { "add": [ "SYS_PTRACE" ] } }, "dependsOn": [ { "containerName": "datadog-agent", "condition": "HEALTHY" }, { "containerName": "cws-instrumentation-init", "condition": "SUCCESS" } ] } ], "volumes": [ { "name": "cws-instrumentation-volume" } ] } ``` Update the following items in the JSON file: - `TASK_NAME` - `DD_API_KEY` - `DD_SITE` - `YOUR_APP_NAME` - `YOUR_APP_IMAGE` - `ENTRYPOINT` You can use the following command to find the entry point of your workload: ```shell docker inspect -f '{{json .Config.Entrypoint}}' ``` or ```shell docker inspect -f '{{json .Config.Cmd}}' ``` **Note**: The environment variable `ECS_FARGATE` is already set to "true". Add your other application containers to the task definition. For details on collecting integration metrics, see [Integration Setup for ECS Fargate](https://docs.datadoghq.com/integrations/faq/integration-setup-ecs-fargate.md?tab=rediswebui). Run the following command to register the ECS task definition: ```shell aws ecs register-task-definition --cli-input-json file:///datadog-agent-ecs-fargate.json ``` ### Enable Vulnerability Management{% #enable-vulnerability-management %} 1. In Datadog, navigate to [Cloud Security > Setup > Cloud Integrations > AWS](https://app.datadoghq.com/security/configuration/csm/setup?active_steps=cloud-accounts&active_sub_step=aws&vuln_container_enabled=true&vuln_host_enabled=true&vuln_lambda_enabled=true). 1. Enable Vulnerability Management by deploying the [Datadog Agentless scanner](https://docs.datadoghq.com/security/cloud_security_management/setup/agentless_scanning/enable.md?tab=existingawsaccount#set-up-aws-cloudformation) on your AWS accounts hosting your Amazon ECR. {% /tab %} {% tab title="Amazon EKS" %} To collect data from your AWS Fargate pods, you must run the Agent as a sidecar of your application pod and set up Role-Based Access Control (RBAC) rules. {% alert level="info" %} If the Agent is running as a sidecar, it can only communicate with containers on the same pod. Run an Agent for every pod you want to monitor. {% /alert %} ### Set up RBAC rules{% #set-up-rbac-rules %} Use the following [Agent RBAC deployment instruction](https://docs.datadoghq.com/integrations/eks_fargate.md?tab=manual#amazon-eks-fargate-rbac) before deploying the Agent as a sidecar. ### Deploy the Agent as a sidecar{% #deploy-the-agent-as-a-sidecar %} The following manifest represents the minimum configuration required to deploy your application with the Datadog Agent as a sidecar with Workload Protection enabled: ```yaml apiVersion: apps/v1 kind: Deployment metadata: name: "" namespace: default spec: replicas: 1 selector: matchLabels: app: "" template: metadata: labels: app: "" name: "" spec: initContainers: - name: cws-instrumentation-init image: public.ecr.aws/datadog/cws-instrumentation:latest command: - "/cws-instrumentation" - "setup" - "--cws-volume-mount" - "/cws-instrumentation-volume" volumeMounts: - name: cws-instrumentation-volume mountPath: "/cws-instrumentation-volume" securityContext: runAsUser: 0 containers: - name: "" image: "" command: - "/cws-instrumentation-volume/cws-instrumentation" - "trace" - "--" - "" volumeMounts: - name: cws-instrumentation-volume mountPath: "/cws-instrumentation-volume" readOnly: true - name: datadog-agent image: public.ecr.aws/datadog/agent:latest env: - name: DD_API_KEY value: "" - name: DD_RUNTIME_SECURITY_CONFIG_ENABLED value: "true" - name: DD_RUNTIME_SECURITY_CONFIG_EBPFLESS_ENABLED value: "true" - name: DD_EKS_FARGATE value: "true" - name: DD_CLUSTER_NAME value: "" - name: DD_KUBERNETES_KUBELET_NODENAME valueFrom: fieldRef: apiVersion: v1 fieldPath: spec.nodeName volumes: - name: cws-instrumentation-volume serviceAccountName: datadog-agent shareProcessNamespace: true ``` {% /tab %} ## Verify that the Agent is sending events to Workload Protection{% #verify-that-the-agent-is-sending-events-to-workload-protection %} ### Check the ruleset_loaded event{% #check-the-ruleset_loaded-event %} When you enable Workload Protection on AWS Fargate ECS or EKS, the Agent sends an agent event to Datadog to confirm that the default ruleset has been successfully deployed. To view the agent event, navigate to the [Agent Events](https://app.datadoghq.com/security/agent-events) page in Datadog and search for `@agent.rule_id:ruleset_loaded`. At the right of the query, select All events instead of Security events; otherwise, `ruleset_loaded` events are filtered out. ### Trigger a security signal{% #trigger-a-security-signal %} You can also verify the Agent is sending events to Workload Protection by manually triggering an AWS Fargate security signal. In the task definition, replace the "workload" container with the following: ```json "name": "cws-signal-test", "image": "ubuntu:latest", "entryPoint": [ "/cws-instrumentation-volume/cws-instrumentation", "trace", "--verbose", "--", "/usr/bin/bash", "-c", "apt update;apt install -y curl; while true; do curl https://google.com; sleep 5; done" ], ```