Setting up Workload Protection on AWS Fargate

Docs > Datadog Security > Workload Protection > Setting up Workload Protection > Setting up Workload Protection on AWS Fargate

Use the following instructions to enable Workload Protection.

Collecting events using Workload Protection will affect your billing. For more information, see Datadog Pricing.

Prerequisites

The Datadog AWS integration is installed and configured for your AWS accounts
Access to AWS Management Console
AWS Fargate ECS or EKS workloads

Images

On AWS Fargate, Workload Protection cannot use eBPF because Fargate does not provide access to the host kernel. The Datadog Agent alone cannot trace your application containers in this environment. In addition to the Agent, we use the cws-instrumentation image to instrument your workload with ptrace and collect runtime security events.

cws-instrumentation-init: public.ecr.aws/datadog/cws-instrumentation:latest
datadog-agent: public.ecr.aws/datadog/agent:latest

Installation

AWS Console

Sign in to AWS Management Console.
Navigate to the ECS section.
On the left menu, select Task Definitions, and then select Create new Task Definition with JSON. Alternatively, choose an existing Fargate task definition.
To create a task definition, use the Datadog ECS task patcher to patch an existing task definition automatically. Alternatively, manually author the JSON definition or use the AWS CLI method.
Click Create to create the task definition.

AWS CLI

Download datadog-agent-cws-ecs-fargate.json.

datadog-agent-cws-ecs-fargate.json

{
    "family": "<YOUR_TASK_NAME>",
    "cpu": "256",
    "memory": "512",
    "networkMode": "awsvpc",
    "pidMode": "task",
    "requiresCompatibilities": [
        "FARGATE"
    ],
    "containerDefinitions": [
        {
            "name": "cws-instrumentation-init",
            "image": "public.ecr.aws/datadog/cws-instrumentation:latest",
            "essential": false,
            "user": "0",
            "command": [
                "/cws-instrumentation",
                "setup",
                "--cws-volume-mount",
                "/cws-instrumentation-volume"
            ],
            "mountPoints": [
                {
                    "sourceVolume": "cws-instrumentation-volume",
                    "containerPath": "/cws-instrumentation-volume",
                    "readOnly": false
                }
            ]
        },
        {
            "name": "datadog-agent",
            "image": "public.ecr.aws/datadog/agent:latest",
            "essential": true,
            "environment": [
                {
                    "name": "DD_API_KEY",
                    "value": "<DD_API_KEY>"
                },
                {
                    "name": "DD_SITE",
                    "value": "datadoghq.com"
                },
                {
                    "name": "ECS_FARGATE",
                    "value": "true"
                },
                {
                    "name": "DD_RUNTIME_SECURITY_CONFIG_ENABLED",
                    "value": "true"
                },
                {
                    "name": "DD_RUNTIME_SECURITY_CONFIG_EBPFLESS_ENABLED",
                    "value": "true"
                }
            ],
            "healthCheck": {
                "command": [
                    "CMD-SHELL",
                    "/probe.sh"
                ],
                "interval": 30,
                "timeout": 5,
                "retries": 2,
                "startPeriod": 60
            }
        },
        {
            "name": "<YOUR_APP_NAME>",
            "image": "<YOUR_APP_IMAGE>",
            "entryPoint": [
                "/cws-instrumentation-volume/cws-instrumentation",
                "trace",
                "--",
                "<ENTRYPOINT>"
            ],
            "mountPoints": [
                {
                    "sourceVolume": "cws-instrumentation-volume",
                    "containerPath": "/cws-instrumentation-volume",
                    "readOnly": true
                }
            ],
            "linuxParameters": {
                "capabilities": {
                    "add": [
                        "SYS_PTRACE"
                    ]
                }
            },
            "dependsOn": [
                {
                    "containerName": "datadog-agent",
                    "condition": "HEALTHY"
                },
                {
                    "containerName": "cws-instrumentation-init",
                    "condition": "SUCCESS"
                }
            ]
        }
    ],
    "volumes": [
        {
            "name": "cws-instrumentation-volume"
        }
    ]
}

Update the following items in the JSON file:
- TASK_NAME
- DD_API_KEY
- DD_SITE
- YOUR_APP_NAME
- YOUR_APP_IMAGE
- ENTRYPOINT
You can use the following command to find the entry point of your workload:
```
docker inspect <YOUR_APP_IMAGE> -f '{{json .Config.Entrypoint}}'
```
or
```
docker inspect <YOUR_APP_IMAGE> -f '{{json .Config.Cmd}}'
```
Note: The environment variable ECS_FARGATE is already set to “true”.
Add your other application containers to the task definition. For details on collecting integration metrics, see Integration Setup for ECS Fargate.
Run the following command to register the ECS task definition:

aws ecs register-task-definition --cli-input-json file://<PATH_TO_FILE>/datadog-agent-ecs-fargate.json

Enable Vulnerability Management

In Datadog, navigate to Cloud Security > Setup > Cloud Integrations > AWS.
Enable Vulnerability Management by deploying the Datadog Agentless scanner on your AWS accounts hosting your Amazon ECR.

To collect data from your AWS Fargate pods, you must run the Agent as a sidecar of your application pod and set up Role-Based Access Control (RBAC) rules.

If the Agent is running as a sidecar, it can only communicate with containers on the same pod. Run an Agent for every pod you want to monitor.

Set up RBAC rules

Use the following Agent RBAC deployment instruction before deploying the Agent as a sidecar.

Deploy the Agent as a sidecar

The following manifest represents the minimum configuration required to deploy your application with the Datadog Agent as a sidecar with Workload Protection enabled:

apiVersion: apps/v1
kind: Deployment
metadata:
 name: "<APPLICATION_NAME>"
 namespace: default
spec:
 replicas: 1
 selector:
   matchLabels:
     app: "<APPLICATION_NAME>"
 template:
   metadata:
     labels:
       app: "<APPLICATION_NAME>"
     name: "<POD_NAME>"
   spec:
     initContainers:
     - name: cws-instrumentation-init
       image: public.ecr.aws/datadog/cws-instrumentation:latest
       command:
         - "/cws-instrumentation"
         - "setup"
         - "--cws-volume-mount"
         - "/cws-instrumentation-volume"
       volumeMounts:
         - name: cws-instrumentation-volume
           mountPath: "/cws-instrumentation-volume"
       securityContext:
         runAsUser: 0
     containers:
     - name: "<YOUR_APP_NAME>"
       image: "<YOUR_APP_IMAGE>"
       command:
         - "/cws-instrumentation-volume/cws-instrumentation"
         - "trace"
         - "--"
         - "<ENTRYPOINT>"
       volumeMounts:
         - name: cws-instrumentation-volume
           mountPath: "/cws-instrumentation-volume"
           readOnly: true
     - name: datadog-agent
       image: public.ecr.aws/datadog/agent:latest
       env:
         - name: DD_API_KEY
           value: "<DD_API_KEY>"
         - name: DD_RUNTIME_SECURITY_CONFIG_ENABLED
           value: "true"
         - name: DD_RUNTIME_SECURITY_CONFIG_EBPFLESS_ENABLED
           value: "true"
         - name: DD_EKS_FARGATE
           value: "true"
         - name: DD_CLUSTER_NAME
           value: "<CLUSTER_NAME>"
         - name: DD_KUBERNETES_KUBELET_NODENAME
           valueFrom:
             fieldRef:
               apiVersion: v1
               fieldPath: spec.nodeName
     volumes:
       - name: cws-instrumentation-volume
     serviceAccountName: datadog-agent
     shareProcessNamespace: true

Verify that the Agent is sending events to Workload Protection

Check the ruleset_loaded event

When you enable Workload Protection on AWS Fargate ECS or EKS, the Agent sends an agent event to Datadog to confirm that the default ruleset has been successfully deployed. To view the agent event, navigate to the Agent Events page in Datadog and search for @agent.rule_id:ruleset_loaded. At the right of the query, select All events instead of Security events; otherwise, ruleset_loaded events are filtered out.

Trigger a security signal

You can also verify the Agent is sending events to Workload Protection by manually triggering an AWS Fargate security signal.

In the task definition, replace the “workload” container with the following:

            "name": "cws-signal-test",
            "image": "ubuntu:latest",
            "entryPoint": [
                "/cws-instrumentation-volume/cws-instrumentation",
                "trace",
                "--verbose",
                "--",
                "/usr/bin/bash",
                "-c",
                "apt update;apt install -y curl; while true; do curl https://google.com; sleep 5; done"
            ],