Containers are increasingly popular in computing environments because they solve several common problems. They help with dependency management, environment consistency, continuous deployment, resource utilization, and environment isolation.
Amazon Web Services (AWS) provides several services that can help you deploy containerized workloads in the cloud:
Elastic Container Service: ECS is Amazon’s proprietary container orchestration service. It enables the deployment of containers using managed cloud services on server clusters.
AWS Fargate: Fargate is also an AWS proprietary container orchestration service. Fargate is a serverless version of ECS, and with Fargate, there are no underlying servers to manage.
Elastic Kubernetes Service: EKS is Amazon’s managed distribution of Kubernetes, the open-source container orchestration platform.
Several different components of the container environment need to be secured. Some of these components are common amongst all AWS container services, and some are specific to a service. The common components amongst all AWS container services are Image Security, Container Users, Secrets Management, Networking, and SSL. Only with ECS and EKS are you responsible for securing the underlying hosts (ECS and EKS worker nodes).
AWS operates on a shared responsibility model of security, where AWS is responsible for operating and securing the cloud infrastructure. Customers are responsible for operating and securing the workloads that run in the cloud. This model helps describe where the responsibility of AWS ends and the customers begin. AWS is responsible for protecting the infrastructure that runs their services in the Cloud. Customers are responsible for securing the systems and applications that run in the cloud. This also includes the responsibility for network configuration, customer data storage, data sensitivity, your company’s requirements, and applicable laws and regulations.
Summary of Key Concepts
| Security Benefit | AWS Service | Value/Risk Mitigation |
| Identity and Access | AWS IAM | Control Access to AWS Services |
| Image Scanning | Amazon Inspector | Automated continuous vulnerability assurance of container images and EC2 hosts |
| Zero Trust | Secrets Manager | Deploy containers without secrets in the images |
| Encryption | AWS KMS | Image Encryption at rest (in ECR) |
| Regulatory Compliance | AWS Audit Manager | Audit your AWS usage to simplify how you assess risk and compliance with regulations and industry standards |
| Auditing | AWS CloudTrail | Verify on authorized users perform authorized functions |
| Logging and Log Analysis | AWS Cloudwatch | Collect and visualize logs, metrics, and event data |
Explanations
AWS offers many security tools to help secure containerized workloads running in the cloud, including Amazon Inspector, AWS Security Hub, and Secrets Manager.
Many third-party security tools are available to help secure workloads running in the cloud. Examples include Synk, Clair, Prowler, and Paladin.
Identity and Access: AWS IAM
AWS IAM (Identity and Access Management) is essential for AWS container services because it provides a central method for managing access to container resources and services. This includes managing and controlling access to container clusters, task definitions, tasks, and services and granting and revoking access for individual users, groups, and applications. IAM also enables temporary security credentials to access ECS resources, allowing for more flexible and dynamic access control. Overall, IAM helps ensure the security and integrity of ECS environments while providing a scalable and flexible way to manage access and permissions.
Image Scanning: Amazon Inspector
Amazon Inspector is a security assessment service that uses automation to continuously scan for vulnerabilities in container workloads, eliminating the need for manual intervention. Inspector will inspect container images stored in AWS Elastic Container Registry (ECR). This allows for faster detection of known vulnerabilities, reducing the average time it takes for an organization to identify and resolve security threats (known as Mean Time to Remediate, or MTTR).
Zero Trust: Secrets Manager
With AWS Secrets Manager, you can securely store and manage sensitive information, such as database credentials, API keys, and other secrets. Secrets manager can be integrated into your containers workloads which helps to create a zero-trust environment by reducing the number of shared secrets. With AWS Secrets Manager, there is no need to store passwords in applications. Authorized applications can access the secrets, and access can be controlled and monitored using IAM policies and AWS CloudTrail. Additionally, AWS Secrets Manager provides encryption and rotation capabilities to enhance security and prevent potential breaches.
Encryption: AWS KMS
AWS KMS (Key Management Service) has several benefits to container workloads. Its primary utility is providing a central and secure way to manage encryption keys. This is important for container workloads because containers often need to access and store encrypted data, such as personally identifiable information (PII), passwords, keys, and other secrets. With AWS KMS, encryption keys can be centrally managed, accessed, and rotated, making it easier to ensure the security and integrity of containerized data. Additionally, AWS KMS allows hardware security modules (HSMs) to provide additional protection for keys and enables encryption policies and audits to monitor and control access to keys. KMS keys can also encrypt container images stored in AWS ECR.
Regulatory Compliance: AWS Audit Manager
AWS Audit Manager is a service that provides a centralized way to automate the compliance of workloads with regulations and industry standards. This is particularly useful to container workloads because these compliance audits can be integrated into container build pipelines, assuring only compliant workloads can be deployed. AWS Audit Manager allows organizations to create custom audit plans and workflows, assign audit tasks to team members, and it provides tools for reviewing and approving evidence, as well as generating reports and assessments.
Auditing: AWS CloudTrail
AWS CloudTrail is a service that provides visibility into AWS activity to verify that authorized users perform specific functions. This is helpful for container security because it enables organizations to track and monitor access to and usage of their containerized applications and services. For example, CloudTrail logs API calls made to the ECS and EKS APIs, allowing organizations to see who is running containers, what actions they are performing, and when they are taking place. This information can be used to identify and prevent potential security issues, such as unauthorized access or misuse of containers. Additionally, AWS CloudTrail provides tools for alerting and notification, allowing organizations to respond to potential security incidents quickly.
Logging and Log Analysis: AWS CloudWatch
AWS CloudWatch is a service that provides centralized logging, monitoring, and alerting for AWS workloads which ensures the availability and reliability of applications and services. This is helpful for container workloads because containers are ephemeral and do not retain their state after they are terminated. A common set of the state that container cluster admins need to maintain log files. CloudWatch enables the centralized and persistent storage of log files, which can be analyzed after the container has been terminated. CloudWatch also helps provide visibility into the performance and health of their containerized applications and services. It has tools for alerting and notification, allowing quick response to potential performance issues or outages.
Recommendations
The following section provides several recommendations to help you implement secure container workloads in AWS.
Containers should not run as root
Containers should not run as root because running as root gives the container access to the host system’s root user privileges, which could be used to compromise the security of the underlying host and other containers running on the host. When a container runs as root, it has unrestricted access to the host system’s resources. It can modify or delete critical system files, install malicious software, or access other containers or the host system’s network. Running containers as non-root users ensures that the container has only the permissions and access it needs to perform its intended function. This helps improve the system’s security and stability and reduce the impact of security vulnerabilities.
Run only official images
It is highly recommended to only run official base images, which are images released by a vendor. Official base images are typically more secure and reliable than unofficial images. Official base images generally are built, maintained, and supported by a vendor that ensures the images are updated with the latest security patches and updates. Unofficial images may include outdated or vulnerable components.
AWS Security Maturity Model
The AWS Security Maturity Model is a framework that provides best practices for improving the security of workloads in AWS. The AWS Security Maturity Model includes five levels of security maturity, ranging from “basic” to “innovative,” and provides recommendations and guidance for moving from one level to the next. It helps organizations understand their current level of security maturity and provides guidance on improving their security posture over time.
Several third-party tools can be used to help secure your AWS Container workloads:
Synk and Clair
Docker Scan via Synk and Clair provide vulnerability scanning and analysis for Docker images and containers. Synk uses machine learning to identify and assess potential vulnerabilities, whereas Clair uses static analysis to identify known vulnerabilities. Both tools identify potential security issues and help ensure container environments’ security and compliance. They can help organizations quickly identify and then remediate potential vulnerabilities.
Prowler and Paladin
Prowler and Paladin are Cloud Security Posture Management (CSPM) tools that provide security and compliance assessments for AWS environments. They identify and assess potential vulnerabilities in AWS accounts and services. Where Paladin uses automation with machine learning, Prowler uses automation with pre-defined checks. These tools help organizations quickly, efficiently, and continuously evaluate the security of their AWS environments. These tools provide recommendations on how to improve their security posture and help identify and address potential vulnerabilities and compliance issues.
Conclusion
In conclusion, deploying containerized workloads in AWS can be challenging from a security perspective. However, many tools are available, both from AWS and third-party vendors, that can help organizations assess and secure their containerized workloads. These tools can help improve the security and compliance of containerized applications and services and reduce the risk of potential security incidents. By implementing these tools and best practices, organizations can enhance the security of their containerized workloads in AWS.
Today’s cloud environments demand proactive, informed security. Whether you’re preparing for a compliance audit, launching a new architecture, or just looking for peace of mind, an AWS security assessment gives you a clear understanding of your risks—and how to fix them.
At The Information Systems Group, we specialize in delivering tailored AWS assessments that simplify complex environments, highlight key vulnerabilities, and provide a practical roadmap to improve your cloud security posture.