Amazon ECS and Fargate

Discover containers running on Amazon ECS and AWS Fargate and scan their images for vulnerabilities, without installing an agent.

Overview

RAD Security discovers containers running on Amazon ECS through your AWS connection and scans their images for vulnerabilities. Nothing runs inside your tasks and nothing needs to be installed in your clusters.

Launch types: Fargate and EC2 tasks are both covered.
Regions: tasks are discovered in every region of each connected AWS account.
Images: RAD Security pulls each image once per digest, generates an SBOM and scans it. Images from Amazon ECR need the ECR pull permission described below; public images (for example Docker Hub or Amazon ECR Public) need no extra setup.

Prerequisites

The AWS accounts running your ECS tasks are connected to RAD Security. See AWS.
Version 0.11.0 or later of the rad-security-connect Terraform module, to grant the ECR pull permission.

Allow RAD Security to pull images from ECR

Enable ECR image pull in the Terraform module

Set enable_ecr_image_pull = true in the rad-security-connect module of every account that stores images in ECR. This attaches a rad-security-ecr-image-pull policy to the rad-security-connect role.

module "rad-security-connect" {
  source  = "rad-security/rad-security-connect/aws"
  version = ">= 0.11.0"

  enable_ecr_image_pull = true

  # Optional: limit pulls to selected repositories (defaults to all repositories)
  # ecr_repository_arns = [
  #   "arn:aws:ecr:us-west-2:111122223333:repository/my-service",
  #   "arn:aws:ecr:us-west-2:111122223333:repository/team-a/*",
  # ]
}

The policy is created only where secondary_region is false, as IAM is global.

Apply the configuration

Run terraform apply in each account. Accounts that are already connected keep their connection; only the policy is added.

The policy allows only these actions:

Action	Resource
`ecr:GetAuthorizationToken`	`*`
`ecr:BatchGetImage`	`ecr_repository_arns` (all repositories by default)
`ecr:GetDownloadUrlForLayer`	`ecr_repository_arns` (all repositories by default)

Images in a central ECR account

If your tasks run images from an ECR registry in another AWS account, use one of these options:

Connect the registry account (recommended): connect the account that owns the registry to RAD Security with enable_ecr_image_pull = true. RAD Security pulls the images with that account's role.
Allow the running accounts in the repository policy: grant ecr:BatchGetImage and ecr:GetDownloadUrlForLayer to the rad-security-connect role of each account running the tasks, for example arn:aws:iam::111122223333:role/rad-security-connect.

What you'll see

Containers: under Data Sources → Asset Inventory → Containers, each container of a running task appears with its ECS cluster, service (or task definition family for standalone tasks), launch type and region. The platform is shown as Amazon ECS.
Images: under Data Sources → Asset Inventory → Images, ECS images appear next to your Kubernetes images, with their SBOM, packages and vulnerabilities. The image details page lists where each image runs.

How it works

Stage	Timing
Discovery of running tasks	Every cloud sync of the AWS account (every 6 hours)
Image pull and SBOM generation	A few minutes after a new image digest is discovered
Vulnerability scan	Within about 2 hours of SBOM generation
Removal of stopped containers	After two cloud syncs in which the task is no longer running

Each image digest is pulled once, even if it runs in many tasks or accounts. A new deployment with a new digest is scanned as soon as it is discovered.

Limitations

Containers without an image digest are skipped. This includes containers that have not finished pulling their image, and sidecars AWS injects without a digest, such as the GuardDuty Runtime Monitoring agent when it fails to start.
For multi-architecture images, the linux/amd64 variant is scanned.
Private registries other than Amazon ECR are not supported.

Troubleshooting

Next Steps

AWS

Connect AWS accounts to RAD Security

Connect using Terraform

Automate cloud connections with Terraform

Was this page helpful?