Security

Best Practices
for
Containers
Importance of Container Security on AWS
Overview
Containers are becoming increasingly popular for building and deploying applications on
AWS. They provide a lightweight, portable and consistent environment for running
applications, which makes them a great choice for microservices, cloud-native applications
and continuous integration/continuous delivery (CI/CD) pipelines.

However, as with any technology, containers also bring their own set of security challenges.
Containers share the host operating system and kernel, which means that vulnerabilities in
the host can also affect the containers. Additionally, containers can be easily moved between
hosts, which makes it difficult to maintain consistent security policies.

Therefore, it is important to implement best practices and security controls to protect

containerized applications on AWS. This includes securing the container images, the host
operating system, and the network and runtime environment. Implementing these security
controls can help prevent unauthorized access, data breaches, and other security threats.

Overall, Container security on AWS is crucial to ensure the integrity and safety of the
application, as well as the data and resources that the application uses. This is especially
important for applications that handle sensitive data or are exposed to the internet.
Popular Container Services on AWS
Amazon ECS: Built-in security features:
Amazon Elastic Container Service (ECS) is a fully 1. IAM Roles for Service Accounts: ECS and EKS both use IAM roles to
provide permissions to the resources that the service uses. This allows
managed service provided by AWS for running
you to grant least privilege access to your resources and helps to
containerized applications. It allows you to easily
prevent unauthorized access.
run, scale, and orchestrate containerized 2. Automatic security group management: Both services automatically
applications using Docker and AWS infrastructure. manage security groups for the resources they create. This includes
ECS can be used to deploy and manage creating and managing security groups for the container instances
and load balancers, which helps to control ingress and egress traffic
applications on EC2 or AWS Fargate, which is a
to your containerized applications.
serverless compute engine for containers.
3. Network isolation: ECS and EKS both provide network isolation,
which helps to protect your containerized applications from
Amazon EKS:
unauthorized access and data breaches.
Amazon Elastic Kubernetes Service (EKS) is a fully 4. Automatic patching: ECS and EKS will automatically patch the
managed service provided by AWS for running underlying infrastructure to keep it up to date with the latest security
Kubernetes clusters. It allows you to easily run, updates.
5. Monitoring and logging: ECS and EKS both provide built-in
scale, and orchestrate containerized applications
monitoring and logging capabilities. This allows you to monitor the
using Kubernetes and AWS infrastructure.
performance and troubleshoot issues with your containerized
applications.
 Best
Practices
 Use Amazon Elastic Container Registry (ECR)
Amazon Elastic Container Registry (ECR) is a fully managed container registry service provided by AWS for storing, managing, and deploying container

images. It allows you to store, manage, and deploy Docker images on AWS.

Using ECR can help improve the security of your containerized applications on AWS by providing the following features:

1. Authentication and Authorization: ECR uses IAM for authentication and authorization. This allows you to control who can access your container images and

what actions they can perform.

2. Image Scanning: ECR integrates with Amazon Inspector for image scanning. This allows you to automatically scan your container images for vulnerabilities

and malware.

3. Image Signing: ECR supports image signing and scanning for image authenticity. This ensures that the images you deploy have not been tampered with and

come from a trusted source.

4. Image Immutability: ECR allows you to make an image repository immutable. This means that once an image is pushed to the repository, it cannot be

deleted or overwritten. This helps to prevent malicious actors from modifying or tampering with your container images.

5. Image Management: ECR allows you to manage container images throughout their lifecycle. This includes the ability to delete images, set image retention

policies, and monitor image usage.

By using ECR, you can improve the security of your containerized applications by authenticating and authorizing access to your container images, automatically

scanning for vulnerabilities, ensuring image authenticity, protecting images from tampering, and managing images throughout their lifecycle. Additionally, you

can also use ECR with ECS or EKS for deploying and running containerized applications in a secure way.
 Use IAM Roles
Using IAM roles is an important security best practice for containerized applications on AWS. IAM roles allow you to grant least privilege access to yo

AWS resources and help to prevent unauthorized access.

Here are a few ways in which IAM roles can be used to secure containerized applications on AWS:

1. Granting access to resources: IAM roles can be used to grant access to specific resources such as ECR repositories, S3 buckets, and CloudWatch logs. T

allows you to control which resources your containerized applications can access and what actions they can perform on those resources.

2. Running tasks with IAM roles: Amazon ECS and Amazon EKS can use IAM roles for tasks and pods, which allows you to grant permissions to the resourc

that the containerized application uses. This helps to prevent unauthorized access to resources and helps to enforce the least privilege access.

3. Enabling cross-account access: IAM roles can be used to enable cross-account access between different AWS accounts. This allows you to share resourc

across accounts in a secure way without sharing credentials.

4. Managing access to AWS services: IAM roles can be used to manage access to AWS services such as AWS Fargate, Elastic Block Store (EBS), and Elas

File System (EFS). This allows you to control which services your containerized applications can access and what actions they can perform on those service

5. Using IAM roles for EC2 instances: IAM roles can be assigned to EC2 instances, which allows you to grant permissions to the resources that the instanc

use. This can be useful when running containerized applications on EC2 instances, as it allows you to grant the least privilege access to the instances a

their associated resources.

 Use network segmentation and security groups
Using network segmentation and security groups is an important security best practice for containerized applications on AWS. Network segmentation allows

you to divide your network into smaller, isolated segments, which can help to limit the scope of a security incident and prevent unauthorized access. Security

groups allow you to control incoming and outgoing traffic to and from your resources, which can help to prevent unauthorized access and network-based

attacks.

Here are a few ways in which network segmentation and security groups can be used to secure containerized applications on AWS:

1. Isolate container networks: By using network segmentation, you can isolate the network traffic of your containerized applications from other parts of your

network. This can help to prevent unauthorized access and limit the scope of a security incident.

2. Control incoming and outgoing traffic: Security groups can be used to control incoming and outgoing traffic to and from your resources. This can help to prevent

unauthorized access and network-based attacks.

3. Limit access to specific ports: Security groups can be used to limit access to specific ports on your resources. This can help to prevent unauthorized access and

network-based attacks.

4. Use VPC endpoint for ECR: By using the Amazon VPC endpoint for Amazon Elastic Container Registry (ECR) you can route the traffic to ECR directly within the

Amazon VPC, without using the Internet. This can help to improve the security of your container images and prevent unauthorized access.

5. Implement Network Access Control Lists (NACLs) to further granularly control traffic to and from your VPC.

Implementing network segmentation and security groups can help to improve the security of your containerized applications on AWS by controlling access to your

resources and limiting the scope of security incidents.

 Use Amazon CloudWatch Container Insights
Using Amazon CloudWatch Container Insights is an important security best practice for containerized applications on AWS. CloudWatch Container Insights

allows you to monitor and troubleshoot your containerized applications, which can help to detect and prevent security incidents.

Here are a few ways in which CloudWatch Container Insights can be used to secure containerized applications on AWS:

1. Monitor container performance: CloudWatch Container Insights allows you to monitor the performance of your containerized applications, which can help to

detect and prevent performance issues.

2. Collect and analyze log data: CloudWatch Container Insights allows you to collect and analyze log data from your containerized applications, which can help to

detect and troubleshoot security incidents.

3. Monitor resource usage: CloudWatch Container Insights allows you to monitor the resource usage of your containerized applications, which can help to detect and

prevent resource starvation.

4. Set up alarms for threshold breaches: CloudWatch Container Insights allows you to set up alarms for threshold breaches, which can help to detect and prevent

security incidents.

5. Monitor the ECS task and service health, this can help to detect and prevent security incidents.

By using CloudWatch Container Insights, you can gain visibility into the performance and resource usage of your containerized applications, which can help to

detect and prevent security incidents. This allows you to monitor your application's behavior in real-time and take action if any unexpected behavior is detected.
 Keep images and host OS patched
Keeping images and host OS patched is an important security best practice for containerized applications on AWS. Keeping images and host OS

patched can help to prevent vulnerabilities and security incidents.

Here are a few ways in which keeping images and host OS patched can be used to secure containerized applications on AWS:

1. Update container images: By updating container images to the latest versions, you can ensure that your applications are running on the most recent,

secure version of the software. This can help to prevent vulnerabilities and security incidents.

2. Patch host OS: By patching the host OS, you can ensure that your applications are running on a secure, up-to-date operating system. This can help

to prevent vulnerabilities and security incidents.

3. Automate image updates: By automating image updates, you can ensure that your container images are always up to date and running on the most

recent, secure version of the software.

4. Use ECR Image Scanning, this allows you to automatically check for known vulnerabilities in your images, you can configure your registry to block

the images that have high or critical vulnerabilities from being pushed or pulled.

5. Use automated security scanning tools to scan for vulnerabilities in your images.

By keeping images and host OS patched, you can ensure that your containerized applications are running on a secure, up-to-date software stack,

which can help to prevent vulnerabilities and security incidents. This can also help to keep your infrastructure updated and more secure.
 Use Secrets Management
Using secrets management is an important security best practice for containerized applications on AWS. Secrets management allows you to

securely store, manage, and rotate sensitive information such as passwords, keys, and certificates.

Here are a few ways in which secrets management can be used to secure containerized applications on AWS:

1. Use a secrets manager: AWS Secrets Manager allows you to securely store and manage sensitive information such as passwords, keys, and

certificates. This can help to prevent sensitive information from being stored in plaintext and help reduce the risk of security incidents.

2. Rotate secrets: By rotating secrets regularly, you can ensure that your sensitive information is always up-to-date and that any compromised secrets

are quickly replaced.

3. Use IAM roles to control access to secrets: By using IAM roles, you can control access to sensitive information stored in AWS Secrets Manager. This

can help to prevent unauthorized access and reduce the risk of security incidents.

4. Use encrypted environment variables: to store sensitive data, such as database credentials.

5. Use AWS Secrets Manager and Parameter Store to store and manage your containerized application's secrets, this allows you to manage access to

your secrets and rotate them automatically, reducing the risk of security incidents.

By using secrets management, you can securely store, manage, and rotate sensitive information, which can help to prevent security incidents and

protect sensitive data from unauthorized access.

 Perform Security Scans Regularly
Performing security scans is an important security best practice for containerized applications on AWS. Security scans can help to identify

vulnerabilities in your containerized applications and provide guidance on how to remediate them.

Here are a few ways in which security scans can be used to secure containerized applications on AWS:

1. Use Amazon Inspector: Amazon Inspector is an automated security assessment service that helps you to identify vulnerabilities in your containerized

applications and provides guidance on how to remediate them.

2. Use AWS Container Security: AWS Container Security is a service that helps you to identify vulnerabilities in your container images and provides

guidance on how to remediate them.

3. Use AWS Security Hub: AWS Security Hub is a service that aggregates security findings from multiple AWS services, including Amazon Inspector and

AWS Container Security, and provides a central view of your security posture.

4. Use third-party tools: There are also several third-party security scanning tools, such as Aqua Security, Snyk, and Qualys, that can be used to scan your

containerized applications for vulnerabilities.

5. Use Amazon Elastic Container Registry (ECR) Image Scanning: ECR Image Scanning automatically scans your container images stored in ECR for

vulnerabilities and security best practices.

By performing security scans, you can identify vulnerabilities in your containerized applications and provide guidance on how to remediate them,

which can help to prevent security incidents and protect your containerized applications from attacks.
Thanks for attending
the session :)
In conclusion, securing containerized applications on AWS is
essential for protecting your data and infrastructure.

It is important to keep in mind that security is a process that

requires continuous monitoring and improvement, so it is
essential to regularly review and update your security practices
and stay informed about new threats and vulnerabilities.

By following these best practices and utilizing the security

features provided by AWS, you can help protect your
containerized applications from threats and ensure the security
of your data and infrastructure.

Follow on:
Sandip Das

@LearnTechWithSandip