aws / aws/containers-roadmap

[EKS][ECS][Fargate]: Managed SPIRE service

Open
#2,046 2 comments 27 reactions 0 assignees View on GitHub
ECS EKS Fargate Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
I would like AWS to have a managed SPIRE service that integrates with compute services like EKS, ECS and Fargate. This would simplify the issuance and validation of SPIFFE identities for workloads and infrastructure, as well as enable mTLS across compute services, platforms and environments.

**Which service(s) is this request for?**
EKS, ECS, Fargate

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Most container workloads exist in larger architectures comprising different compute environments in the cloud and on-prem. Establishing secure communication between applications in such convoluted environments is hard without a standard approach to identity issuance and validation. SPIRE enables this by creating a zero-trust foundation for communication across complex environments. However, configuring, deploying and maintaining SPIRE components such as the SPIRE Server and Data Store introduces a new layer of management and complexity. In addition to this, there are number of activities in monitoring the SPIRE lifecycle events such as attestation attempts, identity requests, issuances, and rotations, as well as registrations and de-registrations. This operational overhead is time consuming and requires a lot of planning and plumbing to secure continuously changing and complex environments.

**Are you currently working around this issue?**
Self-management with internal platform teams and partnering with dedicated teams/consultants to run and manage SPIRE.

**Additional context**
_None at this time_

**Attachments**
If you think you might have additional information that you'd like to include via an attachment, please do - we'll take a look. (Remember to remove any personally-identifiable information.)

Contributor guide

Open the contributing guide

Research direction

No repository files, tests, or entry points are identified in the issue. Start by reviewing the requested integration across EKS, ECS, and Fargate and the stated SPIRE identity and mTLS requirements. Done would require a defined managed SPIRE service addressing deployment, lifecycle monitoring, identity issuance, and rotation.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
authentication, cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.