aws / aws/containers-roadmap

[Fargate] [request]: AppArmor support to ECS on Fargate

Open
#2,128 0 comments 16 reactions 0 assignees View on GitHub
ECS Fargate Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**
Please add AppArmor support to ECS on Fargate.

**Which service(s) is this request for?**
Fargate, ECS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
For production use, runtime security is essential. Although Fargate mitigates risks at the host level, risks still exist within containers, such as running unintended processes like malware through command injection.

According to the [ECS document about Runtime security](https://docs.aws.amazon.com/AmazonECS/latest/bestpracticesguide/security-runtime.html), `dockerSecurityOptions` is not supported in Fargate.

The only feature that seems to be available in Fargate for this purpose is `ptrace`, but it is slow and not easy to use. Therefore, I would like to see AppArmor support added to Fargate.

**Are you currently working around this issue?**
No

**Additional context**
SELinux will do but AppAprmor is better as it's easy to use.

**Attachments**
None

Contributor guide

Open the contributing guide

Research direction

No repository files or tests are identified. Start with the linked ECS Runtime security documentation and the Fargate/ECS context in this issue; clarify the required AppArmor or SELinux behavior and service scope. Done means the requested runtime security profile is supported on ECS for Fargate, with the behavior documented and validated.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.