[Fargate] [request]: AppArmor support to ECS on Fargate
- Dominant language
- Shell
- Stars
- 5.4k
- Forks
- 334
- PR merge metrics
- No merged PRs in 30d
Description
### Community Note
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
**Tell us about your request**
Please add AppArmor support to ECS on Fargate.
**Which service(s) is this request for?**
Fargate, ECS
**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
For production use, runtime security is essential. Although Fargate mitigates risks at the host level, risks still exist within containers, such as running unintended processes like malware through command injection.
According to the [ECS document about Runtime security](https://docs.aws.amazon.com/AmazonECS/latest/bestpracticesguide/security-runtime.html), `dockerSecurityOptions` is not supported in Fargate.
The only feature that seems to be available in Fargate for this purpose is `ptrace`, but it is slow and not easy to use. Therefore, I would like to see AppArmor support added to Fargate.
**Are you currently working around this issue?**
No
**Additional context**
SELinux will do but AppAprmor is better as it's easy to use.
**Attachments**
None
Contributor guide
Research direction
No repository files or tests are identified. Start with the linked ECS Runtime security documentation and the Fargate/ECS context in this issue; clarify the required AppArmor or SELinux behavior and service scope. Done means the requested runtime security profile is supported on ECS for Fargate, with the behavior documented and validated.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws
- Domain
- cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100