aws / aws/containers-roadmap

[AWS Batch] [request]: support for complete Pod and Container level securityContext from EKS Job Definitions

Open
#2,655 0 comments 0 reactions 0 assignees View on GitHub
EKS Proposed
Dominant language
Shell
Stars
5.4k
Forks
334
PR merge metrics
No merged PRs in 30d

Description

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

**Tell us about your request**

We have users that are interested in utilizing the AWS Batch integration with EKS, but the configuration options available in Job Definition today don't cover enough of the Pod spec to allow their applications to comply with our organization's security posture. Today, it appears that [only some of the fields of the container level securityContext](https://docs.aws.amazon.com/AWSCloudFormation/latest/TemplateReference/aws-properties-batch-jobdefinition-ekscontainersecuritycontext.html) are available. Please consider adding more of the fields from both the [Pod](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.33/#podsecuritycontext-v1-core) and [Container](https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.33/#securitycontext-v1-core) level fields.

For our use cases, the additional must have fields are:
- `capabilities.drop` from container
- `runAsUser` from pod (while this would be overridden by the container level field that is available, we're typically expected to set both to prevent injected containers from running without this configuration)
- `runAsNonRoot` from pod
- `runAsGroup` from pod

**Which service(s) is this request for?**
Support in AWS Batch for EKS Job Definitions

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
See above

**Are you currently working around this issue?**
Historically, our workaround has been not using AWS Batch for these types of use cases.

**Additional context**
For us to make use of this feature, it would need to be exposed via the relevant parts of the CloudFormation API.

**Attachments**
N/A

Contributor guide

Open the contributing guide

Research direction

Start with the AWS Batch for EKS Job Definitions and the related CloudFormation API areas described in the issue. Confirm how to expose container capabilities.drop and pod runAsUser, runAsNonRoot, and runAsGroup; done means these fields are supported for the requested EKS Job Definition use cases.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, kubernetes
Domain
cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.