[ECS] [runtime application self-protection agent]: develop a RASP agent for runtime protection

### Community Note

* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment

What do you want us to build?
A runtime application self protection agent (rasp) that can be embedded directly in ECS containers.

**Which service(s) is this request for?**
Fargate ECS, ECS

**Tell us about the problem you're trying to solve. What are you trying to do, and why is it hard?**
Performing dynamic, live malware, file and network analysis is an exceedingly difficult task in the year 2020 unless one has exorbitant amounts of money to spend on vendor container security platforms like Prisma or Aqua. It is difficult frankly because only Prisma or Aqua offer a rasp, whilst every other container security need can be met with native cloud vendor or open source service offerings, i.e. repos -> ECR, scanning -> ECR|Trivy|Microscanner|Clair|etc., transport control -> IAM|Docker Content Trust|Pod Policy|etc. and the list goes on; but _only_ the most expensive, best-of-breed container security products like Prisma and Aqua offer a rasp. There is no open source rasp. And this is going to force a lot of teams to either buy a very expensive best-of-breed product mainly for a rasp or go without a rasp...

**Are you currently working around this issue?**
_This problem does not have a workaround._

**Additional context**
google "open source container rasp"; you will get no results.

I'm "going for broke" here with this issue; I know it's a big ask. But all the other stuff on the roadmap is kind of elementary for any production container scheduler/repo service. A rasp would differentiate you from every other cloud provider in the world and frankly would save AWS customers tons of money.

Many might warn that, philosophically, a rasp is effectively bloatware because a) linux in general should not need "antivirus" and b) an onboard rasp will utilize precious container compute resources. These are fair arguments, but even fair arguments have fair counterarguments: many (large) enterprises require onboard dynamic security regardless of the infrastructural deployment; AWS offering a rasp would solve this _very difficult problem space._

Also please consider open sourcing this project.

Start by reviewing the ECS and Fargate context and the existing container security services named in the issue, including ECR, Trivy, Clair, IAM, and Docker Content Trust. The request is complete only when an agent can be embedded in ECS containers and provide runtime protection with live malware, file, and network analysis; no repository files or tests are identified.

Written by the indexing model from the issue text.