自動ECS Fargateパッチ適用を無効化

前提条件

• TrendAI Vision One™に接続されたAmazon ECS Fargateクラスター。
• TrendAI Vision One™コンソールでECSクラスターのランタイムセキュリティが有効になっています。
• ECSタスク定義とIAMロールを作成および変更するためのIAM権限。
• コンテナイメージをプルし、CloudWatch Logsに書き込む権限を持つECSタスク実行ロール。

注意 実行ロールにlogs:CreateLogGroupの権限がない場合、タスク定義をデプロイする前にCloudWatchロググループを事前に作成してください (手順3のTerraformの例に示されているように)。

手順1: 自動パッチ適用を無効にする

手順2: 現在のコンテナイメージバージョンを取得

• CloudPdigVersion
• CloudScoutVersion
• CloudFalcoVersion

手順3: タスク定義を作成または更新

• PIDモード (タスク): セキュリティコンテナがタスク全体でアプリケーションプロセスをモニタすることを可能にします。
• 共有ボリューム (trendmicro-コンポーネント): Runtimeセキュリティコンテナが実行するバイナリをinitコンテナがコピーできるようにします。
• SYS_PTRACE機能: プロセストレースとセキュリティ監視を有効にするために、アプリケーションコンテナとセキュリティコンテナの両方に必要です。
• コンテナの依存関係: セキュリティコンテナがアプリケーションの前に正しい順序で起動することを保証します。
• 健康チェック: タスクを正常とする前にセキュリティコンポーネントが実行されていることを確認します。
• IAM権限: セキュリティコンテナがAWS Secrets ManagerおよびSSMパラメータストアから認証トークンを取得し、セキュリティイベントを報告できるようにします。

# Data sources to get current AWS region and account ID
data "aws_region" "current" {}
data "aws_caller_identity" "current" {}

# Variables
variable "log_group" {
  description = "CloudWatch log group name for ECS containers"
  type        = string
  default     = "/ecs/your-task-definition-family-name"
}

variable "cluster_name" {
  description = "Name of your existing ECS cluster"
  type        = string
  default     = "your-cluster-name"
}

variable "execution_role_arn" {
  description = "ARN of the existing ECS task execution role"
  type        = string
}

# Pre-create CloudWatch log group
resource "aws_cloudwatch_log_group" "ecs_logs" {
  name              = var.log_group
  retention_in_days = 7

  tags = {
    Name        = "ECS Task Logs"
    ManagedBy   = "Terraform"
    Application = "Vision One Container Security"
  }
}

resource "aws_ecs_task_definition" "this" {
  family                   = "your-task-definition-family-name"
  requires_compatibilities = ["FARGATE"]
  network_mode             = "awsvpc"
  cpu                      = "512"
  memory                   = "1024"

  # Task role - for runtime permissions (SSM, Secrets Manager, ECS TagResource)
  task_role_arn      = aws_iam_role.container_security_role.arn
  # Execution role - for pulling images and writing logs
  execution_role_arn = var.execution_role_arn

  # Required for Vision One Container Security
  pid_mode = "task"
  volume { name = "trendmicro-component" }

  container_definitions = jsonencode([
    # Your application container
    {
      name             = "your-app"
      image            = "your-app-image:tag"
      essential        = true

      # Application must depend on security container and have SYS_PTRACE capability
      dependsOn        = [{ condition = "START", containerName = "trendmicro-security" }]
      linuxParameters  = { capabilities = { add = ["SYS_PTRACE"] } }
      logConfiguration = {
        logDriver = "awslogs",
        options = {
          "awslogs-group" = var.log_group,
          "awslogs-create-group" = "true",
          "awslogs-region" = data.aws_region.current.id,
          "awslogs-stream-prefix" = "ecs"
        }
      }
    },

    # Vision One Container Security: Init container for PDIG
    {
      name             = "trendmicro-init-pdig"
      image            = "public.ecr.aws/trendmicro/container-security/cloud-pdig:<CloudPdigVersion>"
      essential        = false
      user             = "0"  # Required for FIPS images - runs as root to write to shared volume
      entryPoint       = ["/bin/sh"]
      command          = ["-c", "set -e; attempt=0; until [ $attempt -ge 3 ]; do attempt=$((attempt+1)); if timeout 30 sh -c 'cp -fv /usr/bin/pdig /var/TrendMicro/ && cp -fv /*.sh /var/TrendMicro/'; then exit 0; fi; sleep 2; done; exit 1"]
      mountPoints      = [{ sourceVolume = "trendmicro-component", containerPath = "/var/TrendMicro/" }]
      logConfiguration = {
        logDriver = "awslogs",
        options = {
          "awslogs-group" = var.log_group,
          "awslogs-create-group" = "true",
          "awslogs-region" = data.aws_region.current.id,
          "awslogs-stream-prefix" = "ecs"
        }
      }
    },

    # Vision One Container Security: Init container for Scout
    {
      name             = "trendmicro-init-scout"
      image            = "public.ecr.aws/trendmicro/container-security/cloud-scout:<CloudScoutVersion>"
      essential        = false
      user             = "0"  # Required for FIPS images - runs as root to write to shared volume
      entryPoint       = ["/bin/sh"]
      command          = ["-c", "set -e; attempt=0; until [ $attempt -ge 3 ]; do attempt=$((attempt+1)); if timeout 30 sh -c 'cp -fv /*.sh /var/TrendMicro/ && cp -fv /service /var/TrendMicro/ && cp -fv /ecs_entry /var/TrendMicro/ && cp -fv /MQTT_config.yaml /var/TrendMicro/ && chmod -v 755 /var/TrendMicro/*.sh'; then exit 0; fi; sleep 2; done; exit 1"]
      mountPoints      = [{ sourceVolume = "trendmicro-component", containerPath = "/var/TrendMicro/" }]
      dependsOn        = [{ condition = "SUCCESS", containerName = "trendmicro-init-pdig" }]
      logConfiguration = {
        logDriver = "awslogs",
        options = {
          "awslogs-group" = var.log_group,
          "awslogs-create-group" = "true",
          "awslogs-region" = data.aws_region.current.id,
          "awslogs-stream-prefix" = "ecs"
        }
      }
    },

    # Vision One Container Security: Runtime security container
    {
      name             = "trendmicro-security"
      image            = "public.ecr.aws/trendmicro/container-security/cloud-falco:<CloudFalcoVersion>"
      essential        = false
      user             = "0"  # Required - runs as root for PDIG and Falco operations
      entryPoint       = ["/bin/sh"]
      command          = ["-c", "cp -f /var/TrendMicro/* / && /start_ecs_fargate.sh"]

      # Environment variables - adjust VISION_ONE_ENDPOINT for your region
      environment = [
        { name = "PARAMETER_PREFIX", value = "/V1CS" },
        { name = "SPC_MODE", value = "false" },
        { name = "FILE_INTEGRITY_MONITORING", value = "true" },
        { name = "VISION_ONE_ENDPOINT", value = "<VISION_ONE_ENDPOINT>" },
        { name = "LOG_LEVEL", value = "info" }
      ]

      dependsOn        = [
        { condition = "SUCCESS", containerName = "trendmicro-init-pdig" },
        { condition = "SUCCESS", containerName = "trendmicro-init-scout" }
      ]
      mountPoints      = [{ sourceVolume = "trendmicro-component", containerPath = "/var/TrendMicro/", readOnly = true }]
      linuxParameters  = { capabilities = { add = ["SYS_PTRACE"] } }

      # Health check ensures security components are running properly
      healthCheck = {
        command     = ["CMD-SHELL", "pgrep -f falco >/dev/null && pgrep -f '/service.*grpc-socket-path' >/dev/null || exit 1"]
        interval    = 30
        timeout     = 5
        retries     = 3
        startPeriod = 60
      }
      logConfiguration = {
        logDriver = "awslogs",
        options = {
          "awslogs-group" = var.log_group,
          "awslogs-create-group" = "true",
          "awslogs-region" = data.aws_region.current.id,
          "awslogs-stream-prefix" = "ecs"
        }
      }
    }
  ])
}

# IAM role for the task
resource "aws_iam_role" "container_security_role" {
  name = "container-security-task-role"
  assume_role_policy = jsonencode({
    Version   = "2012-10-17"
    Statement = [{
      Action = "sts:AssumeRole",
      Effect = "Allow",
      Principal = { Service = "ecs-tasks.amazonaws.com" }
    }]
  })
}

# IAM policy with required permissions for Vision One Container Security
resource "aws_iam_role_policy" "container_security_role_policy" {
  name = "container-security-task-role-policy"
  role = aws_iam_role.container_security_role.id

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [
      {
        Effect   = "Allow"
        Action   = "ssm:GetParameter"
        Resource = "arn:aws:ssm:${data.aws_region.current.id}:${data.aws_caller_identity.current.account_id}:parameter/V1CS/*"
      },
      {
        Effect   = "Allow"
        Action   = "secretsmanager:GetSecretValue"
        Resource = "arn:aws:secretsmanager:${data.aws_region.current.id}:${data.aws_caller_identity.current.account_id}:secret:/V1CS/${var.cluster_name}/AuthToken-*"
      },
      {
        Effect   = "Allow"
        Action   = "ecs:TagResource"
        Resource = "arn:aws:ecs:${data.aws_region.current.id}:${data.aws_caller_identity.current.account_id}:task/*"
      },
      {
        Effect   = "Allow"
        Action   = "sqs:SendMessage",
        Resource = "arn:aws:sqs:${data.aws_region.current.id}:${data.aws_caller_identity.current.account_id}:trendmicro-container-security-*"
      }
    ]
  })
}

手順4: デプロイと検証

1. Terraform構成を適用する:

   terraform plan
   terraform apply

2. AWS ECSコンソールでタスク定義が正しく作成されていることを確認してください。
3. このタスク定義を使用してサービスをデプロイします。
4. CloudWatch Logsを確認して、すべてのコンテナが正常に起動することを確認してください。
5. TrendAI Vision One™コンソールでワークロードが表示され、セキュリティイベントが収集されていることを確認してください。

重要な情報