DEV Community

Maureen Chebet
Maureen Chebet

Posted on

Securing Container Lifecycle on AWS: From Build to Runtime

#containers #docker #ecr #ecs

The Security Wake-Up Call

Your containerized applications are under scrutiny. Security scans have revealed critical issues:

  • Base images with known vulnerabilities (CVE-2023-XXXX, CVE-2024-XXXX)
  • Runtime secrets exposed in image layers (API keys, passwords visible in image history)
  • No image signing or verification (anyone can push malicious images)
  • Compliance gaps for financial services (PCI-DSS, SOC 2 requirements not met)

This isn't just about fixing a few Dockerfiles. You need to secure the entire container lifecycle: build, registry, deployment, and runtime.

In this article, I'll walk through a comprehensive container security strategy on AWS that addresses vulnerabilities, implements secrets management, enables image signing, enforces runtime security, and automates compliance.

Container Security Lifecycle

The Four Pillars 

┌─────────────┐ ┌──────────────┐ ┌─────────────┐ ┌──────────────┐ │ BUILD │ → │ REGISTRY │ → │ DEPLOYMENT │ → │ RUNTIME │ │ │ │ │ │ │ │ │ │ Secure base │ │ Image scan │ │ Policy │ │ Least │ │ Multi-stage │ │ Signing │ │ validation │ │ privilege │ │ No secrets │ │ Access │ │ RBAC │ │ Isolation │ └─────────────┘ └──────────────┘ └─────────────┘ └──────────────┘
Enter fullscreen mode Exit fullscreen mode

Phase 1: Secure Base Images and Minimal Attack Surface

The Problem: Vulnerable Base Images

Many Dockerfiles start with:

FROM ubuntu:latest # or FROM node:latest
Enter fullscreen mode Exit fullscreen mode

These base images often contain:

  • Unnecessary packages and tools
  • Known vulnerabilities
  • Large attack surface
  • Outdated packages

Solution: Minimal, Trusted Base Images

Option 1: Use Distroless Images

# Before: Vulnerable base image FROM node:18 COPY . . RUN npm install CMD ["node", "app.js"] # After: Distroless base image FROM node:18-slim AS builder WORKDIR /app COPY package*.json ./ RUN npm ci --only=production FROM gcr.io/distroless/nodejs18-debian11 WORKDIR /app COPY --from=builder /app/node_modules ./node_modules COPY --from=builder /app . USER nonroot:nonroot CMD ["app.js"]
Enter fullscreen mode Exit fullscreen mode

Benefits:

  • No shell, no package manager (reduces attack surface)
  • Minimal OS footprint
  • Only runtime dependencies

Option 2: Alpine Linux

FROM alpine:3.18 AS builder RUN apk add --no-cache nodejs npm WORKDIR /app COPY package*.json ./ RUN npm ci --only=production FROM alpine:3.18 RUN apk add --no-cache nodejs WORKDIR /app COPY --from=builder /app/node_modules ./node_modules COPY --from=builder /app . RUN addgroup -g 1001 -S nodejs && \  adduser -S nodejs -u 1001 USER nodejs:nodejs CMD ["node", "app.js"]
Enter fullscreen mode Exit fullscreen mode

Option 3: AWS-Optimized Base Images

# Use AWS-provided base images FROM public.ecr.aws/lambda/nodejs:18 # or FROM public.ecr.aws/docker/library/node:18-slim
Enter fullscreen mode Exit fullscreen mode

Multi-Stage Build Best Practices

Secure Multi-Stage Build:

# Stage 1: Build dependencies FROM node:18-slim AS deps WORKDIR /app # Copy only package files first (better layer caching) COPY package*.json ./ # Install dependencies with security flags RUN npm ci --only=production --ignore-scripts && \  npm audit --audit-level=moderate && \  rm -rf /tmp/* /var/tmp/* # Stage 2: Build application FROM node:18-slim AS builder WORKDIR /app COPY --from=deps /app/node_modules ./node_modules COPY . . # Build with security hardening RUN npm run build && \  npm prune --production && \  rm -rf /tmp/* /var/tmp/* # Stage 3: Runtime (minimal) FROM gcr.io/distroless/nodejs18-debian11:nonroot WORKDIR /app # Copy only production artifacts COPY --from=builder --chown=nonroot:nonroot /app/dist ./dist COPY --from=builder --chown=nonroot:nonroot /app/node_modules ./node_modules COPY --from=builder --chown=nonroot:nonroot /app/package.json ./ # No secrets, no build tools, no shell EXPOSE 8080 CMD ["dist/index.js"]
Enter fullscreen mode Exit fullscreen mode

Base Image Vulnerability Scanning

Pre-Build Base Image Check:

#!/bin/bash # check-base-image.sh BASE_IMAGE=$1 if [ -z "$BASE_IMAGE" ]; then echo "Usage: $0 <base-image>" exit 1 fi echo "Scanning base image: $BASE_IMAGE" # Use Trivy to scan base image trivy image --severity HIGH,CRITICAL --exit-code 1 "$BASE_IMAGE" if [ $? -eq 0 ]; then echo "Base image passed security scan" exit 0 else echo "Base image has critical vulnerabilities" exit 1 fi
Enter fullscreen mode Exit fullscreen mode

Integrate into CI/CD:

# .github/workflows/docker-build.yml name: Build and Scan on: push: branches: [main] jobs: check-base-image: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Check base image run: | BASE_IMAGE=$(grep '^FROM' Dockerfile | head -1 | awk '{print $2}') ./check-base-image.sh "$BASE_IMAGE" build: needs: check-base-image runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - name: Build Docker image run: docker build -t payment-app:latest .
Enter fullscreen mode Exit fullscreen mode

Automated Base Image Updates

Dependabot for Docker:

# .github/dependabot.yml version: 2 updates: - package-ecosystem: "docker" directory: "/" schedule: interval: "weekly" open-pull-requests-limit: 10
Enter fullscreen mode Exit fullscreen mode

Phase 2: Secrets Management (Not in Images)

The Problem: Secrets in Image Layers

Common Anti-Pattern:

# NEVER DO THIS FROM node:18 ENV DB_PASSWORD=mysecretpassword123 ENV API_KEY=sk_live_1234567890 COPY . . RUN npm install CMD ["node", "app.js"]
Enter fullscreen mode Exit fullscreen mode

Why This is Dangerous:

  • Secrets are visible in image history: docker history <image>
  • Secrets are in image layers (even if removed in later layers)
  • Anyone with image access can extract secrets
  • Secrets are in version control (if Dockerfile is committed)

Solution: AWS Secrets Manager Integration

Secure Dockerfile:

FROM node:18-slim AS builder WORKDIR /app COPY package*.json ./ RUN npm ci --only=production FROM gcr.io/distroless/nodejs18-debian11:nonroot WORKDIR /app COPY --from=builder /app/node_modules ./node_modules COPY --from=builder /app . # No secrets in image! # Secrets will be injected at runtime via environment variables # or mounted volumes from AWS Secrets Manager EXPOSE 8080 CMD ["app.js"]
Enter fullscreen mode Exit fullscreen mode

Application Code - Fetching Secrets:

// app.js const AWS = require('aws-sdk'); const secretsManager = new AWS.SecretsManager({ region: process.env.AWS_REGION }); async function getSecret(secretName) { try { const data = await secretsManager.getSecretValue({ SecretId: secretName }).promise(); return JSON.parse(data.SecretString); } catch (error) { console.error(`Error retrieving secret ${secretName}:`, error); throw error; } } // Fetch secrets at startup let dbCredentials; async function initializeSecrets() { dbCredentials = await getSecret('payment-app/database/credentials'); process.env.DB_HOST = dbCredentials.host; process.env.DB_USER = dbCredentials.username; process.env.DB_PASSWORD = dbCredentials.password; } initializeSecrets().then(() => { // Start application app.listen(8080); });
Enter fullscreen mode Exit fullscreen mode

ECS Task Definition with Secrets:

{ "family": "payment-app", "containerDefinitions": [ { "name": "payment-app", "image": "123456789.dkr.ecr.us-east-1.amazonaws.com/payment-app:latest", "secrets": [ { "name": "DB_PASSWORD", "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789:secret:payment-app/database/credentials:password::" }, { "name": "API_KEY", "valueFrom": "arn:aws:secretsmanager:us-east-1:123456789:secret:payment-app/api-key::" } ], "environment": [ { "name": "AWS_REGION", "value": "us-east-1" } ] } ], "taskRoleArn": "arn:aws:iam::123456789:role/ecs-task-role", "executionRoleArn": "arn:aws:iam::123456789:role/ecs-execution-role" }
Enter fullscreen mode Exit fullscreen mode

IAM Role for Secrets Access:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "secretsmanager:GetSecretValue", "secretsmanager:DescribeSecret" ], "Resource": [ "arn:aws:secretsmanager:us-east-1:123456789:secret:payment-app/*" ] }, { "Effect": "Allow", "Action": [ "kms:Decrypt" ], "Resource": [ "arn:aws:kms:us-east-1:123456789:key/secrets-key-id" ], "Condition": { "StringEquals": { "kms:ViaService": "secretsmanager.us-east-1.amazonaws.com" } } } ] }
Enter fullscreen mode Exit fullscreen mode

Kubernetes Secrets (If Using EKS)

External Secrets Operator:

# external-secret.yaml apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: payment-app-secrets spec: refreshInterval: 1h secretStoreRef: name: aws-secrets-manager kind: SecretStore target: name: payment-app-secrets creationPolicy: Owner data: - secretKey: db-password remoteRef: key: payment-app/database/credentials property: password - secretKey: api-key remoteRef: key: payment-app/api-key
Enter fullscreen mode Exit fullscreen mode

Pre-Commit Hook to Detect Secrets 

#!/usr/bin/env python3 # .git/hooks/pre-commit  import subprocess import re import sys def detect_secrets_in_dockerfile(): """Detect secrets in Dockerfile before commit""" patterns = [ (r'ENV\s+\w*PASSWORD\s*=\s*["\']([^"\']+)["\']', 'Password in ENV'), (r'ENV\s+\w*SECRET\s*=\s*["\']([^"\']+)["\']', 'Secret in ENV'), (r'ENV\s+\w*KEY\s*=\s*["\']([^"\']+)["\']', 'Key in ENV'), (r'--password\s+["\']([^"\']+)["\']', 'Password in command'), (r'apikey["\']?\s*[:=]\s*["\']([^"\']+)["\']', 'API key detected'), ] try: with open('Dockerfile', 'r') as f: content = f.read() violations = [] for pattern, message in patterns: matches = re.findall(pattern, content, re.IGNORECASE) if matches: violations.append(f"{message}: {len(matches)} found") if violations: print("❌ SECURITY VIOLATION: Secrets detected in Dockerfile!") for violation in violations: print(f" - {violation}") print("\nUse AWS Secrets Manager instead.") print("See: https://docs.aws.amazon.com/secretsmanager/") sys.exit(1) print("✅ No secrets detected in Dockerfile") return 0 except FileNotFoundError: return 0 if __name__ == '__main__': sys.exit(detect_secrets_in_dockerfile())
Enter fullscreen mode Exit fullscreen mode

Phase 3: Image Scanning and Signing

Amazon ECR Image Scanning

Enable Automatic Scanning:

# Enable automatic scanning on push aws ecr put-image-scanning-configuration \ --repository-name payment-app \ --image-scanning-configuration scanOnPush=true # Scan existing images aws ecr start-image-scan \ --repository-name payment-app \ --image-id imageTag=latest
Enter fullscreen mode Exit fullscreen mode

Get Scan Results:

# Get scan findings aws ecr describe-image-scan-findings \ --repository-name payment-app \ --image-id imageTag=latest \ --query 'imageScanFindings' \ --output json
Enter fullscreen mode Exit fullscreen mode

Fail Build on Critical Vulnerabilities:

# check-ecr-scan-results.py import boto3 import sys import json ecr = boto3.client('ecr') def check_scan_results(repo_name, image_tag): """Check ECR scan results and fail if critical issues found""" response = ecr.describe-image-scan-findings( repositoryName=repo_name, imageId={'imageTag': image_tag} ) findings = response.get('imageScanFindings', {}) finding_counts = findings.get('findingCounts', {}) critical_count = finding_counts.get('CRITICAL', 0) high_count = finding_counts.get('HIGH', 0) print(f"Scan Results:") print(f" Critical: {critical_count}") print(f" High: {high_count}") print(f" Medium: {finding_counts.get('MEDIUM', 0)}") print(f" Low: {finding_counts.get('LOW', 0)}") # Fail if critical or too many high severity  if critical_count > 0: print(f"❌ Build failed: {critical_count} CRITICAL vulnerabilities found") sys.exit(1) if high_count > 5: print(f"❌ Build failed: {high_count} HIGH vulnerabilities found (max 5 allowed)") sys.exit(1) print("✅ Image scan passed") return 0 if __name__ == '__main__': if len(sys.argv) < 3: print("Usage: python check-ecr-scan-results.py <repo-name> <image-tag>") sys.exit(1) sys.exit(check_scan_results(sys.argv[1], sys.argv[2]))
Enter fullscreen mode Exit fullscreen mode

Integrate into CI/CD:

# buildspec.yml version: 0.2 phases: pre_build: commands: - echo Logging in to Amazon ECR... - aws ecr get-login-password --region $AWS_DEFAULT_REGION | docker login --username AWS --password-stdin $AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com - REPOSITORY_URI=$AWS_ACCOUNT_ID.dkr.ecr.$AWS_DEFAULT_REGION.amazonaws.com/$IMAGE_REPO_NAME - COMMIT_HASH=$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | cut -c 1-7) - IMAGE_TAG=${COMMIT_HASH:=latest} build: commands: - echo Building Docker image... - docker build -t $IMAGE_REPO_NAME:$IMAGE_TAG . - docker tag $IMAGE_REPO_NAME:$IMAGE_TAG $REPOSITORY_URI:$IMAGE_TAG post_build: commands: - echo Pushing Docker image... - docker push $REPOSITORY_URI:$IMAGE_TAG - echo Waiting for image scan to complete... - | aws ecr wait image-scan-complete \ --repository-name $IMAGE_REPO_NAME \ --image-id imageTag=$IMAGE_TAG \ --max-attempts 30 \ --delay 10 - echo Checking scan results... - | python check-ecr-scan-results.py $IMAGE_REPO_NAME $IMAGE_TAG - echo Image scan passed, proceeding with deployment
Enter fullscreen mode Exit fullscreen mode

Image Signing with AWS Signer

Create Signing Profile:

# Create signing profile aws signer put-signing-profile \ --profile-name payment-app-signing-profile \ --platform-id Notation-OCI-SHA384-ECDSA \ --signing-material certificateArn=arn:aws:acm:region:account:certificate/cert-id # Get signing profile aws signer get-signing-profile \ --profile-name payment-app-signing-profile
Enter fullscreen mode Exit fullscreen mode

Sign Image:

# Sign image after push aws signer start-signing-job \ --source '{ "s3": { "bucketName": "payment-app-artifacts", "key": "payment-app-latest.tar" } }' \ --destination '{ "s3": { "bucketName": "payment-app-artifacts", "prefix": "signed/" } }' \ --profile-name payment-app-signing-profile
Enter fullscreen mode Exit fullscreen mode

Verify Image Signature:

# Install notation CLI # https://notaryproject.dev/docs/installation/ # Verify signature notation verify \ --certificate-file certificate.pem \ 123456789.dkr.ecr.us-east-1.amazonaws.com/payment-app:latest
Enter fullscreen mode Exit fullscreen mode

Enforce Signature Verification in ECS:

import boto3 ecs = boto3.client('ecs') def verify_image_signature(image_uri): """Verify image signature before deployment""" # Extract image details  # Check signature using notation or AWS Signer API  # If signature invalid, reject deployment  pass def create_service_with_signature_check(task_definition): """Create ECS service only if image is signed""" # Verify signature first  image_uri = task_definition['containerDefinitions'][0]['image'] if not verify_image_signature(image_uri): raise ValueError(f"Image {image_uri} is not signed or signature invalid") # Create service  ecs.create_service( cluster='payment-cluster', serviceName='payment-service', taskDefinition=task_definition['family'], desiredCount=2 )
Enter fullscreen mode Exit fullscreen mode

Third-Party Scanning Tools

Trivy Integration:

# Install Trivy wget https://github.com/aquasecurity/trivy/releases/download/v0.45.0/trivy_0.45.0_Linux-64bit.tar.gz tar -xzf trivy_0.45.0_Linux-64bit.tar.gz # Scan image trivy image --severity HIGH,CRITICAL \ --format json \ --output trivy-results.json \ 123456789.dkr.ecr.us-east-1.amazonaws.com/payment-app:latest # Fail build on critical findings trivy image --exit-code 1 --severity CRITICAL \ 123456789.dkr.ecr.us-east-1.amazonaws.com/payment-app:latest
Enter fullscreen mode Exit fullscreen mode

Snyk Integration:

# Install Snyk npm install -g snyk # Authenticate snyk auth $SNYK_TOKEN # Scan Docker image snyk container test 123456789.dkr.ecr.us-east-1.amazonaws.com/payment-app:latest \ --severity-threshold=high \ --json > snyk-results.json
Enter fullscreen mode Exit fullscreen mode

Phase 4: Runtime Security (Least Privilege)

ECS Task Security Configuration

Non-Root User:

{ "containerDefinitions": [ { "name": "payment-app", "image": "123456789.dkr.ecr.us-east-1.amazonaws.com/payment-app:latest", "user": "1001:1001", "readonlyRootFilesystem": true, "privileged": false, "linuxParameters": { "capabilities": { "drop": ["ALL"], "add": ["NET_BIND_SERVICE"] } } } ] }
Enter fullscreen mode Exit fullscreen mode

Resource Limits:

{ "containerDefinitions": [ { "name": "payment-app", "memory": 512, "memoryReservation": 256, "cpu": 256, "ulimits": [ { "name": "nofile", "softLimit": 1024, "hardLimit": 2048 } ] } ] }
Enter fullscreen mode Exit fullscreen mode

EKS Pod Security Standards

Pod Security Policy:

apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: payment-app-psp spec: privileged: false allowPrivilegeEscalation: false requiredDropCapabilities: - ALL volumes: - 'configMap' - 'secret' - 'emptyDir' runAsUser: rule: 'MustRunAsNonRoot' seLinux: rule: 'RunAsAny' fsGroup: rule: 'RunAsAny' readOnlyRootFilesystem: true
Enter fullscreen mode Exit fullscreen mode

Security Context:

apiVersion: apps/v1 kind: Deployment metadata: name: payment-app spec: template: spec: securityContext: runAsNonRoot: true runAsUser: 1001 fsGroup: 1001 containers: - name: payment-app image: 123456789.dkr.ecr.us-east-1.amazonaws.com/payment-app:latest securityContext: allowPrivilegeEscalation: false readOnlyRootFilesystem: true capabilities: drop: - ALL add: - NET_BIND_SERVICE resources: limits: memory: "512Mi" cpu: "500m" requests: memory: "256Mi" cpu: "250m"
Enter fullscreen mode Exit fullscreen mode

Network Policies (EKS) 

apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: name: payment-app-netpol spec: podSelector: matchLabels: app: payment-app policyTypes: - Ingress - Egress ingress: - from: - podSelector: matchLabels: app: nginx-ingress ports: - protocol: TCP port: 8080 egress: - to: - podSelector: matchLabels: app: database ports: - protocol: TCP port: 5432 - to: - namespaceSelector: matchLabels: name: kube-system ports: - protocol: UDP port: 53
Enter fullscreen mode Exit fullscreen mode

AWS App Mesh for Service Isolation 

apiVersion: appmesh.k8s.aws/v1beta2 kind: VirtualNode metadata: name: payment-app spec: podSelector: matchLabels: app: payment-app listeners: - portMapping: port: 8080 protocol: http serviceDiscovery: dns: hostname: payment-app.payment.svc.cluster.local backends: - virtualService: virtualServiceName: database.payment.svc.cluster.local
Enter fullscreen mode Exit fullscreen mode

Runtime Security Monitoring

Amazon Inspector for Runtime Scanning:

# Enable Inspector for ECS aws inspector2 enable \ --resource-types EC2 \ --account-ids 123456789 # Create assessment target aws inspector2 create-assessment-target \ --name payment-app-ecs \ --resource-group-arn arn:aws:resource-groups:us-east-1:123456789:group/payment-app
Enter fullscreen mode Exit fullscreen mode

CloudWatch Container Insights:

# Enable Container Insights for ECS aws ecs update-cluster \ --cluster payment-cluster \ --settings name=containerInsights,value=enabled
Enter fullscreen mode Exit fullscreen mode

Phase 5: Compliance Automation

AWS Config Rules for Container Compliance

ECR Compliance Rule:

import boto3 import json def evaluate_ecr_compliance(configuration_item): """Evaluate ECR repository compliance""" compliance_status = 'COMPLIANT' annotation = '' # Check if image scanning is enabled  if not configuration_item.get('configuration', {}).get('imageScanningConfiguration', {}).get('scanOnPush', False): compliance_status = 'NON_COMPLIANT' annotation = 'ECR image scanning must be enabled for PCI-DSS compliance' # Check if encryption is enabled  if not configuration_item.get('configuration', {}).get('encryptionConfiguration', {}).get('encryptionType') == 'AES256': compliance_status = 'NON_COMPLIANT' annotation = 'ECR encryption must be enabled' return { 'compliance_type': compliance_status, 'annotation': annotation } def lambda_handler(event, context): """Lambda handler for Config custom rule""" config = boto3.client('config') configuration_item = json.loads(event['invokingEvent'])['configurationItem'] evaluation = evaluate_ecr_compliance(configuration_item) config.put_evaluations( Evaluations=[{ 'ComplianceResourceType': configuration_item['resourceType'], 'ComplianceResourceId': configuration_item['resourceId'], 'ComplianceType': evaluation['compliance_type'], 'Annotation': evaluation['annotation'], 'OrderingTimestamp': configuration_item['configurationItemCaptureTime'] }] ) return evaluation
Enter fullscreen mode Exit fullscreen mode

ECS Task Definition Compliance:

def evaluate_ecs_task_compliance(configuration_item): """Evaluate ECS task definition compliance""" compliance_status = 'COMPLIANT' violations = [] config = configuration_item.get('configuration', {}) containers = config.get('containerDefinitions', []) for container in containers: # Check if running as root  if container.get('user') is None or container.get('user') == 'root': violations.append('Container must not run as root user') # Check if readonly root filesystem  if not container.get('readonlyRootFilesystem', False): violations.append('Container must have readonly root filesystem') # Check if privileged  if container.get('privileged', False): violations.append('Container must not run in privileged mode') # Check capabilities  linux_params = container.get('linuxParameters', {}) capabilities = linux_params.get('capabilities', {}) if 'ALL' not in capabilities.get('drop', []): violations.append('Container must drop ALL capabilities') if violations: compliance_status = 'NON_COMPLIANT' annotation = '; '.join(violations) else: annotation = 'Task definition meets security requirements' return { 'compliance_type': compliance_status, 'annotation': annotation }
Enter fullscreen mode Exit fullscreen mode

Automated Compliance Reporting 

import boto3 from datetime import datetime config = boto3.client('config') s3 = boto3.client('s3') def generate_compliance_report(): """Generate container compliance report""" # Get compliance summary  response = config.get_compliance_summary_by_config_rule( ConfigRuleNames=[ 'ecr-image-scanning-enabled', 'ecs-task-non-root-user', 'ecs-task-readonly-filesystem' ] ) report = { 'timestamp': datetime.utcnow().isoformat(), 'compliance_summary': response.get('ComplianceSummariesByConfigRule', []), 'overall_compliance': calculate_compliance_percentage(response) } # Save to S3 for audit trail  s3.put_object( Bucket='compliance-reports', Key=f"container-compliance-{datetime.utcnow().strftime('%Y-%m-%d')}.json", Body=json.dumps(report, indent=2), ServerSideEncryption='AES256' ) return report def calculate_compliance_percentage(response): """Calculate overall compliance percentage""" total_resources = 0 compliant_resources = 0 for rule_summary in response.get('ComplianceSummariesByConfigRule', []): summary = rule_summary.get('ComplianceSummary', {}) total_resources += summary.get('ComplianceResourceCount', {}).get('CappedCount', 0) compliant_resources += summary.get('CompliantResourceCount', {}).get('CappedCount', 0) if total_resources == 0: return 100.0 return (compliant_resources / total_resources) * 100
Enter fullscreen mode Exit fullscreen mode

Policy Enforcement with OPA (Open Policy Agent)

OPA Policy for Container Security:

# container-security.rego package container.security # Deny if container runs as root deny[msg] { input.container.user == "root" msg := "Container must not run as root user" } # Deny if privileged mode enabled deny[msg] { input.container.privileged == true msg := "Container must not run in privileged mode" } # Deny if readonly root filesystem not enabled deny[msg] { input.container.readonlyRootFilesystem != true msg := "Container must have readonly root filesystem" } # Deny if ALL capabilities not dropped deny[msg] { not "ALL" in input.container.linuxParameters.capabilities.drop msg := "Container must drop ALL capabilities" }
Enter fullscreen mode Exit fullscreen mode

Integrate OPA with ECS:

import requests import json def validate_task_definition_with_opa(task_definition): """Validate task definition against OPA policies""" opa_url = "http://opa-service:8181/v1/data/container/security" # Prepare input for OPA  input_data = { "container": task_definition['containerDefinitions'][0] } response = requests.post( f"{opa_url}/deny", json={"input": input_data} ) if response.status_code == 200: result = response.json() if result.get('result'): # Policy violations found  violations = result['result'] raise ValueError(f"Policy violations: {violations}") return True
Enter fullscreen mode Exit fullscreen mode

Complete CI/CD Pipeline with Security

Secure Build Pipeline 

# pipeline.yaml version: 0.2 phases: pre_build: commands: - echo Checking base image... - BASE_IMAGE=$(grep '^FROM' Dockerfile | head -1 | awk '{print $2}') - trivy image --severity HIGH,CRITICAL --exit-code 1 "$BASE_IMAGE" - echo Checking for secrets in Dockerfile... - python check-dockerfile-secrets.py build: commands: - echo Building Docker image... - docker build -t $IMAGE_REPO_NAME:$IMAGE_TAG . - docker tag $IMAGE_REPO_NAME:$IMAGE_TAG $REPOSITORY_URI:$IMAGE_TAG post_build: commands: - echo Scanning image with Trivy... - trivy image --severity HIGH,CRITICAL --exit-code 1 $REPOSITORY_URI:$IMAGE_TAG - echo Pushing to ECR... - docker push $REPOSITORY_URI:$IMAGE_TAG - echo Waiting for ECR scan... - | aws ecr wait image-scan-complete \ --repository-name $IMAGE_REPO_NAME \ --image-id imageTag=$IMAGE_TAG - echo Checking ECR scan results... - python check-ecr-scan-results.py $IMAGE_REPO_NAME $IMAGE_TAG - echo Signing image... - aws signer start-signing-job --profile-name payment-app-signing-profile --source ... - echo Validating task definition... - python validate-task-definition.py task-definition.json - echo All security checks passed!
Enter fullscreen mode Exit fullscreen mode

Best Practices Summary

Do's ✅

  1. Use minimal base images (distroless, alpine)
  2. Multi-stage builds to reduce image size
  3. Never include secrets in images
  4. Scan images before deployment
  5. Sign images for integrity verification
  6. Run as non-root user
  7. Drop all capabilities by default
  8. Use readonly root filesystem
  9. Set resource limits
  10. Enable network policies

Don'ts ❌

  1. Don't use latest tags in production
  2. Don't run as root user
  3. Don't include secrets in images or Dockerfiles
  4. Don't skip scanning before deployment
  5. Don't use privileged mode unless absolutely necessary
  6. Don't ignore security findings
  7. Don't disable read-only filesystem without justification
  8. Don't forget to sign images

Conclusion

Securing containers requires a comprehensive approach across the entire lifecycle. Key takeaways:

  1. Minimal base images reduce attack surface significantly
  2. AWS Secrets Manager eliminates secrets from images
  3. ECR scanning catches vulnerabilities before deployment
  4. Image signing ensures integrity and authenticity
  5. Runtime security (least privilege, isolation) protects running containers
  6. Compliance automation ensures continuous adherence to standards

The result? A secure, compliant containerized application that meets financial services requirements while maintaining operational efficiency.

Additional Resources

Top comments (0)