Project: ThreatMapper (Provisioning / Security & Compliance)
File: aws-ecs.md

title: AWS ECS (EC2 Provider) Deployed as a daemon service using a task definition In AWS ECS, the ThreatMapper sensors are deployed as a daemon service using task definition. Make sure you have the following information: Management console URL/IP, later referred as `<MGMTCONSOLEURL>` Deepfence API key, later referred as `<DEEPFENCE_KEY>` (This key can be found from the management console, in the settings > User > API Key) Create a new role (e.g.: `deepfence-agent-role`) Go to the IAM dashboard from AWS Console Go to Access management > roles Select "Create Role", Select "Custom trust policy" Paste the following: ```json { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "Service": "ecs-tasks.amazonaws.com" }, "Action": "sts:AssumeRole" } ] } ``` Then continue: Search in the "Permissions policies" for "Task" > Select the following policy: `AmazonECSTaskExecutionRolePolicy` Click "Next", name the role `deepfence-agent-role`, then "Create role" Search for your newly created roles Then create the new policy. Create new task definition for deepfence agent Use Old ECS Experience (old UI) Go to the "Elastic Container Service" dashboard from AWS console In the top left corner, disable new UI to use the legacy UI. Go to "Task Definitions" Select "Create new Task Definition" Select EC2, then "Next step" Provide a name to your task definition (e.g. `deepfence-agent-ec2-task`) Select the Task role and execution role (e.g. `deepfence-agent-role`) At the bottom, select "Configure via JSON" Copy and paste the following JSON configuration: (Replace `<DEEPFENCEKEY>` and `<MGMTCONSOLE_URL>` with actual values) :::info Image tag `deepfenceio/deepfenceagentce:2.1.1-multiarch` is supported in amd64 and arm64/v8

::: ```json { "ipcMode": null, "containerDefinitions": [ { "dnsSearchDomains": [], "environmentFiles": null, "logConfiguration": null, "entryPoint": [], "portMappings": [], "command": [], "linuxParameters": null, "cpu": 0, "environment": [ { "name": "DEEPFENCE_KEY", "value": "<DEEPFENCE_KEY>" }, { "name": "MGMTCONSOLEURL", "value": "<MGMTCONSOLEURL>" }, { "name": "DFLOGLEVEL", "value": "info" }, { "name": "USERDEFINEDTAGS", "value": "" } ], "resourceRequirements": null, "ulimits": null, "dnsServers": [], "mountPoints": [ { "readOnly": true, "containerPath": "/fenced/mnt/host", "sourceVolume": "Host" }, { "readOnly": false, "containerPath": "/sys/kernel/debug", "sourceVolume": "SysKernelDebug" }, { "readOnly": false, "containerPath": "/var/run/docker.sock", "sourceVolume": "DockerSock" }, { "readOnly": false, "containerPath": "/var/log/fenced", "sourceVolume": "VarLogFenced" } ], "workingDirectory": null, "secrets": null, "dockerSecurityOptions": [], "memory": null, "memoryReservation": null, "volumesFrom": [], "stopTimeout": null, "image": "docker.io/deepfenceio/deepfenceagentce:2.1.1", "startTimeout": null, "firelensConfiguration": null, "dependsOn": null, "disableNetworking": null, "interactive": null, "healthCheck": null, "essential": true, "links": [], "hostname": null, "extraHosts": null, "pseudoTerminal": null, "user": null, "readonlyRootFilesystem": null, "dockerLabels": {}, "systemControls": [], "privileged": true, "name": "deepfence" } ], "placementConstraints": [], "memory": "2048", "family": "deepfence-agent-ec2-provider", "pidMode": null, "requiresCompatibilities": [ "EC2" ], "networkMode": "host", "runtimePlatform": { "operatingSystemFamily": "LINUX", "cpuArchitecture": "X86_64" }, "cpu": "512", "inferenceAccelerators": null, "proxyConfiguration": null, "volumes": [ { "fsxWindowsFileServerVolumeConfiguration": null, "efsVolumeConfiguration": null, "name": "SysKernelDebug", "host": { "sourcePath": "/sys/kernel/debug" }, "dockerVolumeConfiguration": null }, { "fsxWindowsFileServerVolumeConfiguration": null, "efsVolumeConfiguration": null, "name": "DockerSock", "host": { "sourcePath": "/var/run/docker.sock" }, "dockerVolumeConfiguration": null }, { "fsxWindowsFileServerVolumeConfiguration": null, "efsVolumeConfiguration": null, "name": "VarLogFenced", "host": { "sourcePath": null }, "dockerVolumeConfiguration": null }, { "fsxWindowsFileServerVolumeConfiguration": null, "efsVolumeConfiguration": null, "name": "Host", "host": { "sourcePath": "/" }, "dockerVolumeConfiguration": null } ] } ``` Select the container "deepfence" and select `Auto-configure CloudWatch Logs` for `Log configuration` Then create the new task definition. Create a new service to execute the Task and deploy the agent Use Old ECS Experience (old UI) Go to the "Elastic Container Service" dashboard from the AWS console Go to "Task definitions" Select previously created task definition Select "Actions" > "Create service" Select Launch type: `EC2` Choose the ECS cluster to deploy Provide a name to your service (e.g. `deepfence-agent-ec2-service`) Set `Service Type` as `DAEMON` Create the service Monitor the service creation and check if the task is in running state. It can take a couple of minutes If the task is running, you should see the agent appearing in your console, well done!