# Guidance for Container Runtime Security Monitoring with CNCF Falco and AWS Security Hub ## Overview This Guidance shows you how to stream security event logs from Falco into AWS Security Hub in near real-time for enriched analysis. Provided by Cloud Native Computing Foundations (CNCF), Falco detects security events at runtime for containers. Using an integration of the FireLens and Fluent Bit tools with AWS services, this Guidance enriches security event logs generated by Falco and imports them into AWS Security Hub. Your security and DevOps teams can then use the Security Hub management portal to gain a centralized view of security events from all your container applications to facilitate triage and resolution. ## How it works ### Infrastructure This architecture diagram shows how to set up the Amazon EKS cluster needed for this Guidance. To learn more about detecting security events using CNCF Falco and AWS Security Hub, open the Architecture tab. [Download the architecture diagram PDF](https://d1.awsstatic.com/solutions/guidance/architecture-diagrams/container-runtime-security-monitoring-with-cncf-falco-and-aws-security-hub.pdf?target=_blank)Step 1An administrator or DevOps user commits infrastructure as code (IaC) code changes, configured to Amazon EKS specification, into the Git repository.Step 2Amazon Elastic Compute Cloud (Amazon EC2) management instance provisioning is started by the administrator or DevOps user by using AWS CloudFormation code obtained from the Git repository.Step 3The management instance's userData script starts Amazon EKS cluster resource deployment processes against the target AWS environment (using eksctl command and cluster specification).Step 4Required AWS Identity and Access Management (IAM) roles and polices and AWS Key Management Service (AWS KMS) keys are created.Step 5The Amazon Virtual Private Cloud (Amazon VPC) for the Amazon EKS control plane component is deployed.Step 6The Amazon EKS control plane components are deployed into the Amazon EKS VPC.Step 7The Amazon EKS compute VPC is deployed for the Amazon EKS compute plane.Step 8Public and private subnets and other networking components are deployed into the compute VPC.Step 9The Amazon EKS node groups with compute plane nodes (Amazon EC2 instances in an Amazon EC2 Auto Scaling group) are deployed into the compute VPC and join the Amazon EKS cluster.Step 10The Amazon EKS cluster is available for application deployments. The Kubernetes API is accessible for command line interface (CLI) clients and applications through a Network Load Balancer.### Architecture [Download the architecture diagram PDF](https://d1.awsstatic.com/solutions/guidance/architecture-diagrams/container-runtime-security-monitoring-with-cncf-falco-and-aws-security-hub.pdf#page=2?target=_blank)Step 1The Fluent Bit and FireLens log-event aggregation and the CNCF Falco security monitoring components are deployed into Amazon EKS clusters running in different AWS Regions.Step 2CNCF Falco containers monitor application containers running on Amazon EKS cluster nodes for possible security incidents (based on defined rules) and generate security events.Step 3The security events are streamed to the Fluent Bit and FireLens log-event aggregators.Step 4Aggregated security events are imported into Amazon CloudWatch log streams.Step 5AWS Lambda functions detect security events in the CloudWatch log stream, transform them into AWS Security Finding Format (ASFF) schema, and import them into regional hubs for AWS Security Hub.Step 6Security findings in ASFF are available in regional Security Hub portals.Step 7Security findings in ASFF are aggregated into a "single pane of glass" (or centralized) Security Hub portal, which includes the regional hubs as members. (This can be one of the regional Security Hub instances.)Step 8Security team members authenticate into the central Security Hub portal using IAM, and access is granted according to IAM roles.Step 9Aggregated security findings and remediation workflows are available in the "single pane of glass" Security Hub portal for acknowledgement and triage.## Deploy with confidence Everything you need to launch this Guidance in your account is right here. - **Deploy this Guidance**: Use sample code to deploy this Guidance in your AWS account [Sample code](https://github.com/aws-solutions-library-samples/guidance-for-container-runtime-security-monitoring-on-amazon-eks-with-cncf-falco-amazon-securityhub) ## Well-Architected Pillars The architecture diagram above is an example of a Solution created with Well-Architected best practices in mind. To be fully Well-Architected, you should follow as many Well-Architected best practices as possible. ### Operational Excellence This Guidance provides operational excellence by invoking Security Hub workflows that respond in near real-time to security threats related to your business applications. The Fluent Bit and FireLens integration used with Falco sends information about containers’ potential runtime security violations to the CloudWatch log event manager. Lambda then converts them into ASFF and imports them into Security Hub portals, where your security team can review, triage, and remediate them. [Read the Operational Excellence whitepaper](/wellarchitected/latest/operational-excellence-pillar/welcome.html) ### Security This Guidance uses Falco to continuously scan the containers running on your Amazon EKS applications for runtime security events. Falco also monitors containers running on Amazon EKS cluster nodes for security violations and works with FireLens, CloudWatch, and Lambda to send security event information into Security Hub, which further aggregates the security event logs and displays them for review and triage by your security team. You can then use Security Hub to start remediation workflows for security threats. All IAM policies used in the Amazon EKS cluster are scoped down to the minimum permissions required for the service to function properly. [Read the Security whitepaper](/wellarchitected/latest/security-pillar/welcome.html) ### Reliability Amazon EKS is an enterprise-grade, reliable Kubernetes application service deployed with high availability across multiple Availability Zones. CloudWatch is a log-event-management service, and Lambda is an event-processing service; together, these services ingest and generate information on security threats that might impact application reliability. Security Hub aggregates and displays these findings so that your security and site reliability engineering (SRE) teams can quickly address threats, significantly reducing the chances of application failures due to security violations. [Read the Reliability whitepaper](/wellarchitected/latest/reliability-pillar/welcome.html) ### Performance Efficiency This Guidance provides efficient scalability and performance both for your containerized application platforms (using Amazon EKS ) and for event detection (using Falco, CloudWatch, Lambda ). You can also deploy this security monitoring solution across Regions, further helping you avoid negative performance impacts from security threats. [Read the Performance Efficiency whitepaper](/wellarchitected/latest/performance-efficiency-pillar/welcome.html) ### Cost Optimization By using Falco, which is an open-source service, available at no cost, you can lower the cost of security event monitoring. CloudWatch, Lambda, and Security Hub are charged based on the amount of ingested and processed event data. These services provide a free tier of data storage and processing, so costs only accrue after you exceed this tier. Additionally, CloudWatch provides automatic archival for logs, helping you reduce message storage costs. [Read the Cost Optimization whitepaper](/wellarchitected/latest/cost-optimization-pillar/welcome.html) ### Sustainability CloudWatch, Lambda, and Security Hub are serverless and automatically scale to match workload demands and eliminate idle resources, and Amazon EKS provides high elasticity. By using these managed AWS services, alongside cloud-native technologies that run on elastic Amazon EKS clusters, this Guidance helps you achieve a high utilization of infrastructure resources, helping you minimize energy waste. Additionally, this Guidance does not require custom hardware or physical servers, and by using it to remediate security threats, you can further optimize resource utilization. [Read the Sustainability whitepaper](/wellarchitected/latest/sustainability-pillar/sustainability-pillar.html) [Read usage guidelines](/solutions/guidance-disclaimers/)