Amazon ECS ExecとSysdigを使ってコンテナ内で安全にコマンドを実行する

docker -it exec container-name /bin/sh
kubectl exec --stdin --tty pod-name -- /bin/bash

aws ecs execute-command \
--region $REGION \
--cluster $CLUSTER_NAME \
--task $TASKID \
--container $CONTAINER_NAME \
--command "/bin/sh" \
--interactive

{
    "eventVersion": "1.08",
    "userIdentity": {
        "type": "IAMUser",
        "principalId": "$PRINCIPAL_ID",
        "arn": "arn:aws:iam::$USER_ID:user/$USER_NAME",
        "accountId": "$USER_ID",
        "accessKeyId": "$ACCESS_KEY_ID",
        "userName": "$USER_NAME"
    },
    "eventTime": "2021-02-03T17:00:14Z",
    "eventSource": "ecs.amazonaws.com",
    "eventName": "ExecuteCommand",
    "awsRegion": "ap-southeast-1",
    "sourceIPAddress": "$SOURCE_IP_ADDRESS",
    "userAgent": "aws-cli/1.18.222 Python/2.7.16 Darwin/20.2.0 botocore/1.19.62",
    "requestParameters": {
        "cluster": "$CLUSTER_NAME",
        "container": "$CONTAINER_NAME",
        "command": "/bin/sh",
        "interactive": true,
        "task": "arn:aws:ecs:ap-southeast-1:$USER_ID:task/$CLUSTER_NAME/$TASK_ID"
    },
    "responseElements": {
        "clusterArn": "arn:aws:ecs:ap-southeast-1:$USER_ID:cluster/$CLUSTER_NAME",
        "containerArn": "arn:aws:ecs:ap-southeast-1:$USER_ID:container/20486b49-de19-4f3f-9569-4748a0cb6fef",
        "containerName": "$CONTAINER_NAME",
        "interactive": true,
        "session": {
            "sessionId": "ecs-execute-command-062049f67691b9fa8",
            "streamUrl": "wss://ssmmessages.ap-southeast-1.amazonaws.com/v1/data-channel/ecs-execute-command-062049f67691b9fa8?role=publish_subscribe",
            "tokenValue": "HIDDEN_DUE_TO_SECURITY_REASONS"
        },
        "taskArn": "arn:aws:ecs:ap-southeast-1:845151661675:task/fargate-test/637d524791b7457b9e6598414404162a"
    },
    "requestID": "1742d166-4d53-4012-8dc6-def771383b5b",
    "eventID": "a8592389-8e99-4e01-8866-48089aec4f9c",
    "readOnly": false,
    "eventType": "AwsApiCall",
    "managementEvent": true,
    "eventCategory": "Management",
    "recipientAccountId": "$USER_ID"
}

- list: system_shells
  items: [/bin/bash, /bin/csh, /bin/ksh, /bin/sh, /bin/tcsh, /bin/zsh]

- rule: Terminal Shell in ECS Container
  desc: A terminal shell has been executed inside an ECS container.
  condition:
    jevt.value[/eventSource]="ecs.amazonaws.com" and
    jevt.value[/eventName]="ExecuteCommand" and
    jevt.value[/requestParameters/command] in (system_shells) and
    jevt.value[/requestParameters/interactive]=true and
    not jevt.value[/errorCode] exists
  output:
    An interactive terminal shell has been executed inside an ECS container
    (requesting user=%jevt.value[/userIdentity/arn],
     requesting IP=%jevt.value[/sourceIPAddress],
     AWS region=%jevt.value[/awsRegion],
     cluster=%jevt.value[/requestParameters/cluster],
     container=%jevt.value[/requestParameters/container],
     command=%jevt.value[/requestParameters/command],
     task=%jevt.value[/requestParameters/task])
  priority: WARNING
  tags:
    - cloud
    - aws
    - aws_ecs
    - aws_fargate
    - aws_ecs_exec
  source: aws_cloudtrail

- rule: Execute Interactive Command inside an ECS Container
  desc: Detect execution of an interactive command inside an ECS container.
  condition:
    jevt.value[/eventSource]="ecs.amazonaws.com" and
    jevt.value[/eventName]="ExecuteCommand" and
    not jevt.value[/requestParameters/command] in (system_shells) and
    jevt.value[/requestParameters/interactive]=true and
    not jevt.value[/errorCode] exists
  (...)

- rule: Execute Command inside an ECS Container
  desc: Detect execution of a command inside an ECS container.
  condition:
    jevt.value[/eventSource]="ecs.amazonaws.com" and
    jevt.value[/eventName]="ExecuteCommand" and
    jevt.value[/requestParameters/interactive]=false and
    not jevt.value[/errorCode] exists
  (...)