Deploy App-Embedded Defender on AWS Fargate for Amazon EKS

Follow these steps to deploy and validate the App-Embedded Defender on AWS Fargate for Amazon Elastic Kubernetes Service (EKS).

Prerequisites

To get started, you’ll need the following:

• An existing Amazon EKS cluster with a configured Fargate profile. For detailed setup instructions, see the AWS documentation.
• The AWS account hosting the EKS cluster must be already set up and accessible in your Prisma Cloud console. See the Prisma Cloud documentation for account setup procedures.

Configure AWS IAM Roles for Service Accounts (IRSA)

Ensure that IAM Roles for Service Accounts (IRSA) is configured within AWS EKS Fargate and mapped to the service account used by the Kubernetes pods you want to protect.

1. Enable the IAM OIDC Provider: Establish an IAM OIDC identity provider for your EKS cluster. This is a one-time action per cluster that allows IAM to trust authentication tokens from your EKS cluster, which is essential for IRSA.
2. Create an IAM Role and Policy: Define an IAM policy that specifies the necessary permissions for your pod and an IAM role that the pod can assume.

   1. Create the IAM Policy: This policy dictates the actions the role can perform on specific resources, such as an S3 bucket.
   2. Create the IAM Role: Link this IAM role to the required Kubernetes service account via a trust policy.

Deploy the Defender

1. Prisma Cloud Console Access: Log in to your Prisma Cloud Console and confirm that the AWS account where the EKS cluster resides is ready and accessible.
2. Select EKS Fargate Defender Type: In the Prisma Cloud Console, go to the defender deployment section to get the necessary instrumentation logic.

   1. Go to Manage > Defenders > Defenders: Deployed.
   2. Select Manual deploy.
   3. On the Basic Settings tab:

      1. Select Single Defender as the deployment method.
      2. Select Container Defender App-Embedded as the defender type.
      3. Select EKS Fargate as the deployment type.
3. Generate the protected deployment YAML: Submit a valid EKS Fargate deployment YAML to the Prisma Cloud Console. The console modifies this YAML to include the Defender’s init container and other essential settings.

   1. Enter a valid EKS Fargate deployment YAML in Insert deployment definition.

      For more information about Kubernetes deployment YAML, see https://kubernetes.io/docs/concepts/workloads/controllers/deployment/.
   2. Click Generate protected deployment definition.
   3. The output is displayed in Generated deployment definition. Copy the YAML generated by Prisma Cloud Console for deployment in your EKS cluster.
4. Apply the generated YAML to the cluster: After the console processes your original YAML file, it will return a modified version that includes the Defender instrumentation.

   1. Save the YAML generated by the Prisma Cloud Console to a file (for example, defended-deployment.yaml).
   2. Apply this YAML file to your EKS cluster by running the following command: kubectl apply -f defended-deployment.yaml.
   3. This action schedules the pod to run on a Fargate node.

Validate Defender Visibility

The app-embedded defender is an init container that executes and terminates upon completion. You can verify the successful deployment of the defender and its visibility in both your EKS cluster and the Prisma Cloud Console using the following steps.

• In the Cluster:

  1. To verify that the pod is running, run: kubectl get pods.
  2. To describe the pod and confirm the presence of the twistlock-defender init container and the injected environment variables, run: kubectl describe pod <your-pod-name>.
• In the Prisma Cloud Console:

  1. Go to Radar > Defenders > Deployed defenders.
  2. Filter the view to locate your new Defender. It will be uniquely identified by a combination of its OIDC Issuer URL, Pod UID, and container name.

Run Cloud Discovery

Run a cloud discovery scan to ensure the Prisma Cloud Console accurately correlates the running Defender with the discovered EKS container entity.

1. In the Prisma Cloud Console, manually initiate a cloud discovery scan for the relevant AWS account.
2. When the scan is complete, go to the Radar view.
3. Locate the aws-eks-container asset for your deployment and confirm its status is Defended.