Configuration

Proxy Configuration

All cluster components, operator, cluster manager, sensor and scanner will all respect the HTTP_PROXY family of environment variables.
Depending on the installation method, Terraform or CloudFormation you can set the URL to the proxy.

Terraform
Cloud Formation)

Set the proxy_configuration variable so that proxy settings will be applied.

First the proxy should be enabled.
Then set httpProxy variable to the URL of the proxy.

httpsProxy will also be set to the same value if omitted.

proxy_configuration = {
  enabled = true
  httpProxy = "http://proxy.service:1234"
}

Set the Proxy variable to URL to the proxy to use e.a http://proxy.service:1234.

Multi-Cluster Mode

When you run multiple ECS clusters, you can deploy a single Cluster Manager and point the sensors and scanners in the other clusters at it. A cluster dedicated to running the Cluster Manager, with no workloads of its own, is called a utility cluster.

This page uses the aws-ecs-runtime module, which lets a cluster run the sensor and scanner without a Cluster Manager of its own. Every cluster uses that same module, with a different cluster_manager block. If you installed with aws-ecs-sensor, see Existing installations below. Multi-cluster mode is not available with CloudFormation.

warning

If you already monitor AWS Lambda, do not reuse the upwind-utility-cluster-* cluster from the AWS Lambda guide. Its Cluster Manager exposes only port 8082, which is what the Lambda Tracer uses. ECS sensors and scanners need 8444.

Deploy the utility cluster

Disable the node daemons so the cluster runs the Cluster Manager and nothing else:

module "upwind_cluster_manager" {
  source = "https://get.upwind.io/terraform/modules/aws-ecs-runtime/aws-ecs-runtime-<version>.tar.gz"

  create           = true
  ecs_cluster_name = "upwind-utility"
  vpc_id           = var.vpc_id
  subnets          = toset(var.subnet_ids)

  credentials = {
    client_id     = var.upwind_client_id
    client_secret = var.upwind_client_secret
  }

  sensor  = { enabled = false }
  scanner = { enabled = false }

  cluster_manager = {
    create        = true
    multi_cluster = true

    service_discovery = {
      use_internal_lb = true
    }
  }
}

multi_cluster lets the Cluster Manager see tasks in the other clusters. Without it they appear empty in the Upwind console, with no error.
use_internal_lb puts the Cluster Manager behind an internal load balancer listening on 8082 and 8444. Omit it to use AWS Cloud Map service discovery instead, which only resolves inside a single VPC.

Connect additional clusters

Use the same module with the Cluster Manager disabled and pointed at the shared one:

module "upwind_sensor" {
  source   = "https://get.upwind.io/terraform/modules/aws-ecs-runtime/aws-ecs-runtime-<version>.tar.gz"
  for_each = toset(["production-api", "production-workers"])

  create           = true
  ecs_cluster_name = each.value

  credentials = {
    secret_arn          = module.upwind_cluster_manager.sensor_secret_arn
    registry_secret_arn = module.upwind_cluster_manager.registry_credentials_secret_arn
  }

  cluster_manager = {
    create = false
    domain = module.upwind_cluster_manager.cluster_manager_lb_dns_name
  }
}

The sensor and scanner run as ECS daemon services, so each cluster needs registered EC2 container instances — one task is placed on every instance. Allow those instances to reach the Cluster Manager's security group on ports 8082 and 8444; the module exposes it as the cluster_manager_security_group_id output.

If a cluster uses ECS Managed Instances, also set managed_instances_capacity_provider_names to the names of its capacity providers. The daemon services skip managed instances, which are covered by a separate managed daemon, and leaving this empty deploys nothing to them.

Important

Set domain to a hostname only, with no port and no scheme. The sensor and scanner append the port themselves, so a port here produces a target like host:8444:8444 and every sensor fails with too many colons in address, even though the Cluster Manager is healthy.

To share a Cluster Manager across VPCs, keep use_internal_lb enabled, connect the VPCs with peering or Transit Gateway, and allow 8082 and 8444 from the other CIDR ranges. By default only the utility cluster's own VPC CIDR is allowed.

Existing installations using aws-ecs-sensor

If you installed with the aws-ecs-sensor module, which the console currently provides, you can either stay on it or move to aws-ecs-runtime.

info

Changing module is not a configuration edit. The resources are addressed differently in each module, so Terraform plans to destroy and recreate the Upwind components unless you move each resource with terraform state mv first. Contact your Upwind solutions architect before migrating a production cluster.

To stay on aws-ecs-sensor, deploy the upwind-sensor and upwind-scanner services into each additional cluster yourself, reusing the task definitions from the utility cluster, and point them at the shared Cluster Manager:

sensor_extra_env = {
  UPWIND_CLUSTER_AGENT_DOMAIN = "upwind-cluster-manager.upwind-<utility-cluster>.private"
}

scanner_extra_env = {
  UPWIND_CLUSTER_AGENT_DOMAIN = "upwind-cluster-manager.upwind-<utility-cluster>.private"
}

With this approach all clusters must be in the same VPC, and every cluster gets its own Cluster Manager, since aws-ecs-sensor has no way to opt out of it.

gVisor Support

The Upwind Sensor includes support for monitoring applications running in gVisor sandboxes, providing enhanced security isolation for sensitive workloads. gVisor implements a userspace kernel that acts as a security boundary between containerized applications and the host system.

Learn more about gVisor support including configuration, architecture, and deployment options.

Proxy Configuration​

Multi-Cluster Mode​

Deploy the utility cluster​

Connect additional clusters​

Existing installations using aws-ecs-sensor​

gVisor Support​