EC2
Overview
Deploying the Upwind components on ECS using the EC2 launch type involves several steps that leverage the power and flexibility of AWS services to manage and scale containerized applications. In this setup, you can run the Upwind components as containerized services. Specifically, the Upwind Sensor can be configured as a daemon service in the host network mode, ensuring it has the necessary visibility and access to monitor and manage the network traffic efficiently across your EC2 instances.
Unlike the Fargate launch type, where AWS provisions and manages the compute for you, the EC2 launch type gives you more control over the underlying infrastructure - and with that control comes the responsibility for providing it.
The underlying EC2 infrastructure is not provisioned automatically. Before installing the Upwind components, you must deploy and manage the EC2 container instances that are registered to your ECS cluster, including their capacity and scaling. The Upwind installation deploys the Upwind components onto your existing cluster - it does not create EC2 instances on your behalf.
Components
Below is a table detailing the Upwind components and their roles in an ECS cluster using the EC2 launch type:
| Upwind Sensor | Collects data on network traffic and system metrics across your EC2 instances. It operates in host network mode to ensure comprehensive visibility and efficient data gathering. |
| Upwind Scanner | Runs as an ECS daemon service alongside the Sensor, with one task placed on every EC2 container instance. It is deployed by default and can be turned off - see Configuration. |
| Upwind Cluster Manager | Orchestrates the deployment and operation of Upwind components across the ECS cluster. It coordinates tasks, ensuring that the sensor data is efficiently processed and analyzed without the need for direct infrastructure management. |
On ECS with the EC2 launch type, the Upwind Scanner scans the container images of your running tasks and reports package vulnerabilities and secrets for those images.
It does not scan the EC2 container instance itself. No SBOM is generated for the host filesystem, so OS and host package vulnerabilities for your ECS container instances are not reported from this install path.
To cover the hosts, deploy a Cloud scanner in the account and enable EC2 instance scanning. The Cloud scanner scans your ECS container instances as EC2 instances, reporting vulnerabilities, malware, and secrets for them agentlessly. For the scanning capabilities and exclusions per resource type, see AWS coverage.
Installation
The installation choices available for deploying the Upwind components on EC2 are as follows:
- Terraform (Recommended)
- AWS CloudFormation
Upgrade
For instructions on upgrading Upwind components on an ECS cluster using the EC2 launch type, refer to the Upgrade guide.
Troubleshooting
If you encounter issues during deployment or operation, consult the Troubleshooting guide for solutions and best practices.