Sensor and Scanner

Overview

The sensor and scanner run as daemon services on EC2 container instances. You configure them with the sensor and scanner variables. They have no effect on Fargate tasks, which use the tracer.

Sensor

Attribute	Type	Default	Description
enabled	bool	true	Whether the module deploys the sensor daemon service.
image.registry	string	"registry.upwind.io"	The image registry.
image.repository	string	"images/agent"	The image repository.
image.tag	string	"0.131.4"	The image tag.
image.bcc	bool	false	Use the -bcc build of the image.
resources.cpu	number	51	CPU units for the container.
resources.memory	number	1024	Memory in MiB for the container.
extra_env	map(string)	{}	Extra environment variables for the container.
docker_security_options	list(string)	[]	Docker security options. They apply to both the sensor and the scanner containers.

sensor = {
  resources = {
    cpu    = 128
    memory = 2048
  }

  extra_env = {
    EXAMPLE_VARIABLE = "value"
  }
}

Scanner

Attribute	Type	Default	Description
enabled	bool	true	Whether the module deploys the scanner daemon service.
resources.cpu	number	51	CPU units for the container.
resources.memory	number	512	Memory in MiB for the container.
extra_env	map(string)	{}	Extra environment variables for the container.
tmpfs_size	string	"10m"	The size of the scanner's tmpfs volume.

The scanner uses the same registry, repository, and tag as the sensor, so sensor.image sets both. The scanner variable has no image attribute.

scanner = {
  tmpfs_size = "64m"

  resources = {
    memory = 1024
  }
}

Turn the daemons off

Both daemons default to true. On a Fargate-only cluster, set both to false:

module "upwind_ecs_runtime" {
  source = "https://get.upwind.io/terraform/modules/aws-ecs-runtime/aws-ecs-runtime-1.5.1.tar.gz"

  ecs_cluster_name = "my-ecs-cluster"
  vpc_id           = "vpc-0123456789abcdef0"
  subnets          = ["subnet-0123456789abcdef0", "subnet-0fedcba9876543210"]

  credentials = {
    client_id     = var.upwind_client_id
    client_secret = var.upwind_client_secret
  }

  sensor  = { enabled = false }
  scanner = { enabled = false }

  cluster_manager = { launch_type = "FARGATE" }
}

Security options

Use sensor.docker_security_options to pass Docker security options to the sensor and scanner containers:

sensor = {
  docker_security_options = ["no-new-privileges"]
}