Onboarding AWS Elastic Container Registry

• AWS User Access Key - Standard AWS user access key with the policy AmazonEC2ContainerRegistryReadOnly required for read-only access to the applicable ECR.

• AWS Node Group Role - For an EKS Amazon Elastic Kubernetes Service (Amazon EKS) is a managed Kubernetes service that makes it easy for you to run Kubernetes on AWS and on-premises. cluster created in the AWS environment, CloudGuard needs the IAM Identity and Access Management (IAM) - A web service that customers can use to manage users and user permissions within their organizations. role of the EKS node to access the AWS services.

  To use this option, make sure that:

  • Your host cluster is an EKS cluster.

  • Your EKS cluster is on the same AWS account as the registry.

  • The Amazon EKS worker node IAM role (NodeInstanceRole) has sufficient permissions to access the ECR.

  • Metadata API is enabled on the EC2 Amazon EC2 - A web service for launching and managing Linux/UNIX and Windows Server instances in Amazon data centers. node. Enable it again if it is disabled. For more details, see Amazon EC2 documentation.

  To learn more about these requirements, see AWS Node Group Role for Amazon ECR.

• AWS Custom Role for Amazon ECR (Kubernetes) - For an EKS cluster created in the AWS environment, CloudGuard needs the custom IAM role to scan ECR registries in the same or across different AWS accounts.

  To use this option, make sure that:

  • Your host cluster is an EKS cluster.

  • You have a custom role with sufficient permissions to access the ECR.

  • The IAM role NodeInstanceRole attached to the EKS cluster has the sts:AssumeRole permissions.

  • Metadata API is enabled on the EC2 node. If it is disabled, enable it again. For more details, see Amazon EC2 documentation.

  • Minimum required agent version: 2.23.0

  To learn more about these requirements, see AWS Custom Role for Amazon ECR (Kubernetes).

• AWS User Access Key - Standard AWS user access key with the policy AmazonEC2ContainerRegistryReadOnly required for read-only access to the applicable ECR.

• AWS ECS Task Role - For an ECS Amazon Elastic Container Service (ECS) - a fully managed container orchestration service that helps you deploy, manage, and scale Docker containers running applications, services, and batch processes. cluster created in the AWS environment, CloudGuard needs the IAM role of the ECS cluster to access the AWS services.

  To use this option, make sure that:

  • Your host cluster is an ECS cluster.

  • Your ECS cluster is on the same AWS account as the registry.

  • The Amazon ECS task IAM role (TaskRole) has sufficient permissions to access the ECR.

  • Minimum required agent version: 2.28.0.

• AWS Custom Role for Amazon ECR (AWS ECS) - For an ECS cluster created in the AWS environment, CloudGuard needs the custom IAM role to scan ECR registries in the same or across different AWS accounts.

  To use this option, make sure that:

  • Your host cluster is an ECS cluster.

  • You have a custom role with sufficient permissions to access the ECR.

  • The IAM role TaskRole attached to the ECS cluster has the sts:AssumeRole permissions

  • Minimum required agent version: 2.28.0.

  To learn more about these requirements, see Special Roles.

1. In the CloudGuard portal, navigate to Asset > Environments.

2. From the top menu, select Add > Container Registry and follow the setup steps.

3. In the Container Registry Onboarding wizard, enter the registry details:

   1. Environment Name - Enter a new name for the registry or use the default name. This name allows you to identify the registry later in CloudGuard.

   2. Environment Description - Optionally, enter a description.

   3. Select an Organizational Unit.

   4. Select the type of environment to host your scanner - Kubernetes or AWS ECS scanner.

   5. Select a Kubernetes Kubernetes, often abbreviated as “K8s”, orchestrates containerized applications to run on a cluster of hosts. cluster or an AWS environment on which you can run the registry scanner:

      • For Kubernetes, select from the list of clusters with enabled Image Assurance. For a new cluster, click Onboard a new Kubernetes Cluster and see Onboarding Kubernetes Clusters. In this case, you quit the registry onboarding and, after onboarding a new cluster, you need to start the registry onboarding from the beginning.

      • For AWS, select from the list of all AWS environments onboarded to CloudGuard.

   6. Choose Registry type - Select the AWS Elastic Container Registry (ECR).

   7. Registry URI - Enter the approved endpoint name of your ECR in this format: <aws_account_id>.dkr.ecr.<region>.amazonaws.com.

      Important - Make sure the URI does not contain /<subfolder> after amazonaws.com.

   8. Authentication Method - Select one of the methods:

      • AWS User Access Keys

        Pull Secret Name - Create the Kubernetes secret in the same namespace where the Check Point Image Assurance agents are deployed. The secret must contain the image pull credentials.

        Make sure that the <secret-name> is a valid Kubernetes name. For more details, see the Kubernetes Documentation.

        To create the secret, run:

        kubectl create secret docker-registry <secret-name> \ --namespace <namespace> \ # must be the same namespace as the CloudGuard agent --docker-server=<registry-uri> \ # <aws_account_id>.dkr.ecr.<region>.amazonaws.com --docker-username=<AWS_ACCESS_KEY> \ --docker-password=<AWS_SECRET_KEY>

      • AWS Node Group Role or AWS ECS Task Role

      • AWS Custom Role

        Role ARN - Use the ARN Amazon Resource Names (ARNs) uniquely identify AWS resources. They are required to specify a resource unambiguously across all of AWS, such as in IAM policies, Amazon Relational Database Service (Amazon RDS) tags, and API calls. of the custom role created in Special Roles.

        To use these methods, make sure the hosting cluster satisfies all the prerequisites in Prerequisites.

4. Click Next to continue to Cluster Configurations.

In this step, you configure the CloudGuard Service Account credentials if in Step 1 you selected to onboard with a new cluster or with the existing cluster that requires an agent update.

For onboarding with the hosting cluster that has updated agents, this step is skipped.

1. Configure a Service Account by one of these methods:

   • Select an existing Service Account with its corresponding API Key.

   • Enter a Service Account manually.

   • Click Add Service Account to create a new account.

2. Click Next to continue to the next step.

The worker node running on your hosting cluster needs the IAM permissions to access the ECR. Kubernetes clusters created with automation like EKS ETL have these permissions by default. Kubernetes clusters created manually may not have the permissions, so you have to add them.

To verify the cluster configuration:

1. Open the Amazon Elastic Kubernetes Service console.

2. Select the cluster to use as a hosting cluster.

3. From the Compute tab, add a new node group or select an existing one.

4. In the selected node group, go to the Details tab.

5. Below Node IAM role ARN, click the ARN link to open the Node Group Role configuration for the attached Role in the EKS cluster.

6. In the Permissions tab, make sure that the AmazonEC2ContainerRegistryReadOnly managed policy is attached to the role.

The worker node running on your hosting cluster needs the custom IAM permissions to access an ECR.

1. On your AWS console, open the IAM Service.

2. Create a custom IAM role on the AWS account of your ECR:

   Sample Role Policy

   Copy

   { 
     "Version": "2012-10-17", 
     "Statement": [ 
       { 
         "Effect": "Allow", 
         "Action": [ 
           "ecr:GetDownloadUrlForLayer", 
           "ecr:BatchCheckLayerAvailability", 
           "ecr:BatchGetImage", 
           "ecr:DescribeImages", 
           "ecr:DescribeRepositories", 
           "ecr:ListImages", 
           "ecr:ListTagsForResource" 
           ], 
         "Resource": "arn:aws:ecr:*:<AWS-Account-ID where ECR located>:repository/*" 
       }, 
       { 
         "Effect": "Allow", 
         "Action": ["ecr:GetAuthorizationToken"], 
         "Resource": "*" 
       } 
     ] 
   } 

3. Create a role trust relationship to give the EKS account access to the ECR account:

   Sample Role Trust Relationship
   

   Copy

   { 
     "Version": "2012-10-17", 
     "Statement": [ 
       { 
         "Sid": "Statement1", 
         "Effect": "Allow", 
         "Principal": { 
           "AWS": "arn:aws:iam::<AWS-Account-ID where EKS Located>:root" 
         }, 
         "Action": "sts:AssumeRole" 
       } 
     ] 
   } 
   

4. Open the Amazon Elastic Kubernetes Service console.

5. Select the cluster to use as a hosting cluster.

6. On the Compute tab, add a new node group or select an existing one.

7. In the Node group section, select the created node group or the default node group.

8. In the selected node group, go to the Details tab.

9. Below Node IAM role ARN, click the ARN link to open the Node Group Role configuration for the attached Role in the EKS cluster.

10. In the Permissions tab, click Add permissions to create a new IAM policy.

11. Select Create inline policy, click JSON to edit the policy, and add the sample policy provided below.

    Sample Policy

    This policy uses an ARN of the Custom-IAM-Role that you created in Step 2.

    Copy

    { 
      "Version": "2012-10-17", 
      "Statement": [ 
        { 
          "Effect": "Allow", 
          "Action": ["sts:AssumeRole"], 
          "Resource": "<ARN-Custom-IAM-Role>" 
        } 
      ] 
    } 
    

12. Click Next.

13. Give a name to the policy and click Create policy. The policy is added and attached to the IAM Node Group Role.

The ECS Task Role attached to the Service needs the IAM permissions to access the ECR. ECS clusters created manually may not have the permissions, so you have to add them.

To verify the cluster configuration:

1. Open the Amazon Elastic Container Service console.

2. Select the cluster to use as a hosting cluster.

3. From the Task tab, select one of the tasks.

4. In the Configuration panel, click Task definition.

5. Below Task role, click the link to open the Task Role configuration for the attached Role in the ECS cluster.

6. In the Permissions tab, make sure that the AmazonEC2ContainerRegistryReadOnly managed policy is attached to the role.

The ECS Task Role attached to the Service needs the custom IAM permissions to access the ECR.

1. On your AWS console, open the IAM Service.

2. Create a custom IAM role on the AWS account of your ECR:

   Sample Role Policy

   Copy

   { 
     "Version": "2012-10-17", 
     "Statement": [ 
       { 
         "Effect": "Allow", 
         "Action": [ 
           "ecr:GetDownloadUrlForLayer", 
           "ecr:BatchCheckLayerAvailability", 
           "ecr:BatchGetImage", 
           "ecr:DescribeImages", 
           "ecr:DescribeRepositories", 
           "ecr:ListImages", 
           "ecr:ListTagsForResource" 
           ], 
         "Resource": "arn:aws:ecr:*:<AWS-Account-ID where ECR located>:repository/*" 
       }, 
       { 
         "Effect": "Allow", 
         "Action": ["ecr:GetAuthorizationToken"], 
         "Resource": "*" 
       } 
     ] 
   } 

3. Create a role trust relationship to give the EKS account access to the ECR account:

   Sample Role Trust Relationship
   

   Copy

   { 
     "Version": "2012-10-17", 
     "Statement": [ 
       { 
         "Sid": "Statement1", 
         "Effect": "Allow", 
         "Principal": { 
           "AWS": "arn:aws:iam::<AWS-Account-ID where EKS Located>:root" 
         }, 
         "Action": "sts:AssumeRole" 
       } 
     ] 
   } 
   

4. Open the Amazon Elastic Container Service console.

5. Select the cluster to use as a hosting cluster.

6. From the Task tab, select one of the tasks.

7. In the Configuration panel, click Task definition.

8. Below Task role, click the link to open the Task Role configuration for the attached Role in the ECS cluster.

9. In the Permissions tab, click Add permissions to create a new IAM policy.

10. Select Create inline policy, click JSON to edit the policy, and add the sample policy provided below.

    Sample Policy

    This policy uses an ARN of the Custom-IAM-Role that you created in Step 2.

    Copy

    { 
      "Version": "2012-10-17", 
      "Statement": [ 
        { 
          "Effect": "Allow", 
          "Action": ["sts:AssumeRole"], 
          "Resource": "<ARN-Custom-IAM-Role>" 
        } 
      ] 
    } 
    

11. Click Next.

12. Give a name to the policy and click Create policy. The policy is added and attached to the IAM Node Group Role.