Protect your Amazon Web Service (AWS) containers with Defender for Containers

Defender for Containers in Microsoft Defender for Cloud is the cloud-native solution that is used to secure your containers so you can improve, monitor, and maintain the security of your clusters, containers, and their applications.

Learn more about Overview of Microsoft Defender for Containers.

You can learn more about Defender for Container's pricing on the pricing page.

Prerequisites

• You need a Microsoft Azure subscription. If you don't have an Azure subscription, you can sign up for a free subscription.

• You must enable Microsoft Defender for Cloud on your Azure subscription.

• Connect your AWS account to Microsoft Defender for Cloud

• Verify your Kubernetes nodes can access source repositories of your package manager. For information about the requirements, see Network requirements.

• Ensure the following Azure Arc-enabled Kubernetes network requirements are validated.

Enable the Defender for Containers plan on your AWS account

To protect your EKS clusters, you need to enable the Containers plan on the relevant AWS account connector.

To enable the Defender for Containers plan on your AWS account:

1. Sign in to the Azure portal.

2. Search for and select Microsoft Defender for Cloud.

3. In the Defender for Cloud menu, select Environment settings.

4. Select the relevant AWS account.

   

5. Set the toggle for the Containers plan to On.

   

6. To change optional configurations for the plan, select Settings.

   

   • The Agentless threat protection feature provides runtime protection to your cluster containers. The feature sends Kubernetes audit logs to Microsoft Defender. Set the Agentless threat protection toggle to On and set the retention period of your audit logs.

     Note

     If you disable this configuration, then the Threat detection (control plane) feature will be disabled. Learn more about features availability.

   • K8S API access sets permissions to allow API-based discovery of your Kubernetes clusters. To enable, set the K8S API access toggle to On.

   • Registry access sets permissions to allow vulnerability assessment of images stored in ECR. To enable, set the Registry access toggle to On.

7. Select Next: Review and generate.

8. Select Update.

Note

To enable or disable individual Defender for Containers capabilities, either globally or for specific resources, see How to enable Microsoft Defender for Containers components.

Deploy the Defender sensor in EKS clusters

Azure Arc-enabled Kubernetes, the Defender sensor, and Azure Policy for Kubernetes should be installed and running on your EKS clusters. There's a dedicated Defender for Cloud recommendation that can be used to install these extensions (and Azure Arc if necessary):

• EKS clusters should have Microsoft Defender's extension for Azure Arc installed

To deploy the required extensions:

1. From Defender for Cloud's Recommendations page, search for one of the recommendations by name.

2. Select an unhealthy cluster.

   Important

   You must select the clusters one at a time.

   Don't select the clusters by their hyperlinked names: select anywhere else in the relevant row.

3. Select Fix.

4. Defender for Cloud generates a script in the language of your choice:

   • For Linux, select Bash.
   • For Windows, select PowerShell.

5. Select Download remediation logic.

6. Run the generated script on your cluster.

Next steps

• For advanced enablement features for Defender for Containers, see the Enable Microsoft Defender for Containers page.

• Overview of Microsoft Defender for Containers.