CONTAINER SECURITY
EKS Security Hardening & Runtime Threat Detection
Overview
What this project is.
Production-grade EKS cluster deployed via Terraform with defense-in-depth security — granular RBAC per namespace, deny-all-default network policies, restricted pod security standards, and Falco for runtime anomaly detection including container shell access and unexpected process execution.
Problem
Why this matters.
Default Kubernetes configurations are insecure. Runtime threats like cryptomining and container escapes need real-time detection.
Architecture
How it's built.
- EKS cluster deployed with Terraform modules
- RBAC: granular least-privilege per namespace
- Network policies: deny-all default with explicit allow rules
- Pod Security Standards: restricted profile enforced
- Falco for runtime anomaly detection (shell access, unexpected processes)
- Trivy image scanning integrated in CI/CD pipeline
Tools
Tech stack.
AWS EKSTerraformFalcoOPA/GatekeeperKyvernoTrivy
Impact
Results.
Layered security from container build through runtime with automated policy enforcement
Presentation
How to showcase this.
Show Terraform modules. Include Falco rule for shell-in-container. Display defense-in-depth layers diagram.