AWS guardduty documentation change
Summary
Updated EKS Runtime Monitoring prerequisites with kernel support details, CPU architecture clarifications, restructured OS support table, and updated agent version compatibility
Security assessment
Changes clarify operational requirements for security monitoring (e.g., kernel flags, architecture support) but do not address specific vulnerabilities or security incidents
Diff
diff --git a/guardduty/latest/ug/prereq-runtime-monitoring-eks-support.md b/guardduty/latest/ug/prereq-runtime-monitoring-eks-support.md index dc870494e..6d5c1a71f 100644 --- a//guardduty/latest/ug/prereq-runtime-monitoring-eks-support.md +++ b//guardduty/latest/ug/prereq-runtime-monitoring-eks-support.md @@ -25 +25 @@ The platform that you use may impact how GuardDuty security agent supports Guard -The OS distribution, kernel version, and CPU architecture affect the support provided by the GuardDuty security agent. The following table shows the verified configuration for deploying the GuardDuty security agent and configuring EKS Runtime Monitoring. +The OS distribution, kernel version, and CPU architecture affect the support provided by the GuardDuty security agent. Kernel support includes `eBPF`, `Tracepoints` and `Kprobe`. For CPU architectures, Runtime Monitoring supports AMD64 (`x64`) and ARM64(Graviton2 and above)1. @@ -27,10 +27 @@ The OS distribution, kernel version, and CPU architecture affect the support pro -**OS distribution**1**** | **Kernel version**2**** | **Kernel support** | **CPU architecture** | **Supported Kubernetes version** ----|---|---|---|--- -**x64 (AMD64)** | **Graviton (ARM64)** **(Graviton2 and above)**3**** -Bottlerocket | eBPF Tracepoints, Kprobe | 5.4, 5.10, 5.15, 6.14 | Supported | Supported | v1.23 - v1.32 -Ubuntu | v1.21 - v1.32 -AL2 -AL2023 _5_ -RedHat 9.4 | 5.14 -Fedora 34.0 | 5.11, 5.17 -CentOS Stream 9 | 5.14 +The following table shows the verified configuration for deploying the GuardDuty security agent and configuring EKS Runtime Monitoring. @@ -38 +29,11 @@ CentOS Stream 9 | 5.14 - 1. Support for various operating systems - GuardDuty has verified the support for using Runtime Monitoring on the operating systems that are listed in the preceding table. If you use a different operating system and are able to install the security agent successfully, you might get all the expected security value that GuardDuty has been verified to provide with the listed OS distribution. +OS distribution**2** | Kernel version**3** | Supported Kubernetes version +---|---|--- +Bottlerocket | 5.4, 5.10, 5.15, 6.14 | v1.23 - v1.32 +Ubuntu | 5.4, 5.10, 5.15, 6.14 | v1.21 - v1.32 +Amazon Linux 2 | 5.4, 5.10, 5.15, 6.14 | v1.21 - v1.32 +Amazon Linux 2023 _5_ | 5.4, 5.10, 5.15, 6.14 | v1.21 - v1.32 +RedHat 9.4 | 5.144 | v1.21 - v1.32 +Fedora 34.0 | 5.11, 5,. | v1.21 - v1.32 +CentOS Stream 9 | 5.14 | v1.21 - v1.32 + + 1. Runtime Monitoring for Amazon EKS clusters doesn't support the first generation Graviton instance such as A1 instance types. @@ -40 +41 @@ CentOS Stream 9 | 5.14 - 2. For any kernel version, you must set the `CONFIG_DEBUG_INFO_BTF` flag to `y` (meaning _true_). This is required so that the GuardDuty security agent can run as expected. + 2. Support for various operating systems - GuardDuty has verified Runtime Monitoring support for the operating distribution listed in the preceding table. While the GuardDuty security agent may run on operating systems not listed in the preceding table, the GuardDuty team cannot guarantee the expected security value. @@ -42 +43 @@ CentOS Stream 9 | 5.14 - 3. Runtime Monitoring for Amazon EKS clusters doesn't support the first generation Graviton instance such as A1 instance types. + 3. For any kernel version, you must set the `CONFIG_DEBUG_INFO_BTF` flag to `y` (meaning _true_). This is required so that the GuardDuty security agent can run as expected. @@ -46 +47 @@ CentOS Stream 9 | 5.14 - 5. Runtime Monitoring supports AL2023 with the release of the GuardDuty security agent v1.6.0 and above. For more information, see [GuardDuty security agent versions for Amazon EKS clusters](./runtime-monitoring-agent-release-history.html#eks-runtime-monitoring-agent-release-history). + 5. Runtime Monitoring supports AL2023 with the release of the GuardDuty security agent v1.6.0 and above. For more information, see [GuardDuty security agent versions for Amazon EKS resources](./runtime-monitoring-agent-release-history.html#eks-runtime-monitoring-agent-release-history). @@ -57 +58 @@ Amazon EKS add-on GuardDuty security agent version | Kubernetes version -v1.9.0 (latest - v1.9.0-eksbuild.2) v1.8.1 (latest - v1.8.1-eksbuild.2) | 1.21 - 1.32 +v1.10.0 (latest - v1.10.0-eksbuild.2) v1.9.0 (latest - v1.9.0-eksbuild.2) v1.8.1 (latest - v1.8.1-eksbuild.2) | 1.21 - 1.32 @@ -60 +60,0 @@ v1.7.1 v1.7.0 v1.6.1 | 1.21 - 1.31 -| @@ -62 +61,0 @@ v1.6.0 v1.5.0 v1.4.1 v1.4.0 v1.3.1 | 1.21 - 1.29 -| @@ -64 +62,0 @@ v1.3.0 v1.2.0 | 1.21 - 1.28 -| @@ -66 +63,0 @@ v1.1.0 | 1.21 - 1.26 -| @@ -71 +68 @@ Some of the GuardDuty security agent versions will reach end of standard support -For information about the agent release versions, see [GuardDuty security agent versions for Amazon EKS clusters](./runtime-monitoring-agent-release-history.html#eks-runtime-monitoring-agent-release-history). +For information about the agent release versions, see [GuardDuty security agent versions for Amazon EKS resources](./runtime-monitoring-agent-release-history.html#eks-runtime-monitoring-agent-release-history).