amazon-cloudwatch-agent-fips

Key Features

Core capabilities and strengths of this container

• FIPS 140-2 compliant monitoring capabilities
• Secure metrics and logs collection
• System and application performance monitoring
• Custom metrics support with FIPS encryption

Common Use Cases

Typical scenarios where this container excels

• Government and regulated industry deployments
• Secure cloud infrastructure monitoring
• Compliance-focused environments
• Enterprise security operations

Pull Latest Image

Download the container image from the registry

Basic Run

Run the container with basic configuration

docker run -d --name cloudwatch-agent \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /proc:/host/proc:ro \
  -v /sys:/host/sys:ro \
  clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-cloudwatch-agent-fips:latest

Production Deployment

Deploy with production security settings

docker run -d --name cloudwatch-agent-prod \
  --read-only \
  --security-opt=no-new-privileges \
  --user 1000:1000 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /proc:/host/proc:ro \
  -v /sys:/host/sys:ro \
  -v /etc/cwagent/config.json:/etc/cwagent/config.json:ro \
  clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-cloudwatch-agent-fips:latest

Volume Mount

Mount configuration and log directories

docker run -d \
  -v /etc/cwagent:/etc/cwagent \
  -v /var/log:/var/log:ro \
  clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-cloudwatch-agent-fips:latest

Port Forwarding

Run with custom port mappings

docker run -d -p 8125:8125/udp clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-cloudwatch-agent-fips:latest

Environment Variables

Configuration options available through environment variables

AWS_REGION

AWS region for CloudWatch

us-east-1

CW_CONFIG_CONTENT

CloudWatch Agent configuration as JSON string

CWAGENT_USER

User to run the CloudWatch agent

cwagent

CWAGENT_GROUP

Group to run the CloudWatch agent

cwagent

Security Best Practices

Recommended security configurations and practices

• Use IAM roles for AWS authentication
• Implement least privilege access principles
• Enable FIPS mode in configuration
• Regular security patches and updates
• Secure configuration file permissions
• Monitor agent logs for security events
• Use encrypted communications
• Implement proper access controls

Kubernetes Security Context

Recommended security context for Kubernetes deployments

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  runAsGroup: 1000
  readOnlyRootFilesystem: true
  allowPrivilegeEscalation: false
  capabilities:
    drop: ["ALL"]
    add: ["SYS_PTRACE"]

Documentation Resources

Essential links and resources for further information

• Container Registry: https://clnstrt-images.cleanstart.com/$ORGANIZATION
• Container Documentation: https://clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-cloudwatch-agent-fips