The Amazon CloudWatch Agent Operator FIPS container provides a FIPS-compliant implementation for managing and operating CloudWatch agents in Kubernetes environments. It automates the deployment, configuration, and lifecycle management of CloudWatch agents across clusters while maintaining FIPS 140-2 compliance for enhanced security in regulated environments.
Core capabilities and strengths of this container
Typical scenarios where this container excels
Download the container image from the registry
docker pull clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-cloudwatch-agent-operator-fips:latestdocker pull clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-cloudwatch-agent-operator-fips:latest-devRun the container with basic configuration
docker run -it --name cloudwatch-operator clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-cloudwatch-agent-operator-fips:latestDeploy with production security settings
docker run -d --name cloudwatch-operator-prod \
--read-only \
--security-opt=no-new-privileges \
--user 1000:1000 \
-v /var/run/kubernetes:/var/run/kubernetes \
clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-cloudwatch-agent-operator-fips:latestMount local directory for persistent data
docker run -v $(pwd)/config:/etc/cloudwatch-agent/config clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-cloudwatch-agent-operator-fips:latestRun with custom port mappings
docker run -p 8080:8080 clnstrt-images.cleanstart.com/$ORGANIZATION/amazon-cloudwatch-agent-operator-fips:latestConfiguration options available through environment variables
us-east-1cloudwatch-agent-operatorinfo8080Recommended security configurations and practices
Recommended security context for Kubernetes deployments
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop: ["ALL"]
seccompProfile:
type: RuntimeDefaultEssential links and resources for further information