AWS Deployment

DeepIntShield Enterprise images for AWS customers are distributed through AWS ECR, enabling native IAM integration for secure, credential-less authentication.

Architecture

flowchart LR
    subgraph AWS[AWS Account]
        subgraph EKS[EKS Cluster]
            Pod[DeepIntShield Pod]
            KSA[K8s ServiceAccount]
        end
        IAMRole[IAM Role]
        ECR[AWS ECR<br/>DeepIntShield Images]
    end

    KSA -->|Annotated with| IAMRole
    Pod -->|Assumes| IAMRole
    IAMRole -->|Pull Permission| ECR
    ECR -->|Image| Pod

Prerequisites

• EKS cluster (v1.23+) or ECS cluster
• AWS CLI configured with appropriate permissions
• kubectl configured for your EKS cluster
• Your AWS Account ID allowlisted by DeepIntShield team

Note

Contact the DeepIntShield team to get your AWS account ID and IAM role ARN allowlisted for ECR access.

IRSA (Recommended)

IAM Roles for Service Accounts (IRSA) provides the most secure authentication method for EKS deployments.

Step 1: Create IAM Policy

Create an IAM policy that grants ECR pull access to the DeepIntShield repository.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ECRAuth",
      "Effect": "Allow",
      "Action": [
        "ecr:GetAuthorizationToken"
      ],
      "Resource": "*"
    },
    {
      "Sid": "ECRPullFromDeepIntShield",
      "Effect": "Allow",
      "Action": [
        "ecr:BatchGetImage",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchCheckLayerAvailability"
      ],
      "Resource": "arn:aws:ecr:us-east-1:DEEPINTSHIELD_ACCOUNT_ID:repository/YOUR_HUB_SLUG"
    }
  ]
}

Caution

Replace DEEPINTSHIELD_ACCOUNT_ID and YOUR_HUB_SLUG with the values provided by the DeepIntShield team.

Save this policy as deepintshield-ecr-pull-policy.json and create it:

aws iam create-policy \
  --policy-name DeepIntShieldECRPullPolicy \
  --policy-document file://deepintshield-ecr-pull-policy.json

Step 2: Create IAM Role with OIDC Trust

Create an IAM role that can be assumed by your Kubernetes ServiceAccount.

First, get your OIDC provider URL:

aws eks describe-cluster \
  --name YOUR_CLUSTER_NAME \
  --query "cluster.identity.oidc.issuer" \
  --output text

Create the trust policy (trust-policy.json):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Federated": "arn:aws:iam::YOUR_ACCOUNT_ID:oidc-provider/oidc.eks.REGION.amazonaws.com/id/OIDC_ID"
      },
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Condition": {
        "StringEquals": {
          "oidc.eks.REGION.amazonaws.com/id/OIDC_ID:aud": "sts.amazonaws.com",
          "oidc.eks.REGION.amazonaws.com/id/OIDC_ID:sub": "system:serviceaccount:NAMESPACE:deepintshield-sa"
        }
      }
    }
  ]
}

Create the role and attach the policy:

# Create the role
aws iam create-role \
  --role-name DeepIntShieldECRPullRole \
  --assume-role-policy-document file://trust-policy.json

# Attach the policy
aws iam attach-role-policy \
  --role-name DeepIntShieldECRPullRole \
  --policy-arn arn:aws:iam::YOUR_ACCOUNT_ID:policy/DeepIntShieldECRPullPolicy

Step 3: Provide Role ARN to DeepIntShield

Send your IAM role ARN to the DeepIntShield team for allowlisting:

arn:aws:iam::YOUR_ACCOUNT_ID:role/DeepIntShieldECRPullRole

Step 4: Create Namespace and ServiceAccount

kubectl create namespace deepintshield

apiVersion: v1
kind: ServiceAccount
metadata:
  name: deepintshield-sa
  namespace: deepintshield
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::YOUR_ACCOUNT_ID:role/DeepIntShieldECRPullRole

Step 5: Deploy DeepIntShield

apiVersion: apps/v1
kind: Deployment
metadata:
  name: deepintshield
  namespace: deepintshield
spec:
  replicas: 2
  selector:
    matchLabels:
      app: deepintshield
  template:
    metadata:
      labels:
        app: deepintshield
    spec:
      serviceAccountName: deepintshield-sa
      containers:
      - name: deepintshield
        image: DEEPINTSHIELD_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/YOUR_HUB_SLUG:latest
        ports:
        - containerPort: 8080
          name: http
        resources:
          requests:
            cpu: "250m"
            memory: "512Mi"
          limits:
            cpu: "1000m"
            memory: "2Gi"
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 5
        volumeMounts:
        - name: config
          mountPath: /app/data/config.json
          subPath: config.json
      volumes:
      - name: config
        secret:
          secretName: deepintshield-config
---
apiVersion: v1
kind: Service
metadata:
  name: deepintshield
  namespace: deepintshield
spec:
  selector:
    app: deepintshield
  ports:
  - port: 80
    targetPort: 8080
    protocol: TCP
  type: ClusterIP

ECS Task Roles

For ECS deployments, use IAM Task Roles for authentication.

Step 1: Create Task Execution Role

The task execution role allows ECS to pull images from ECR.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ecr:GetAuthorizationToken"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ecr:BatchCheckLayerAvailability",
        "ecr:GetDownloadUrlForLayer",
        "ecr:BatchGetImage"
      ],
      "Resource": "arn:aws:ecr:us-east-1:DEEPINTSHIELD_ACCOUNT_ID:repository/YOUR_HUB_SLUG"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "*"
    }
  ]
}

Step 2: Create ECS Task Definition

{
  "family": "deepintshield",
  "networkMode": "awsvpc",
  "requiresCompatibilities": ["FARGATE"],
  "cpu": "512",
  "memory": "1024",
  "executionRoleArn": "arn:aws:iam::YOUR_ACCOUNT_ID:role/DeepIntShieldECSExecutionRole",
  "containerDefinitions": [
    {
      "name": "deepintshield",
      "image": "DEEPINTSHIELD_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/YOUR_HUB_SLUG:latest",
      "portMappings": [
        {
          "containerPort": 8080,
          "protocol": "tcp"
        }
      ],
      "healthCheck": {
        "command": ["CMD-SHELL", "curl -f http://localhost:8080/health || exit 1"],
        "interval": 30,
        "timeout": 5,
        "retries": 3,
        "startPeriod": 60
      },
      "logConfiguration": {
        "logDriver": "awslogs",
        "options": {
          "awslogs-group": "/ecs/deepintshield",
          "awslogs-region": "us-east-1",
          "awslogs-stream-prefix": "deepintshield"
        }
      }
    }
  ]
}

Step 3: Create ECS Service

aws ecs create-service \
  --cluster your-cluster \
  --service-name deepintshield \
  --task-definition deepintshield \
  --desired-count 2 \
  --launch-type FARGATE \
  --network-configuration "awsvpcConfiguration={subnets=[subnet-xxx],securityGroups=[sg-xxx],assignPublicIp=ENABLED}"

Verifying Access

Test ECR Authentication

# Get ECR login token
aws ecr get-login-password --region us-east-1 | \
  docker login --username AWS --password-stdin \
  DEEPINTSHIELD_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com

# Pull test
docker pull DEEPINTSHIELD_ACCOUNT_ID.dkr.ecr.us-east-1.amazonaws.com/YOUR_HUB_SLUG:latest

Verify IRSA Configuration

# Check ServiceAccount annotation
kubectl get sa deepintshield-sa -n deepintshield -o yaml

# Verify pod can assume role
kubectl exec -it deployment/deepintshield -n deepintshield -- \
  aws sts get-caller-identity

Troubleshooting

ImagePullBackOff Errors

1. Check IAM Role trust policy: Ensure the OIDC provider and ServiceAccount match
2. Verify ECR permissions: Confirm the role has ecr:BatchGetImage permission
3. Check allowlisting: Ensure your role ARN is allowlisted by DeepIntShield team

# Check pod events
kubectl describe pod -l app=deepintshield -n deepintshield

# Check IRSA token
kubectl exec -it deployment/deepintshield -n deepintshield -- \
  cat /var/run/secrets/eks.amazonaws.com/serviceaccount/token

Authentication Errors

# Verify OIDC provider is configured
aws iam list-open-id-connect-providers

# Check role assumption
aws sts assume-role-with-web-identity \
  --role-arn arn:aws:iam::YOUR_ACCOUNT_ID:role/DeepIntShieldECRPullRole \
  --role-session-name test \
  --web-identity-token file:///path/to/token

Next Steps

• Configure DeepIntShield settings for your use case
• Set up observability for monitoring
• Enable clustering for high availability