# Connect Akto with AWS ECS

<figure><img src="https://2916937215-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FRc4KTKGprZI2sPWKoaLe%2Fuploads%2Fgit-blob-3821058a90e82c9eaf27010f87808e3466671d6b%2Fimage.png?alt=media" alt=""><figcaption></figcaption></figure>

## Introduction

Learn about how to send API traffic data from AWS ECS setup to Akto from your environment. Depending on your ECS infrastructure type refer to these respective sections:

1. [FARGATE infrastructure](#adding-akto-traffic-collector-to-ecs-fargate-cluster)
2. [EC2 instances infrastructure](#adding-akto-traffic-collector-to-ecs-ec2-instances-cluster)

## Adding Akto traffic collector to ECS FARGATE cluster

When the ECS cluster is running on AWS FARGATE infrastructure, we will add a container to the task definition of the task, from which we want to monitor. Refer the below image to check your cluster type.

<figure><img src="https://2916937215-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FRc4KTKGprZI2sPWKoaLe%2Fuploads%2Fgit-blob-84ab7c77f5359eb771e55253665a6c5a48c10d65%2Fecs-2.png?alt=media" alt="ECS FARGATE infrastructure type"><figcaption><p>ECS FARGATE infrastructure type</p></figcaption></figure>

1. Setup Akto data processor using the guide [here](https://docs.akto.io/getting-started/quick-start-with-akto-self-hosted/helm-deploy). Keep the value `AKTO_NLB_IP` handy, as we will need them later.
2. Add a container with the configuration defined below. Please replace the `AKTO_NLB_IP` variable, as obtained from [step 1](#adding-akto-traffic-collector-to-ecs-fargate-cluster).

   ```bash
   {
       "name": "mirror-api-logging",
       "image": "aktosecurity/mirror-api-logging:k8s_agent",
       "cpu": 1024,
       "memory": 1024,
       "portMappings": [],
       "essential": false,
       "environment": [
           {
               "name": "AKTO_TRAFFIC_BATCH_TIME_SECS",
               "value": "10"
           },
           {
               "name": "AKTO_MONGO_CONN",
               "value": "mongodb://0.0.0.0:27017/admini"
           },
           {
               "name": "AKTO_TRAFFIC_BATCH_SIZE",
               "value": "10"
           },
           {
               "name": "AKTO_INFRA_MIRRORING_MODE",
               "value": "gcp"
           },
           {
               "name": "AKTO_KAFKA_BROKER_MAL",
               "value": "<AKTO_NLB_IP>:9092"
           }
       ],
       "environmentFiles": [],
       "mountPoints": [],
       "volumesFrom": [],
       "systemControls": []
   }
   ```

   <figure><img src="https://2916937215-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FRc4KTKGprZI2sPWKoaLe%2Fuploads%2Fgit-blob-5a9890ab26678832272466cc32fbb04566b9ba4c%2Fecs-1.png?alt=media" alt="ECS task definition"><figcaption><p>ECS task definition</p></figcaption></figure>
3. After adding this definition to the task, update the task revision in the service.

   <figure><img src="https://2916937215-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FRc4KTKGprZI2sPWKoaLe%2Fuploads%2Fgit-blob-c2bc758538aa226dabdfcde417dda79208decf4e%2Fecs-3.png?alt=media" alt="Update ECS service"><figcaption><p>Update ECS service</p></figcaption></figure>
4. The containers for the task should show both your primary container and mirror-api-logging container.

   <figure><img src="https://2916937215-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FRc4KTKGprZI2sPWKoaLe%2Fuploads%2Fgit-blob-d4d4a82a565d3127fd727b7130441afb27f980f9%2Fecs-4.png?alt=media" alt="Updated service"><figcaption><p>Updated service</p></figcaption></figure>

## Adding Akto traffic collector to ECS EC2 instances cluster

When the ECS cluster is a EC2 instances cluster, we will create a task definition for the mirror-api-logging container and run the task as a daemonset.

<figure><img src="https://2916937215-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FRc4KTKGprZI2sPWKoaLe%2Fuploads%2Fgit-blob-468779c8ff81296e8fd059e5f3160baf15cb1192%2Fecs-ec2-1.png?alt=media" alt="Cluster configuration"><figcaption><p>Cluster configuration</p></figcaption></figure>

1. Setup Akto data processor using the guide [here](https://docs.akto.io/getting-started/quick-start-with-akto-self-hosted/helm-deploy). Keep the value `AKTO_NLB_IP` handy, as we will need them later.
2. We will create a new task definition with launch type as EC2 instances, network mode host and the container details as follows. You can directly create a new task definition using the JSON given below. You can also refer the screenshots attached. Please replace the `AKTO_NLB_IP` variable, as obtained from [step 1](#adding-akto-traffic-collector-to-ecs-ec2-instances-cluster).

   ```bash
   {
       "family": "mirror-api-logging",
       "containerDefinitions": [
           {
               "name": "mirror-api-logging",
               "image": "aktosecurity/mirror-api-logging:k8s_agent",
               "cpu": 1024, 
               "memory": 1024,
               "portMappings": [],
               "essential": true,
               "environment": [
                   {
                       "name": "AKTO_TRAFFIC_BATCH_TIME_SECS",
                       "value": "10"
                   },
                   {
                       "name": "AKTO_MONGO_CONN",
                       "value": "mongodb://0.0.0.0:27017/admini"
                   },
                   {
                       "name": "AKTO_TRAFFIC_BATCH_SIZE",
                       "value": "10"
                   },
                   {
                       "name": "AKTO_INFRA_MIRRORING_MODE",
                       "value": "gcp"
                   },
                   {
                       "name": "AKTO_KAFKA_BROKER_MAL",
                       "value": "<AKTO_NLB_IP>:9092"
                   }
               ],
               "environmentFiles": [],
               "mountPoints": [],
               "volumesFrom": [],
               "ulimits": [],
               "logConfiguration": {
                   "logDriver": "awslogs",
                   "options": {
                       "awslogs-create-group": "true",
                       "awslogs-group": "/ecs/mirror-api-logging",
                       "awslogs-region": "ap-south-1",
                       "awslogs-stream-prefix": "ecs"
                   },
                   "secretOptions": []
               },
               "systemControls": []
           }
       ],
       "executionRoleArn": "<Use default execution role>",
       "networkMode": "host",
       "requiresCompatibilities": [
           "EC2"
       ],
       "runtimePlatform": {
           "cpuArchitecture": "X86_64",
           "operatingSystemFamily": "LINUX"
       }
   }
   ```

   <figure><img src="https://2916937215-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FRc4KTKGprZI2sPWKoaLe%2Fuploads%2Fgit-blob-9eb36aa834308e9a08ad2c0c0787854fdf27611b%2Fecs-ec2-2.png?alt=media" alt="Task configuration"><figcaption><p>Task configuration</p></figcaption></figure>

   <figure><img src="https://2916937215-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FRc4KTKGprZI2sPWKoaLe%2Fuploads%2Fgit-blob-be6addf66953ad0ba7ba31720bd51e78f4439383%2Fecs-ec2-3.png?alt=media" alt="Task configuration"><figcaption><p>Task configuration</p></figcaption></figure>

   <figure><img src="https://2916937215-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FRc4KTKGprZI2sPWKoaLe%2Fuploads%2Fgit-blob-926458c13b1da66cfcf71447db3f9b0436a81ee0%2Fecs-ec2-4.png?alt=media" alt="Task configuration"><figcaption><p>Task configuration</p></figcaption></figure>

   <figure><img src="https://2916937215-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FRc4KTKGprZI2sPWKoaLe%2Fuploads%2Fgit-blob-51136ef8627ffef5124dc2b30357753b74a14c13%2Fecs-ec2-5.png?alt=media" alt="Task configuration"><figcaption><p>Task configuration</p></figcaption></figure>
3. We will create a daemonset service with launch type EC2. Go to services tab in the ECS cluster and click on `Create`.

   <figure><img src="https://2916937215-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FRc4KTKGprZI2sPWKoaLe%2Fuploads%2Fgit-blob-211eb005aac18dbb7861df7c8f0e6e1ce620bbb7%2Fecs-ec2-6.png?alt=media" alt="Daemonset configuration"><figcaption><p>Daemonset configuration</p></figcaption></figure>
4. Select `Launch type` in `Compute options` and `EC2` in `Launch type`.

   <figure><img src="https://2916937215-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FRc4KTKGprZI2sPWKoaLe%2Fuploads%2Fgit-blob-8e2d53e333be87659ae9519decea5d3e3699ce23%2Fecs-ec2-7.png?alt=media" alt="Daemonset configuration"><figcaption><p>Daemonset configuration</p></figcaption></figure>
5. Select `Service` in `Application type`, select `mirror-api-logging` in `Family` ( The task definition we just created ), enter `mirror-api-logging` as `Service name` and set the `Service type` as `Daemon`. Then click on `Create` on the bottom of the page.

   <figure><img src="https://2916937215-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FRc4KTKGprZI2sPWKoaLe%2Fuploads%2Fgit-blob-f3d2132a07e262d9cb27e30755f3852b321e9b0d%2Fecs-ec2-8.png?alt=media" alt="Daemonset configuration"><figcaption><p>Daemonset configuration</p></figcaption></figure>
6. Voila, you have created a daemonset in ECS. You should see the traffic in Akto dashboard in some time.
