Running Tetragon in AWS CodeBuild to Block npm postinstall Network Access

Description and use

Tetragon in AWS CodeBuild blocks unwanted network requests initiated by npm postinstall scripts, enhancing CI security.

Problem

npm postinstall scripts can initiate unwanted network connections, exposing CI environments to potential attacks.

Outcome

In enforce mode, Tetragon successfully blocked the curl network request initiated by a postinstall script, preventing outbound traffic while allowing the CI job to finish.

Workflow

• Create demo/victim and demo/compromised-dependency projects
• Add postinstall script that runs /usr/bin/curl
• Configure CodeBuild runner with privileged mode and Linux 6 kernel
• Start Tetragon in PRE_BUILD phase
• Add TracingPolicy to block curl egress to non‑127.0.0.0/8
• Run job in baseline, observe, and enforce modes
• Verify curl exit status and dummy value receipt

Evidence

Only in enforce mode was curl terminated with SIGKILL, and no receive record was created.

Source

Tetragon starts during the CodeBuild PRE_BUILD phase, after which the GitHub Actions job is executed.

Source