Running Tetragon in AWS CodeBuild to Block npm postinstall Network Access

Описание и применение

Тетроген в AWS CodeBuild блокирует нежелательные сетевые запросы, инициируемые скриптами postinstall в npm, обеспечивая безопасность CI.

Задача

npm postinstall scripts can initiate unwanted network connections, exposing CI environments to potential attacks.

Результат

In enforce mode, Tetragon successfully blocked the curl network request initiated by a postinstall script, preventing outbound traffic while allowing the CI job to finish.

Рабочий процесс

• Create demo/victim and demo/compromised-dependency projects
• Add postinstall script that runs /usr/bin/curl
• Configure CodeBuild runner with privileged mode and Linux 6 kernel
• Start Tetragon in PRE_BUILD phase
• Add TracingPolicy to block curl egress to non‑127.0.0.0/8
• Run job in baseline, observe, and enforce modes
• Verify curl exit status and dummy value receipt

Доказательства

Only in enforce mode was curl terminated with SIGKILL, and no receive record was created.

Источник

Tetragon starts during the CodeBuild PRE_BUILD phase, after which the GitHub Actions job is executed.

Источник