Running Tetragon in AWS CodeBuild to Block npm postinstall Network Access

说明与用途

Tetragon 在 AWS CodeBuild 中阻止 npm postinstall 脚本发起的网络请求，提升 CI 安全性。

问题

npm postinstall scripts can initiate unwanted network connections, exposing CI environments to potential attacks.

结果

In enforce mode, Tetragon successfully blocked the curl network request initiated by a postinstall script, preventing outbound traffic while allowing the CI job to finish.

工作流

• Create demo/victim and demo/compromised-dependency projects
• Add postinstall script that runs /usr/bin/curl
• Configure CodeBuild runner with privileged mode and Linux 6 kernel
• Start Tetragon in PRE_BUILD phase
• Add TracingPolicy to block curl egress to non‑127.0.0.0/8
• Run job in baseline, observe, and enforce modes
• Verify curl exit status and dummy value receipt

证据

Only in enforce mode was curl terminated with SIGKILL, and no receive record was created.

来源

Tetragon starts during the CodeBuild PRE_BUILD phase, after which the GitHub Actions job is executed.

来源