I’m installing and testing Deepfence’s Threatmapper for the first time, an Open Source Cloud Native Application Protection Platform (CNAPP) - To test it against some use cases and understand it a bit better.
Modules tested #
- Cloud Security Posture (CSPM) in AWS (CIS Benchmarks, NIST, etc. compliance scanning)
- I found this module not too worthy: It sets up an ECS task for reasons I don’t understand, which cost money (I let it run for 4 days and it cost me around $15 USD), and we can simply run Prowler for the same exact purpose.
- Linux Security Posture - Configuration assessment
- Internal Vulnerability scans on Linux Hosts
- Secret Scanning (Great feature, but I’ve had issues making it work) - Very interesting feature
- Malware Scanning (Same issue happening) - Very interesting feature
- Public container registry security scan (I’m having a hard time understanding how to specify Docker images and namespaces) - Very interesting feature
Architecture & Deployment #
- Platform: Proxmox
- Amazon Web Services: ECS task (As per Deepfence’s documentation for AWS cloud scanners )
- Networking: Cloudflare Tunnels | Tried Tailscale overlay network but didn’t have success running it in the same AWS ECS task so I weren’t able to establish communication privately between AWS ECS cloud scanner ↔ Deepfence Web Console
- Linux Agent Scanner: Another Debian 12 VM
Terraform Issues #
Had to modify the Terraform template with an updated AWS version provider. Everything went smoothly from here:
provider "aws" {
version = "~> 5.0"
# AWS region: Example: us-east-1
region = "us-east-1"
}
ERRORS & ISSUES #
Secret Scanner in Copilot host always with errors. Inspecting the logs:
