Tetragon eBPF Runtime Security Observability

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Kernel-Level Runtime Security Running in Minutes, Not Hours

Tetragon is Cilium's eBPF-based runtime security observability and enforcement engine, a CNCF project trusted across the cloud-native ecosystem. This AMI delivers a fully hardened, production-ready Tetragon host agent so your team gains kernel-level visibility into process execution, file access, network activity and privileged system calls without spending hours on manual deployment and lockdown.

The current release available is Tetragon 1.7.0.

## What You Get: A Security Appliance, Not a Bare Binary

• Pinned upstream release - the official Tetragon 1.7.0 release tarball, verified against the project's published SHA256 checksum, installed as a standard systemd service.
• Meaningful events from first boot - a default TracingPolicy set monitors reads of sensitive files (/etc/shadow, /etc/sudoers, /root/.ssh), writes to system binary and configuration directories, and setuid privileged syscalls, on top of Tetragon's always-on process execution and exit events.
• Structured JSON export - events are written to /var/log/tetragon/tetragon.log for your log shipper, SIEM or CI pipeline, and can be streamed live with `tetra getevents`.
• Provable on your own instance - a bundled self-test triggers a monitored action and confirms the matching event is produced, so you can verify the engine works end to end before relying on it.
• Extensible policies - drop your own TracingPolicy YAML files into /etc/tetragon/tetragon.tp.d/ and restart the service to extend or tighten what the host observes.

## Secure By Default

The gRPC control interface is a loopback-only unix socket, metrics and profiling endpoints are disabled, and the health port is pinned to loopback and additionally guarded by an nftables rule so it is never reachable off-box. SSH with your launch key is the only open port. The image ships no default credential of any kind, unattended security upgrades are enabled, and the OS is fully patched at capture.

## What You Avoid By Using This AMI

• Fetching and checksum-verifying the upstream release and wiring it into systemd
• Writing a hardened daemon configuration and an initial monitoring policy set
• Locking down the gRPC control socket and the health port
• Proving end to end that a monitored action actually produces an event
• Ongoing maintenance and security patching without expert guidance

## Use Cases With Context

Security-conscious SaaS teams running single-tenant instances - monitor each customer-facing host for unauthorized credential reads or binary modifications without deploying a full Kubernetes stack. Structured JSON events feed directly into your existing SIEM.

DevOps teams operating bastion hosts or CI runners - detect unexpected process execution or privilege escalation on infrastructure hosts that sit outside your container orchestration layer. The self-test proves coverage is active after every deployment.

Compliance-driven organizations preparing for audits - gain kernel-level evidence of file-access patterns and privileged syscall usage to satisfy auditor requests for runtime monitoring controls, with events exportable to any log pipeline.

## cloudimg Support - Available 24/7

24/7 technical support by email and live chat with a one-hour average response for critical issues. Our engineers help with deployment, writing and tuning TracingPolicies, shipping events to your SIEM, and scaling across your fleet.

## Resources

For detailed TracingPolicy examples, event schema documentation and deployment guidance, see the official Tetragon documentation at tetragon.io/docs.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.