CrowdStrike Falcon EKS Protection

An automated solution for deploying CrowdStrike Falcon Operator, Sensor, KAC and ImageAnalyzer to EKS clusters across your AWS Organization using event-driven architecture.

Demo

Usage Guides

✨ Features

• 🚀 Event-Driven Automation: Automatically installs Falcon components when EKS clusters are created
• 🎯 Intelligent Sensor Selection: Auto-detects cluster type and deploys appropriate sensors
• 🔒 Secure: API credentials stored in AWS Secrets Manager
• 📊 Observable: Complete CloudWatch logging with structured output
• 🌐 Self-Contained Infrastructure: Creates own VPC and networking
• 🏢 Organization Support: Deploy across AWS Organizations or single accounts

⚙️ How It Works

1. Infrastructure Setup

• Self-Contained: ECS Task runs in a dedicated VPC, subnets, NAT Gateway, and security groups
• Container Image: Uses public amazon/aws-cli:2.15.30 image
  • pre-installed tools: aws-cli
  • installs dependencies and pulls latest scripts from GitHub at runtime

2. Script Details

• Event Handler: Retrieves event data and configures ECS Task environment with required variables such as Cluster name, AWS Account ID, AWS Region
• Setup Script: Adds the ECS Task ARN to the EKS Cluster Access entries and the ECS Task VPC NAT IP address to the inbound CIDR list
• Deploy Script: Determines sensor type and apply Falcon Operator and Falcon Deployment Components using kubectl
• Falcon Deployment: YAML manifest template with dynamic parameter substitution stored in Parameter Store

3. Enhanced Event-Driven Architecture

• EventBridge Rule: Triggers when EKS clusters are created
• Centralized Custom EventBus: EventBridge Rules across the AWS Organization target this to allow for a single, centralized ECS Cluster.
• ECS Fargate Task: Invoked via EventBridge rule to run EKS Protection Scripts

4. Intelligent Sensor Deployment

• Auto Mode: Set SensorType = auto to automatically select appropriate sensors based on cluster type
  • Fargate-only clusters → Falcon Container sensor
  • Node-based clusters → Falcon Node sensor
  • Hybrid clusters → Falcon Node sensor & Falcon Container sensor
• Manual Override: Set SensorType to node, container or both to force a sensor type and bypass cluster type detection

Container Sensor Injection Behavior

• Container sensor injection disabled by default
• falcon-sidecar-injector pods may run but only inject the container sensor if Fargate pods are labeled.
• This prevents duplicative sensors when running hybrid clusters (EC2 and Fargate) and allows both DEPLOY_FALCON_NODE_SENSOR = true and DEPLOY_FALCON_CONTAINER = true.

NOTE: Use the following label to inject Falcon Container to your pods
falcon.crowdstrike.com/inject: "true"

📊 Event-Driven Architecture

EKS Cluster Creation → EventBridge → Centralized EventBus → ECS Fargate Task
                           ↓                                     ↓
                     Get cluster name,                      amazon/aws-cli:2.15.30
                     region, account Id                     (in private VPC)
                                                                 ↓
                                                            Secrets Manager
                                                            (Falcon API credentials)
                                                                 ↓
                                                            GitHub Repository
                                                            (curl latest scripts)
                                                                 ↓
                                                            Parameter Store
                                                            (Falcon Deployment manifest)
                                                                 ↓
                                                            Apply Falcon Operator Deployment
                                                            (with auto-detection)

📋 CloudFormation Parameters

The following table describes all parameters available when deploying the CloudFormation template:

Parameter Notes

• Falcon API Credentials: All three Falcon parameters (FalconClientId, FalconClientSecret, FalconCloud) are required for deployment
• Organization Deployment: When Scope is set to organization, you must also provide OrganizationId and OUs
• Sensor Type Auto-Detection: When FalconSensorType is set to auto, the system automatically selects the appropriate sensor based on cluster configuration
• kubectl Version Compatibility: kubectl version 1.33.0 is compatible with Kubernetes versions 1.31-1.34. Ensure kubectl version compatibility with your target Kubernetes cluster versions. Typically the kubectl version should be within 1 minor and 1 major version of your kubernetes cluster version.
• Secure Parameters: FalconClientId and FalconClientSecret are marked as NoEcho and will be stored securely in AWS Secrets Manager

📄 Support and License

License

This project is licensed under the MIT License - see the LICENSE file for details.

Support

This is a community-driven, open source project. While it is not an official CrowdStroke product, it is actively maintained by CrowdStrike and supported in collaboration with the open source developer community.

For more information, please see our SUPPORT file.