: Container Security on AWS using EKS + Falco AWS Inspector Runtime Protection

As containerized applications scale and Kubernetes clusters transition into production environments, the security perimeter has fundamentally shifted. Securing your cloud infrastructure goes beyond basic IAM policies and static image checks; instead, containerized workloads require a continuous defense-in-depth model that operates across the entire software lifecycle—from image build to live runtime.
Because static vulnerability scans cannot protect against zero-day exploits, runtime file manipulations, or unauthorized shell executions inside active pods, traditional boundary security falls short. A single unpatched container vulnerability or a compromised container runtime is all an attacker needs to break out of pod isolation and move laterally through your cluster.
Join us for an interactive, technical study series session where speaker Jattow Oreoluwa will dive deep into building a robust container security architecture using EKS, Falco, AWS Inspector, and Runtime Protection.

📅 Date: Saturday, August 8th, 2026
⏰ Time: 6:00 PM – 7:00 PM WAT
📍 Location: Virtual
Meet Our Speakers
🎤 Speaker: Oreoluwa Jetawo – Cybersecurity/DevSecOps
🎤 Moderator: Kadri Saed –AWS Community Builder

### 📋 What We’ll Cover

We are stripping away the high-level slides to focus on concrete, production-ready patterns:

• The Container Threat Landscape on AWS EKS: Understanding the Kubernetes attack surface—from control plane risks and exposed node agents to malicious pod executions and container breakouts.
• Shift-Left Vulnerability Scanning with AWS Inspector: How to automate continuous scanning of container images in Amazon ECR to catch OS and language-level vulnerabilities before code hits production.
• Real-Time Runtime Threat Detection with Falco: Leveraging eBPF kernel tracing to detect abnormal pod behavior in real time—including unauthorized shell executions (`/bin/bash`), sensitive file modifications, and suspicious outbound network traffic.
• Automated Incident Response & Runtime Protection: Connecting Falco alerts to AWS EventBridge and AWS Lambda to build automated mitigation workflows that isolate compromised pods and revoke compromised access instantly.