Sold by: Darlene Smith
Deployed on AWS
Control outbound traffic from EKS and ECS workloads with identity-based policies enforced in the Linux kernel using eBPF.
Overview
Talos helps security and platform teams control where individual EKS pods and ECS tasks can connect. Policies follow workload identity instead of changing IP addresses and can allow destinations by hostname, IP range, port, or AWS VPC endpoint.
A single agent runs on each node and enforces outbound connection rules in the Linux kernel using eBPF. This removes the need for per-pod sidecars or proxy hops. Connections that do not match an approved destination are blocked and recorded with the workload identity and matched policy.
Talos also provides baseline learning, connection auditing, anomaly detection, threat intelligence checks, Prometheus metrics, and integrations with CloudWatch, S3, Splunk, Slack, PagerDuty, and Opsgenie. Audit trails and reporting help teams provide evidence for PCI DSS, HIPAA, and SOC 2 controls.
Highlights
- Apply default-deny outbound policies to individual EKS and ECS workloads. Rules remain attached to workload identity during autoscaling and IP address changes.
- Enforce connection rules directly in the Linux kernel with one eBPF agent per node. No per-pod sidecars or additional proxy hop is required.
- Record allowed and blocked connections with workload context. Export events and metrics to CloudWatch, S3, Splunk, Prometheus, and existing alerting tools.
Details
Sold by
Categories
Delivery method
Supported services
Delivery option
Talos eBPF Egress Enforcer
Latest version
Operating system
Linux
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on the duration and terms of your contract with the vendor. This entitles you to a specified quantity of use for the contract duration. If you choose not to renew or replace your contract before it ends, access to these entitlements will expire.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Description | Cost/12 months |
|---|---|---|
Core Protection | Egress policy enforcement for up to 50 EKS workloads. | $500.00 |
Advanced Security | Egress enforcement, anomaly detection, and security integrations for up to 500 EKS or ECS workloads. | $2,000.00 |
Fleet Governance | Unlimited workload protection with multi-cluster management, RBAC, compliance reporting, and dedicated support. | $5,000.00 |
Dimensions summary
You buy by contract, and pricing is metered by the number of enforced workloads. Three tiers scale with workload count and capability. Core Protection covers up to 50 EKS workloads with egress policy enforcement. Advanced Security covers up to 500 EKS or ECS workloads and adds anomaly detection plus security integrations. Fleet Governance removes the workload limit and adds multi-cluster management, RBAC, compliance reporting, and dedicated support. As your workload count and governance needs grow, you move up tiers. Metering is per workload, not per node.
Top-of-mind questions for buyers
A workload is a running pod on EKS or a task on ECS, not a node. Many small pods packed onto one node each count separately. Because metering is per workload, dense nodes do not raise your bill by node count alone.
Each tier covers a set workload ceiling. Core Protection covers up to 50 EKS workloads. Advanced Security covers up to 500 EKS or ECS workloads. Fleet Governance removes the limit. To protect more workloads than your tier allows, you move to the next tier.
Core Protection gives in-kernel default-deny enforcement on EKS. Advanced Security adds behavioral anomaly detection and security integrations across EKS and ECS. Fleet Governance adds multi-cluster management, RBAC, compliance reporting, and dedicated support. Capability grows as you move up tiers, alongside the workload limit.
darlenetalos.com
Helpful?
Vendor refund policy
You may request a full refund within 14 days of purchase if Talos has not been used in production. After 14 days, payments are non-refundable except where required by law or agreed service commitments. Contact aws_support@darlenetalos.com with your AWS account ID, agreement ID, and reason for the request. Approved refunds are processed through AWS Marketplace.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
Talos eBPF Egress Enforcer
Supported services: Learn more
- Amazon ECS
Container image
Containers are lightweight, portable execution environments that wrap server application software in a filesystem that includes everything it needs to run. Container applications run on supported container runtimes and orchestration services, such as Amazon Elastic Container Service (Amazon ECS) or Amazon Elastic Kubernetes Service (Amazon EKS). Both eliminate the need for you to install and operate your own container orchestration software by managing and scheduling containers on a scalable cluster of virtual machines.
Version release notes
Initial release of Talos egress enforcement. This version includes IPv4 default-deny policies, CIDR and exact-IP rules, in-kernel eBPF enforcement, connection auditing, Prometheus metrics, and a live event stream.
Additional details
Usage instructions
Talos runs as a privileged container on an ARM64 Linux host. It requires Docker, cgroup v2, and access to the host kernel. For Amazon ECS, use the EC2 launch type. AWS Fargate is not supported.
CONTAINER IMAGE
709825985650.dkr.ecr.us-east-1.amazonaws.com/darlene-smith/talos:1.0.0
QUICK START
- Sign in to the container registry:
aws ecr get-login-password --region us-east-1 | docker login --username AWS --password-stdin 709825985650.dkr.ecr.us-east-1.amazonaws.com
- Pull the Talos image:
docker pull 709825985650.dkr.ecr.us-east-1.amazonaws.com/darlene-smith/talos:1.0.0
- Run the built-in enforcement test:
docker run --rm --privileged
-v /sys/fs/cgroup:/sys/fs/cgroup
709825985650.dkr.ecr.us-east-1.amazonaws.com/darlene-smith/talos:1.0.0 demo
The test is successful when the final message says:
OK: allowed connection succeeded, denied connection blocked in-kernel.
RUN TALOS WITH A POLICY
- Create a file named policy.yaml:
cat > policy.yaml <<'EOF' apiVersion: egress.talos.dev/v1alpha1 kind: EgressPolicy metadata: name: application-egress spec: workload: application defaultAction: deny allow: - cidr: 10.0.0.0/16 name: private-network - cidr: 127.0.0.1/32 name: local-services - ip: 34.223.14.10 ports: [443] name: approved-api EOF
Replace the example addresses with the networks and services required by your workload. Connections that are not included in the policy will be blocked.
- Validate the policy:
docker run --rm
-v "$PWD/policy.yaml:/etc/talos/policy.yaml:ro"
709825985650.dkr.ecr.us-east-1.amazonaws.com/darlene-smith/talos:1.0.0
policy compile /etc/talos/policy.yaml
- Start Talos:
docker run -d
--name talos
--restart unless-stopped
--privileged
--network host
-v /sys/fs/cgroup:/sys/fs/cgroup
-v "$PWD/policy.yaml:/etc/talos/policy.yaml:ro"
-e TALOS_POLICY=/etc/talos/policy.yaml
709825985650.dkr.ecr.us-east-1.amazonaws.com/darlene-smith/talos:1.0.0 agent
- Check the service:
curl http://127.0.0.1:9107/healthz
A healthy installation returns:
ok
- View Prometheus metrics:
curl http://127.0.0.1:9107/metrics
- Watch blocked connections:
curl -N "http://127.0.0.1:9107/api/v1/events?deny=1 "
- Stop and remove Talos:
docker rm -f talos
Support
Vendor support
Community support is available for the free tier through the Talos GitHub repository. Business customers receive email and chat support. Enterprise customers receive dedicated support with response times defined in their service agreement.
email: aws_support@darlenetalos.com
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
Protect your dynamic cloud environments with consistent security, superior visibility, and advanced threat defense such as application visibility and control, deep packet inspection, IPS, malware defense, and URL filtering - powered by Cisco Talos® Threat Intelligence. Achieve deeper visibility into QUIC and TLS 1.3 traffic without breaking Layer 7 policies.
Protect your dynamic cloud environments with consistent security, superior visibility, and advanced threat defense such as application visibility and control, deep packet inspection, IPS, malware defense, and URL filtering - powered by Cisco Talos® Threat Intelligence. Achieve deeper visibility into QUIC and TLS 1.3 traffic without breaking Layer 7 policies.
The only email security solution offering Cisco ESA and Cisco Talos threat intelligence on a pay-as-you-go basis. Cloud-native protection against phishing, ransomware, BEC, and impersonation with nothing to install and no minimum commitments.
Centralize and simplify your firewall administration and intrusion prevention. Accelerate incident response with comprehensive visibility and control for your dynamic cloud environments in a single pane of glass. Gain additional context with instant access to Cisco SecureX through our built-in ribbon.
Cisco Breach Protection Suite provides a comprehensive cybersecurity solution that enhances detection and response capabilities by unifying visibility, prioritizing and contextualizing threats, and empowering analysts to achieve new levels of efficiency.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.