Aqua Runtime Security in Java: Complete Implementation Guide

Introduction to Aqua Runtime Security

Aqua Security provides runtime security for cloud-native applications, focusing on container security, vulnerability management, and runtime protection. Aqua Runtime Security monitors application behavior, detects threats, and prevents attacks in real-time.

Key Features

Runtime Threat Detection: Monitors process behavior, network activity, and file system operations
Container Security: Provides security for Docker and Kubernetes environments
Vulnerability Management: Scans containers for known vulnerabilities
Compliance Enforcement: Ensures compliance with security policies
Behavioral Monitoring: Detects anomalies in application behavior
Forensic Data: Provides detailed audit trails for security incidents

Implementation Guide

Dependencies and Setup

Maven Configuration (pom.xml)

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 
http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.example</groupId>
<artifactId>aqua-runtime-demo</artifactId>
<version>1.0.0</version>
<packaging>jar</packaging>
<properties>
<maven.compiler.source>11</maven.compiler.source>
<maven.compiler.target>11</maven.compiler.target>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<!-- Spring Boot -->
<spring.boot.version>3.1.0</spring.boot.version>
<!-- Security -->
<bouncycastle.version>1.70</bouncycastle.version>
<jwt.version>4.4.0</jwt.version>
<!-- Monitoring -->
<micrometer.version>1.11.0</micrometer.version>
<opentelemetry.version>1.28.0</opentelemetry.version>
</properties>
<dependencyManagement>
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-dependencies</artifactId>
<version>${spring.boot.version}</version>
<type>pom</type>
<scope>import</scope>
</dependency>
</dependencies>
</dependencyManagement>
<dependencies>
<!-- Spring Boot Starters -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-web</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-actuator</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-data-jpa</artifactId>
</dependency>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-validation</artifactId>
</dependency>
<!-- Database -->
<dependency>
<groupId>com.h2database</groupId>
<artifactId>h2</artifactId>
<scope>runtime</scope>
</dependency>
<dependency>
<groupId>org.postgresql</groupId>
<artifactId>postgresql</artifactId>
<scope>runtime</scope>
</dependency>
<!-- Security Libraries -->
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk15on</artifactId>
<version>${bouncycastle.version}</version>
</dependency>
<dependency>
<groupId>com.auth0</groupId>
<artifactId>java-jwt</artifactId>
<version>${jwt.version}</version>
</dependency>
<!-- Monitoring & Observability -->
<dependency>
<groupId>io.micrometer</groupId>
<artifactId>micrometer-core</artifactId>
</dependency>
<dependency>
<groupId>io.micrometer</groupId>
<artifactId>micrometer-registry-prometheus</artifactId>
</dependency>
<dependency>
<groupId>io.opentelemetry</groupId>
<artifactId>opentelemetry-api</artifactId>
<version>${opentelemetry.version}</version>
</dependency>
<!-- Aqua Security SDK (Hypothetical) -->
<dependency>
<groupId>com.aquasec</groupId>
<artifactId>aqua-runtime-sdk</artifactId>
<version>1.0.0</version>
</dependency>
<!-- Test Dependencies -->
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.springframework.security</groupId>
<artifactId>spring-security-test</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
<version>${spring.boot.version}</version>
<executions>
<execution>
<goals>
<goal>repackage</goal>
</goals>
</execution>
</executions>
</plugin>
<!-- Docker Build Plugin -->
<plugin>
<groupId>com.spotify</groupId>
<artifactId>dockerfile-maven-plugin</artifactId>
<version>1.4.13</version>
<executions>
<execution>
<id>default</id>
<goals>
<goal>build</goal>
</goals>
</execution>
</executions>
<configuration>
<repository>aqua-runtime-demo</repository>
<tag>${project.version}</tag>
</configuration>
</plugin>
</plugins>
</build>
</project>

Docker Configuration with Aqua Security

Dockerfile with Security Hardening

# Multi-stage build for secure Java application
FROM eclipse-temurin:11-jdk as builder
# Security: Use non-root user during build
RUN groupadd -r spring && useradd -r -g spring spring
USER spring:spring
WORKDIR /app
# Copy Maven wrapper and pom.xml
COPY --chown=spring:spring mvnw .
COPY --chown=spring:spring .mvn .mvn
COPY --chown=spring:spring pom.xml .
# Copy source code
COPY --chown=spring:spring src ./src
# Build the application
RUN ./mvnw clean package -DskipTests
# Runtime stage with security hardening
FROM aquasec/trivy:0.45.1 as scanner
WORKDIR /app
COPY --from=builder /app/target/*.jar app.jar
# Scan the application for vulnerabilities
RUN trivy filesystem --exit-code 1 --severity HIGH,CRITICAL /
# Final runtime stage
FROM eclipse-temurin:11-jre-jammy
# Security: Install security updates
RUN apt-get update && \
apt-get upgrade -y && \
apt-get clean && \
rm -rf /var/lib/apt/lists/*
# Security: Create non-root user
RUN groupadd -r spring && useradd -r -g spring spring
# Security: Create application directory with proper permissions
RUN mkdir -p /app && chown spring:spring /app
WORKDIR /app
# Security: Copy application as non-root user
COPY --from=builder --chown=spring:spring /app/target/*.jar app.jar
# Security: Create directories for Aqua runtime
RUN mkdir -p /aqua/runtime /aqua/logs /aqua/config && \
chown -R spring:spring /aqua
# Security: Set filesystem permissions
RUN chmod 755 /app && \
chmod 644 /app/app.jar && \
chmod 750 /aqua
# Switch to non-root user
USER spring:spring
# Aqua Runtime Environment Variables
ENV AQUA_ENABLED=true
ENV AQUA_RUNTIME_MONITORING=true
ENV AQUA_THREAT_DETECTION=true
ENV AQUA_LOG_LEVEL=INFO
ENV AQUA_CONFIG_PATH=/aqua/config
ENV AQUA_LOG_PATH=/aqua/logs
# Expose application port
EXPOSE 8080
# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=60s --retries=3 \
CMD curl -f http://localhost:8080/actuator/health || exit 1
# Security: Use exec form for proper signal handling
ENTRYPOINT ["java", "-jar", "app.jar"]

Docker Compose with Aqua Security

version: '3.8'
services:
aqua-runtime-app:
build: .
container_name: aqua-runtime-demo
ports:
- "8080:8080"
environment:
- SPRING_PROFILES_ACTIVE=docker
- AQUA_ENABLED=true
- AQUA_RUNTIME_MONITORING=true
- AQUA_CONFIG_PATH=/aqua/config
- AQUA_LOG_PATH=/aqua/logs
volumes:
- aqua-config:/aqua/config
- aqua-logs:/aqua/logs
- /var/run/docker.sock:/var/run/docker.sock:ro
security_opt:
- no-new-privileges:true
read_only: true
tmpfs:
- /tmp
cap_drop:
- ALL
cap_add:
- NET_BIND_SERVICE
networks:
- aqua-network
# Aqua Security Enforcer (Example)
aqua-enforcer:
image: aquasec/enforcer:6.5
container_name: aqua-enforcer
environment:
- AQUA_SERVER=aqua-server:8080
- AQUA_TOKEN=${AQUA_TOKEN}
volumes:
- /var/run/docker.sock:/var/run/docker.sock
- /proc:/host/proc:ro
- /sys:/host/sys:ro
- /dev:/host/dev:ro
privileged: true
networks:
- aqua-network
# Monitoring stack
prometheus:
image: prom/prometheus:latest
ports:
- "9090:9090"
volumes:
- ./monitoring/prometheus.yml:/etc/prometheus/prometheus.yml
networks:
- aqua-network
grafana:
image: grafana/grafana:latest
ports:
- "3000:3000"
environment:
- GF_SECURITY_ADMIN_PASSWORD=admin
volumes:
- ./monitoring/grafana-dashboard.yml:/etc/grafana/provisioning/dashboards/dashboard.yml
networks:
- aqua-network
volumes:
aqua-config:
aqua-logs:
networks:
aqua-network:
driver: bridge

Aqua Runtime Security Integration

Aqua Runtime Security Service

package com.example.aqua.service;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Value;
import org.springframework.scheduling.annotation.Scheduled;
import org.springframework.stereotype.Service;
import java.io.File;
import java.lang.management.ManagementFactory;
import java.lang.management.RuntimeMXBean;
import java.net.InetAddress;
import java.net.NetworkInterface;
import java.nio.file.Files;
import java.nio.file.Path;
import java.nio.file.Paths;
import java.time.LocalDateTime;
import java.util.*;
/**
* Aqua Runtime Security Service
* Monitors application runtime behavior and security events
*/
@Service
public class AquaRuntimeSecurityService {
private static final Logger logger = LoggerFactory.getLogger(AquaRuntimeSecurityService.class);
@Value("${aqua.runtime.enabled:true}")
private boolean aquaEnabled;
@Value("${aqua.threat.detection.enabled:true}")
private boolean threatDetectionEnabled;
@Value("${aqua.monitoring.interval:30000}")
private long monitoringInterval;
private final List<SecurityEvent> securityEvents = Collections.synchronizedList(new ArrayList<>());
private final RuntimeSecurityMetrics securityMetrics = new RuntimeSecurityMetrics();
/**
* Initialize Aqua runtime security
*/
public void initialize() {
if (!aquaEnabled) {
logger.info("Aqua runtime security is disabled");
return;
}
logger.info("Initializing Aqua runtime security...");
// Perform initial security assessment
performSecurityAssessment();
// Start background monitoring
startRuntimeMonitoring();
logger.info("Aqua runtime security initialized successfully");
}
/**
* Perform comprehensive security assessment
*/
public SecurityAssessment performSecurityAssessment() {
SecurityAssessment assessment = new SecurityAssessment();
assessment.setAssessmentTime(LocalDateTime.now());
try {
// Check container environment
assessment.setContainerized(isContainerized());
// Check security controls
assessment.setSecurityControls(checkSecurityControls());
// Check file system permissions
assessment.setFileSystemSecurity(checkFileSystemSecurity());
// Check network security
assessment.setNetworkSecurity(checkNetworkSecurity());
// Check runtime security
assessment.setRuntimeSecurity(checkRuntimeSecurity());
// Calculate overall security score
assessment.calculateSecurityScore();
logSecurityEvent(SecurityEvent.createAssessmentEvent(
"Security assessment completed", 
"ASSESSMENT", 
"INFO",
assessment.getSecurityScore()
));
} catch (Exception e) {
logger.error("Error during security assessment", e);
assessment.setError(e.getMessage());
}
return assessment;
}
/**
* Monitor runtime behavior
*/
@Scheduled(fixedRateString = "${aqua.monitoring.interval:30000}")
public void monitorRuntime() {
if (!aquaEnabled) return;
try {
// Monitor process behavior
monitorProcessBehavior();
// Monitor file system activity
monitorFileSystemActivity();
// Monitor network activity
monitorNetworkActivity();
// Monitor system resources
monitorSystemResources();
// Update security metrics
updateSecurityMetrics();
} catch (Exception e) {
logger.error("Error during runtime monitoring", e);
logSecurityEvent(SecurityEvent.createErrorEvent(
"Runtime monitoring error", 
"MONITORING", 
"ERROR",
e.getMessage()
));
}
}
/**
* Monitor process behavior for anomalies
*/
private void monitorProcessBehavior() {
RuntimeMXBean runtimeMXBean = ManagementFactory.getRuntimeMXBean();
// Check JVM arguments for security issues
List<String> inputArguments = runtimeMXBean.getInputArguments();
for (String arg : inputArguments) {
if (isSuspiciousJVMArgument(arg)) {
logSecurityEvent(SecurityEvent.createThreatEvent(
"Suspicious JVM argument detected: " + arg,
"PROCESS_MONITORING",
"HIGH",
"JVM_ARGUMENT_ANOMALY"
));
securityMetrics.incrementSuspiciousArguments();
}
}
// Monitor thread count
int threadCount = ManagementFactory.getThreadMXBean().getThreadCount();
if (threadCount > 1000) { // Threshold for demo
logSecurityEvent(SecurityEvent.createWarningEvent(
"High thread count detected: " + threadCount,
"RESOURCE_MONITORING",
"MEDIUM"
));
}
}
/**
* Monitor file system activity
*/
private void monitorFileSystemActivity() {
try {
// Check critical directories
String[] criticalDirs = {"/etc", "/bin", "/sbin", "/usr/bin"};
for (String dir : criticalDirs) {
Path path = Paths.get(dir);
if (Files.exists(path)) {
checkDirectoryPermissions(path);
}
}
// Monitor application directories
Path appDir = Paths.get(System.getProperty("user.dir"));
checkDirectoryPermissions(appDir);
} catch (Exception e) {
logger.warn("Error monitoring file system activity", e);
}
}
/**
* Monitor network activity
*/
private void monitorNetworkActivity() {
try {
Enumeration<NetworkInterface> interfaces = NetworkInterface.getNetworkInterfaces();
while (interfaces.hasMoreElements()) {
NetworkInterface networkInterface = interfaces.nextElement();
// Check for suspicious network interfaces
if (isSuspiciousNetworkInterface(networkInterface)) {
logSecurityEvent(SecurityEvent.createThreatEvent(
"Suspicious network interface detected: " + networkInterface.getName(),
"NETWORK_MONITORING",
"HIGH",
"NETWORK_INTERFACE_ANOMALY"
));
securityMetrics.incrementSuspiciousInterfaces();
}
}
} catch (Exception e) {
logger.warn("Error monitoring network activity", e);
}
}
/**
* Monitor system resources
*/
private void monitorSystemResources() {
Runtime runtime = Runtime.getRuntime();
long maxMemory = runtime.maxMemory();
long totalMemory = runtime.totalMemory();
long freeMemory = runtime.freeMemory();
long usedMemory = totalMemory - freeMemory;
double memoryUsage = (double) usedMemory / maxMemory;
if (memoryUsage > 0.8) { // 80% threshold
logSecurityEvent(SecurityEvent.createWarningEvent(
"High memory usage detected: " + (memoryUsage * 100) + "%",
"RESOURCE_MONITORING",
"MEDIUM"
));
}
}
/**
* Check if running in container
*/
private boolean isContainerized() {
try {
// Check for container indicators
File dockerEnv = new File("/.dockerenv");
if (dockerEnv.exists()) {
return true;
}
// Check cgroups
File cgroup = new File("/proc/1/cgroup");
if (cgroup.exists()) {
String content = Files.readString(cgroup.toPath());
return content.contains("docker") || content.contains("kubepods");
}
} catch (Exception e) {
logger.debug("Error checking container environment", e);
}
return false;
}
/**
* Check security controls
*/
private Map<String, Boolean> checkSecurityControls() {
Map<String, Boolean> controls = new HashMap<>();
// Check various security controls
controls.put("non_root_user", !"root".equals(System.getProperty("user.name")));
controls.put("file_permissions", checkFilePermissions());
controls.put("network_restrictions", checkNetworkRestrictions());
controls.put("resource_limits", checkResourceLimits());
controls.put("security_manager", System.getSecurityManager() != null);
return controls;
}
/**
* Check file system security
*/
private FileSystemSecurity checkFileSystemSecurity() {
FileSystemSecurity fsSecurity = new FileSystemSecurity();
try {
// Check critical file permissions
String[] criticalFiles = {"/etc/passwd", "/etc/shadow", "/etc/hosts"};
for (String filePath : criticalFiles) {
File file = new File(filePath);
if (file.exists()) {
FileSecurityInfo info = checkFileSecurity(file);
fsSecurity.addFileSecurity(filePath, info);
}
}
// Check application directory
File appDir = new File(System.getProperty("user.dir"));
FileSecurityInfo appDirInfo = checkFileSecurity(appDir);
fsSecurity.setApplicationDirectorySecurity(appDirInfo);
} catch (Exception e) {
logger.error("Error checking file system security", e);
}
return fsSecurity;
}
/**
* Check network security
*/
private NetworkSecurity checkNetworkSecurity() {
NetworkSecurity networkSecurity = new NetworkSecurity();
try {
// Check listening ports
networkSecurity.setOpenPorts(checkOpenPorts());
// Check network interfaces
networkSecurity.setNetworkInterfaces(checkNetworkInterfaces());
// Check DNS configuration
networkSecurity.setDnsSecurity(checkDnsSecurity());
} catch (Exception e) {
logger.error("Error checking network security", e);
}
return networkSecurity;
}
/**
* Check runtime security
*/
private RuntimeSecurity checkRuntimeSecurity() {
RuntimeSecurity runtimeSecurity = new RuntimeSecurity();
try {
// Check JVM security properties
runtimeSecurity.setJvmSecurity(checkJvmSecurity());
// Check system properties
runtimeSecurity.setSystemProperties(checkSystemProperties());
// Check environment variables
runtimeSecurity.setEnvironmentVariables(checkEnvironmentVariables());
} catch (Exception e) {
logger.error("Error checking runtime security", e);
}
return runtimeSecurity;
}
/**
* Log security event
*/
public void logSecurityEvent(SecurityEvent event) {
securityEvents.add(event);
securityMetrics.recordEvent(event);
// Log based on severity
switch (event.getSeverity()) {
case "HIGH":
logger.warn("HIGH severity security event: {}", event.getMessage());
break;
case "MEDIUM":
logger.info("MEDIUM severity security event: {}", event.getMessage());
break;
case "LOW":
logger.debug("LOW severity security event: {}", event.getMessage());
break;
default:
logger.info("Security event: {}", event.getMessage());
}
// In production, this would send to Aqua security platform
if (threatDetectionEnabled && "HIGH".equals(event.getSeverity())) {
handleHighSeverityEvent(event);
}
}
/**
* Handle high severity security events
*/
private void handleHighSeverityEvent(SecurityEvent event) {
// Implement threat response logic
logger.error("HIGH severity threat detected: {}", event.getMessage());
// Could trigger automated responses like:
// - Block suspicious IPs
// - Restrict file system access
// - Alert security team
// - Scale down affected containers
}
/**
* Start runtime monitoring
*/
private void startRuntimeMonitoring() {
logger.info("Starting Aqua runtime monitoring...");
// Implementation would start various monitoring threads
}
/**
* Update security metrics
*/
private void updateSecurityMetrics() {
// Update various security metrics
securityMetrics.setActiveEvents(securityEvents.size());
securityMetrics.setLastUpdate(LocalDateTime.now());
}
// Helper methods for security checks
private boolean isSuspiciousJVMArgument(String arg) {
return arg.contains("-Xdebug") || 
arg.contains("-Xrunjdwp") ||
arg.contains("-javaagent") && !arg.contains("aqua");
}
private boolean isSuspiciousNetworkInterface(NetworkInterface networkInterface) {
return networkInterface.isVirtual() && 
!networkInterface.isLoopback() &&
networkInterface.isUp();
}
private boolean checkFilePermissions() {
// Implementation for file permission checks
return true;
}
private boolean checkNetworkRestrictions() {
// Implementation for network restriction checks
return true;
}
private boolean checkResourceLimits() {
// Implementation for resource limit checks
return true;
}
private FileSecurityInfo checkFileSecurity(File file) {
FileSecurityInfo info = new FileSecurityInfo();
info.setPath(file.getAbsolutePath());
info.setExists(file.exists());
info.setReadable(file.canRead());
info.setWritable(file.canWrite());
info.setExecutable(file.canExecute());
info.setOwner(System.getProperty("user.name"));
return info;
}
private List<Integer> checkOpenPorts() {
// Implementation for checking open ports
return new ArrayList<>();
}
private List<String> checkNetworkInterfaces() {
// Implementation for checking network interfaces
return new ArrayList<>();
}
private DnsSecurity checkDnsSecurity() {
// Implementation for DNS security checks
return new DnsSecurity();
}
private JvmSecurity checkJvmSecurity() {
// Implementation for JVM security checks
return new JvmSecurity();
}
private Map<String, String> checkSystemProperties() {
// Implementation for system property checks
return new HashMap<>();
}
private Map<String, String> checkEnvironmentVariables() {
// Implementation for environment variable checks
return new HashMap<>();
}
private void checkDirectoryPermissions(Path path) {
try {
if (!Files.isReadable(path)) {
logSecurityEvent(SecurityEvent.createWarningEvent(
"Directory not readable: " + path,
"FILE_SYSTEM_MONITORING",
"LOW"
));
}
} catch (Exception e) {
logger.debug("Error checking directory permissions: {}", path, e);
}
}
// Getters
public List<SecurityEvent> getSecurityEvents() {
return new ArrayList<>(securityEvents);
}
public RuntimeSecurityMetrics getSecurityMetrics() {
return securityMetrics;
}
public boolean isAquaEnabled() {
return aquaEnabled;
}
}

Security Data Models

package com.example.aqua.model;
import java.time.LocalDateTime;
import java.util.*;
/**
* Security assessment result
*/
public class SecurityAssessment {
private LocalDateTime assessmentTime;
private boolean containerized;
private Map<String, Boolean> securityControls;
private FileSystemSecurity fileSystemSecurity;
private NetworkSecurity networkSecurity;
private RuntimeSecurity runtimeSecurity;
private double securityScore;
private String error;
public SecurityAssessment() {
this.securityControls = new HashMap<>();
this.assessmentTime = LocalDateTime.now();
}
public void calculateSecurityScore() {
int totalChecks = 0;
int passedChecks = 0;
// Calculate score based on security controls
for (Boolean control : securityControls.values()) {
totalChecks++;
if (Boolean.TRUE.equals(control)) {
passedChecks++;
}
}
this.securityScore = totalChecks > 0 ? (double) passedChecks / totalChecks * 100 : 100;
}
// Getters and setters
public LocalDateTime getAssessmentTime() { return assessmentTime; }
public void setAssessmentTime(LocalDateTime assessmentTime) { this.assessmentTime = assessmentTime; }
public boolean isContainerized() { return containerized; }
public void setContainerized(boolean containerized) { this.containerized = containerized; }
public Map<String, Boolean> getSecurityControls() { return securityControls; }
public void setSecurityControls(Map<String, Boolean> securityControls) { this.securityControls = securityControls; }
public FileSystemSecurity getFileSystemSecurity() { return fileSystemSecurity; }
public void setFileSystemSecurity(FileSystemSecurity fileSystemSecurity) { this.fileSystemSecurity = fileSystemSecurity; }
public NetworkSecurity getNetworkSecurity() { return networkSecurity; }
public void setNetworkSecurity(NetworkSecurity networkSecurity) { this.networkSecurity = networkSecurity; }
public RuntimeSecurity getRuntimeSecurity() { return runtimeSecurity; }
public void setRuntimeSecurity(RuntimeSecurity runtimeSecurity) { this.runtimeSecurity = runtimeSecurity; }
public double getSecurityScore() { return securityScore; }
public void setSecurityScore(double securityScore) { this.securityScore = securityScore; }
public String getError() { return error; }
public void setError(String error) { this.error = error; }
}
/**
* File system security information
*/
class FileSystemSecurity {
private Map<String, FileSecurityInfo> fileSecurity = new HashMap<>();
private FileSecurityInfo applicationDirectorySecurity;
// Getters and setters
public Map<String, FileSecurityInfo> getFileSecurity() { return fileSecurity; }
public void setFileSecurity(Map<String, FileSecurityInfo> fileSecurity) { this.fileSecurity = fileSecurity; }
public FileSecurityInfo getApplicationDirectorySecurity() { return applicationDirectorySecurity; }
public void setApplicationDirectorySecurity(FileSecurityInfo applicationDirectorySecurity) { 
this.applicationDirectorySecurity = applicationDirectorySecurity; 
}
public void addFileSecurity(String path, FileSecurityInfo info) {
fileSecurity.put(path, info);
}
}
/**
* File security information
*/
class FileSecurityInfo {
private String path;
private boolean exists;
private boolean readable;
private boolean writable;
private boolean executable;
private String owner;
// Getters and setters
public String getPath() { return path; }
public void setPath(String path) { this.path = path; }
public boolean isExists() { return exists; }
public void setExists(boolean exists) { this.exists = exists; }
public boolean isReadable() { return readable; }
public void setReadable(boolean readable) { this.readable = readable; }
public boolean isWritable() { return writable; }
public void setWritable(boolean writable) { this.writable = writable; }
public boolean isExecutable() { return executable; }
public void setExecutable(boolean executable) { this.executable = executable; }
public String getOwner() { return owner; }
public void setOwner(String owner) { this.owner = owner; }
}
/**
* Network security information
*/
class NetworkSecurity {
private List<Integer> openPorts = new ArrayList<>();
private List<String> networkInterfaces = new ArrayList<>();
private DnsSecurity dnsSecurity;
// Getters and setters
public List<Integer> getOpenPorts() { return openPorts; }
public void setOpenPorts(List<Integer> openPorts) { this.openPorts = openPorts; }
public List<String> getNetworkInterfaces() { return networkInterfaces; }
public void setNetworkInterfaces(List<String> networkInterfaces) { this.networkInterfaces = networkInterfaces; }
public DnsSecurity getDnsSecurity() { return dnsSecurity; }
public void setDnsSecurity(DnsSecurity dnsSecurity) { this.dnsSecurity = dnsSecurity; }
}
/**
* DNS security information
*/
class DnsSecurity {
private boolean secureDnsEnabled;
private List<String> dnsServers = new ArrayList<>();
// Getters and setters
public boolean isSecureDnsEnabled() { return secureDnsEnabled; }
public void setSecureDnsEnabled(boolean secureDnsEnabled) { this.secureDnsEnabled = secureDnsEnabled; }
public List<String> getDnsServers() { return dnsServers; }
public void setDnsServers(List<String> dnsServers) { this.dnsServers = dnsServers; }
}
/**
* Runtime security information
*/
class RuntimeSecurity {
private JvmSecurity jvmSecurity;
private Map<String, String> systemProperties = new HashMap<>();
private Map<String, String> environmentVariables = new HashMap<>();
// Getters and setters
public JvmSecurity getJvmSecurity() { return jvmSecurity; }
public void setJvmSecurity(JvmSecurity jvmSecurity) { this.jvmSecurity = jvmSecurity; }
public Map<String, String> getSystemProperties() { return systemProperties; }
public void setSystemProperties(Map<String, String> systemProperties) { this.systemProperties = systemProperties; }
public Map<String, String> getEnvironmentVariables() { return environmentVariables; }
public void setEnvironmentVariables(Map<String, String> environmentVariables) { this.environmentVariables = environmentVariables; }
}
/**
* JVM security information
*/
class JvmSecurity {
private boolean securityManagerEnabled;
private List<String> securityPolicies = new ArrayList<>();
private Map<String, String> securityProperties = new HashMap<>();
// Getters and setters
public boolean isSecurityManagerEnabled() { return securityManagerEnabled; }
public void setSecurityManagerEnabled(boolean securityManagerEnabled) { this.securityManagerEnabled = securityManagerEnabled; }
public List<String> getSecurityPolicies() { return securityPolicies; }
public void setSecurityPolicies(List<String> securityPolicies) { this.securityPolicies = securityPolicies; }
public Map<String, String> getSecurityProperties() { return securityProperties; }
public void setSecurityProperties(Map<String, String> securityProperties) { this.securityProperties = securityProperties; }
}
/**
* Security event model
*/
class SecurityEvent {
private String id;
private LocalDateTime timestamp;
private String message;
private String category;
private String severity; // HIGH, MEDIUM, LOW, INFO
private String source;
private Map<String, Object> details = new HashMap<>();
public SecurityEvent() {
this.id = UUID.randomUUID().toString();
this.timestamp = LocalDateTime.now();
}
// Factory methods for different event types
public static SecurityEvent createThreatEvent(String message, String category, String severity, String threatType) {
SecurityEvent event = new SecurityEvent();
event.setMessage(message);
event.setCategory(category);
event.setSeverity(severity);
event.getDetails().put("threatType", threatType);
return event;
}
public static SecurityEvent createWarningEvent(String message, String category, String severity) {
SecurityEvent event = new SecurityEvent();
event.setMessage(message);
event.setCategory(category);
event.setSeverity(severity);
return event;
}
public static SecurityEvent createAssessmentEvent(String message, String category, String severity, double score) {
SecurityEvent event = new SecurityEvent();
event.setMessage(message);
event.setCategory(category);
event.setSeverity(severity);
event.getDetails().put("securityScore", score);
return event;
}
public static SecurityEvent createErrorEvent(String message, String category, String severity, String error) {
SecurityEvent event = new SecurityEvent();
event.setMessage(message);
event.setCategory(category);
event.setSeverity(severity);
event.getDetails().put("error", error);
return event;
}
// Getters and setters
public String getId() { return id; }
public void setId(String id) { this.id = id; }
public LocalDateTime getTimestamp() { return timestamp; }
public void setTimestamp(LocalDateTime timestamp) { this.timestamp = timestamp; }
public String getMessage() { return message; }
public void setMessage(String message) { this.message = message; }
public String getCategory() { return category; }
public void setCategory(String category) { this.category = category; }
public String getSeverity() { return severity; }
public void setSeverity(String severity) { this.severity = severity; }
public String getSource() { return source; }
public void setSource(String source) { this.source = source; }
public Map<String, Object> getDetails() { return details; }
public void setDetails(Map<String, Object> details) { this.details = details; }
}
/**
* Runtime security metrics
*/
class RuntimeSecurityMetrics {
private int totalEvents;
private int highSeverityEvents;
private int mediumSeverityEvents;
private int lowSeverityEvents;
private int suspiciousArguments;
private int suspiciousInterfaces;
private int activeEvents;
private LocalDateTime lastUpdate;
public RuntimeSecurityMetrics() {
this.lastUpdate = LocalDateTime.now();
}
public void recordEvent(SecurityEvent event) {
totalEvents++;
switch (event.getSeverity()) {
case "HIGH":
highSeverityEvents++;
break;
case "MEDIUM":
mediumSeverityEvents++;
break;
case "LOW":
lowSeverityEvents++;
break;
}
lastUpdate = LocalDateTime.now();
}
public void incrementSuspiciousArguments() {
suspiciousArguments++;
}
public void incrementSuspiciousInterfaces() {
suspiciousInterfaces++;
}
// Getters and setters
public int getTotalEvents() { return totalEvents; }
public void setTotalEvents(int totalEvents) { this.totalEvents = totalEvents; }
public int getHighSeverityEvents() { return highSeverityEvents; }
public void setHighSeverityEvents(int highSeverityEvents) { this.highSeverityEvents = highSeverityEvents; }
public int getMediumSeverityEvents() { return mediumSeverityEvents; }
public void setMediumSeverityEvents(int mediumSeverityEvents) { this.mediumSeverityEvents = mediumSeverityEvents; }
public int getLowSeverityEvents() { return lowSeverityEvents; }
public void setLowSeverityEvents(int lowSeverityEvents) { this.lowSeverityEvents = lowSeverityEvents; }
public int getSuspiciousArguments() { return suspiciousArguments; }
public void setSuspiciousArguments(int suspiciousArguments) { this.suspiciousArguments = suspiciousArguments; }
public int getSuspiciousInterfaces() { return suspiciousInterfaces; }
public void setSuspiciousInterfaces(int suspiciousInterfaces) { this.suspiciousInterfaces = suspiciousInterfaces; }
public int getActiveEvents() { return activeEvents; }
public void setActiveEvents(int activeEvents) { this.activeEvents = activeEvents; }
public LocalDateTime getLastUpdate() { return lastUpdate; }
public void setLastUpdate(LocalDateTime lastUpdate) { this.lastUpdate = lastUpdate; }
}

Security Configuration

package com.example.aqua.config;
import com.example.aqua.service.AquaRuntimeSecurityService;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.CommandLineRunner;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.scheduling.annotation.EnableScheduling;
/**
* Aqua Security Configuration
*/
@Configuration
@EnableScheduling
public class AquaSecurityConfig {
private static final Logger logger = LoggerFactory.getLogger(AquaSecurityConfig.class);
@Autowired
private AquaRuntimeSecurityService aquaSecurityService;
/**
* Initialize Aqua security on application startup
*/
@Bean
public CommandLineRunner initializeAquaSecurity() {
return args -> {
logger.info("Initializing Aqua runtime security configuration...");
aquaSecurityService.initialize();
};
}
/**
* Security-related beans configuration
*/
@Bean
public SecurityProperties securityProperties() {
return new SecurityProperties();
}
/**
* Security properties configuration
*/
public static class SecurityProperties {
private boolean aquaEnabled = true;
private boolean threatDetection = true;
private long monitoringInterval = 30000;
private String aquaConfigPath = "/aqua/config";
private String aquaLogPath = "/aqua/logs";
// Getters and setters
public boolean isAquaEnabled() { return aquaEnabled; }
public void setAquaEnabled(boolean aquaEnabled) { this.aquaEnabled = aquaEnabled; }
public boolean isThreatDetection() { return threatDetection; }
public void setThreatDetection(boolean threatDetection) { this.threatDetection = threatDetection; }
public long getMonitoringInterval() { return monitoringInterval; }
public void setMonitoringInterval(long monitoringInterval) { this.monitoringInterval = monitoringInterval; }
public String getAquaConfigPath() { return aquaConfigPath; }
public void setAquaConfigPath(String aquaConfigPath) { this.aquaConfigPath = aquaConfigPath; }
public String getAquaLogPath() { return aquaLogPath; }
public void setAquaLogPath(String aquaLogPath) { this.aquaLogPath = aquaLogPath; }
}
}

Security Dashboard Controller

package com.example.aqua.controller;
import com.example.aqua.model.SecurityAssessment;
import com.example.aqua.model.SecurityEvent;
import com.example.aqua.service.AquaRuntimeSecurityService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.http.ResponseEntity;
import org.springframework.security.access.prepost.PreAuthorize;
import org.springframework.web.bind.annotation.*;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
/**
* Security Dashboard REST Controller
*/
@RestController
@RequestMapping("/api/security")
@PreAuthorize("hasRole('ADMIN')")
public class SecurityDashboardController {
@Autowired
private AquaRuntimeSecurityService aquaSecurityService;
/**
* Get current security assessment
*/
@GetMapping("/assessment")
public ResponseEntity<SecurityAssessment> getSecurityAssessment() {
SecurityAssessment assessment = aquaSecurityService.performSecurityAssessment();
return ResponseEntity.ok(assessment);
}
/**
* Get security events
*/
@GetMapping("/events")
public ResponseEntity<List<SecurityEvent>> getSecurityEvents() {
List<SecurityEvent> events = aquaSecurityService.getSecurityEvents();
return ResponseEntity.ok(events);
}
/**
* Get security metrics
*/
@GetMapping("/metrics")
public ResponseEntity<Map<String, Object>> getSecurityMetrics() {
Map<String, Object> metrics = new HashMap<>();
metrics.put("totalEvents", aquaSecurityService.getSecurityMetrics().getTotalEvents());
metrics.put("highSeverityEvents", aquaSecurityService.getSecurityMetrics().getHighSeverityEvents());
metrics.put("mediumSeverityEvents", aquaSecurityService.getSecurityMetrics().getMediumSeverityEvents());
metrics.put("activeEvents", aquaSecurityService.getSecurityMetrics().getActiveEvents());
metrics.put("lastUpdate", aquaSecurityService.getSecurityMetrics().getLastUpdate());
return ResponseEntity.ok(metrics);
}
/**
* Trigger manual security scan
*/
@PostMapping("/scan")
public ResponseEntity<Map<String, String>> triggerSecurityScan() {
SecurityAssessment assessment = aquaSecurityService.performSecurityAssessment();
Map<String, String> response = new HashMap<>();
response.put("status", "COMPLETED");
response.put("securityScore", String.valueOf(assessment.getSecurityScore()));
response.put("message", "Security assessment completed successfully");
return ResponseEntity.ok(response);
}
/**
* Get security status
*/
@GetMapping("/status")
public ResponseEntity<Map<String, Object>> getSecurityStatus() {
Map<String, Object> status = new HashMap<>();
status.put("aquaEnabled", aquaSecurityService.isAquaEnabled());
status.put("runtimeMonitoring", true);
status.put("threatDetection", true);
status.put("containerized", false); // This would be dynamic
return ResponseEntity.ok(status);
}
}

Monitoring and Observability

Security Metrics with Micrometer

package com.example.aqua.monitoring;
import com.example.aqua.service.AquaRuntimeSecurityService;
import io.micrometer.core.instrument.Gauge;
import io.micrometer.core.instrument.MeterRegistry;
import io.micrometer.core.instrument.Counter;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.scheduling.annotation.Scheduled;
import org.springframework.stereotype.Component;
import java.util.concurrent.atomic.AtomicInteger;
/**
* Security metrics exporter for Prometheus monitoring
*/
@Component
public class SecurityMetricsExporter {
private final MeterRegistry meterRegistry;
private final AquaRuntimeSecurityService securityService;
private final AtomicInteger securityScore = new AtomicInteger(100);
private final Counter securityEventsCounter;
private final Counter highSeverityEventsCounter;
@Autowired
public SecurityMetricsExporter(MeterRegistry meterRegistry, 
AquaRuntimeSecurityService securityService) {
this.meterRegistry = meterRegistry;
this.securityService = securityService;
// Initialize counters
this.securityEventsCounter = Counter.builder("aqua.security.events.total")
.description("Total number of security events")
.register(meterRegistry);
this.highSeverityEventsCounter = Counter.builder("aqua.security.events.high_severity")
.description("Number of high severity security events")
.register(meterRegistry);
// Initialize gauges
Gauge.builder("aqua.security.score")
.description("Current security assessment score")
.register(meterRegistry, securityScore);
Gauge.builder("aqua.security.active_events")
.description("Number of active security events")
.register(meterRegistry, securityService.getSecurityMetrics(), 
metrics -> metrics.getActiveEvents());
}
/**
* Update security metrics periodically
*/
@Scheduled(fixedRate = 30000) // Every 30 seconds
public void updateSecurityMetrics() {
// Update security score
securityScore.set((int) securityService.performSecurityAssessment().getSecurityScore());
// Update event counters based on current state
// This would be more sophisticated in production
}
/**
* Record security event in metrics
*/
public void recordSecurityEvent(String severity) {
securityEventsCounter.increment();
if ("HIGH".equals(severity)) {
highSeverityEventsCounter.increment();
}
}
}

Application Configuration

# application.yml
spring:
application:
name: aqua-runtime-demo
security:
oauth2:
resourceserver:
jwt:
issuer-uri: https://auth.aquasec.com
# Aqua Security Configuration
aqua:
runtime:
enabled: true
threat-detection:
enabled: true
monitoring:
interval: 30000
config:
path: /aqua/config
logs:
path: /aqua/logs
# Actuator Endpoints
management:
endpoints:
web:
exposure:
include: health,info,metrics,prometheus,aqua
endpoint:
health:
show-details: always
aqua:
enabled: true
# Logging Configuration
logging:
level:
com.example.aqua: DEBUG
file:
name: /aqua/logs/application.log
pattern:
file: "%d{yyyy-MM-dd HH:mm:ss} - %logger{36} - %msg%n"
# Server Configuration
server:
port: 8080
servlet:
context-path: /
compression:
enabled: true

CI/CD Integration

GitHub Actions Workflow

name: Aqua Security Scan
on:
push:
branches: [ main, develop ]
pull_request:
branches: [ main ]
schedule:
- cron: '0 2 * * *'  # Daily at 2 AM
jobs:
security-scan:
name: Aqua Security Scan
runs-on: ubuntu-latest
steps:
- name: Checkout code
uses: actions/checkout@v4
- name: Set up Java
uses: actions/setup-java@v3
with:
java-version: '11'
distribution: 'temurin'
cache: 'maven'
- name: Build application
run: mvn clean package -DskipTests
- name: Build Docker image
run: docker build -t aqua-runtime-demo:latest .
- name: Run Trivy vulnerability scanner
uses: aquasecurity/trivy-action@master
with:
image-ref: 'aqua-runtime-demo:latest'
format: 'sarif'
output: 'trivy-results.sarif'
- name: Upload Trivy scan results
uses: github/codeql-action/upload-sarif@v2
with:
sarif_file: 'trivy-results.sarif'
- name: Run Aqua security scan
run: |
docker run --rm \
-v /var/run/docker.sock:/var/run/docker.sock \
aquasec/scanner:latest \
scan --local aqua-runtime-demo:latest
- name: Security Scan Summary
run: |
echo "## Aqua Security Scan Results" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "### Security Assessment" >> $GITHUB_STEP_SUMMARY
echo "- ✅ Container image built successfully" >> $GITHUB_STEP_SUMMARY
echo "- ✅ Trivy vulnerability scan completed" >> $GITHUB_STEP_SUMMARY
echo "- ✅ Aqua security scan completed" >> $GITHUB_STEP_SUMMARY
echo "" >> $GITHUB_STEP_SUMMARY
echo "### Next Steps" >> $GITHUB_STEP_SUMMARY
echo "- Review security reports" >> $GITHUB_STEP_SUMMARY
echo "- Address any critical vulnerabilities" >> $GITHUB_STEP_SUMMARY
echo "- Deploy with Aqua runtime protection" >> $GITHUB_STEP_SUMMARY
deploy:
name: Deploy with Aqua Protection
runs-on: ubuntu-latest
needs: security-scan
if: github.ref == 'refs/heads/main'
steps:
- name: Deploy to Kubernetes
run: |
kubectl apply -f kubernetes/deployment.yaml
kubectl apply -f kubernetes/aqua-security.yaml
- name: Verify deployment
run: |
kubectl rollout status deployment/aqua-runtime-demo

Kubernetes Deployment with Aqua

# kubernetes/deployment.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
name: aqua-runtime-demo
labels:
app: aqua-runtime-demo
spec:
replicas: 3
selector:
matchLabels:
app: aqua-runtime-demo
template:
metadata:
labels:
app: aqua-runtime-demo
annotations:
aquasecurity.com/scanner: "true"
aquasecurity.com/enforcer: "true"
spec:
containers:
- name: aqua-runtime-demo
image: aqua-runtime-demo:latest
ports:
- containerPort: 8080
env:
- name: AQUA_ENABLED
value: "true"
- name: SPRING_PROFILES_ACTIVE
value: "kubernetes"
resources:
requests:
memory: "512Mi"
cpu: "250m"
limits:
memory: "1Gi"
cpu: "500m"
securityContext:
runAsNonRoot: true
runAsUser: 1000
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
livenessProbe:
httpGet:
path: /actuator/health
port: 8080
initialDelaySeconds: 30
periodSeconds: 10
readinessProbe:
httpGet:
path: /actuator/health
port: 8080
initialDelaySeconds: 5
periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
name: aqua-runtime-demo
spec:
selector:
app: aqua-runtime-demo
ports:
- port: 80
targetPort: 8080
type: ClusterIP

Security Testing

package com.example.aqua.security;
import com.example.aqua.service.AquaRuntimeSecurityService;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.test.context.TestPropertySource;
import static org.junit.jupiter.api.Assertions.*;
/**
* Aqua Runtime Security Tests
*/
@SpringBootTest
@TestPropertySource(properties = {
"aqua.runtime.enabled=true",
"aqua.threat.detection.enabled=true"
})
public class AquaSecurityTests {
@Autowired
private AquaRuntimeSecurityService aquaSecurityService;
@Test
public void testSecurityAssessment() {
var assessment = aquaSecurityService.performSecurityAssessment();
assertNotNull(assessment);
assertTrue(assessment.getSecurityScore() >= 0);
assertTrue(assessment.getSecurityScore() <= 100);
assertNotNull(assessment.getSecurityControls());
}
@Test
public void testSecurityEvents() {
var events = aquaSecurityService.getSecurityEvents();
assertNotNull(events);
}
@Test
public void testSecurityMetrics() {
var metrics = aquaSecurityService.getSecurityMetrics();
assertNotNull(metrics);
assertTrue(metrics.getTotalEvents() >= 0);
}
@Test
public void testAquaEnabled() {
assertTrue(aquaSecurityService.isAquaEnabled());
}
}

Best Practices

1. Runtime Security Monitoring

/**
* Advanced runtime security monitoring
*/
@Component
public class AdvancedRuntimeMonitor {
/**
* Monitor for suspicious system calls
*/
@Scheduled(fixedRate = 60000)
public void monitorSystemCalls() {
// Monitor for suspicious process behavior
// Check for unauthorized file access
// Monitor network connections
// Check for privilege escalation attempts
}
/**
* Behavioral analysis for anomaly detection
*/
public void analyzeBehavior() {
// Implement machine learning for anomaly detection
// Baseline normal behavior
// Detect deviations from baseline
// Trigger alerts for suspicious activities
}
}

2. Incident Response

/**
* Security incident response handler
*/
@Component
public class SecurityIncidentResponse {
/**
* Handle security incidents
*/
public void handleIncident(SecurityEvent event) {
switch (event.getSeverity()) {
case "HIGH":
handleHighSeverityIncident(event);
break;
case "MEDIUM":
handleMediumSeverityIncident(event);
break;
case "LOW":
handleLowSeverityIncident(event);
break;
}
}
private void handleHighSeverityIncident(SecurityEvent event) {
// Immediate response actions
// Isolate affected container
// Alert security team
// Collect forensic data
// Trigger automated remediation
}
}

Conclusion

This comprehensive Aqua Runtime Security implementation provides:

Runtime threat detection and monitoring
Container security hardening
Behavioral analysis for anomaly detection
Comprehensive security assessment
CI/CD integration with security scanning
Kubernetes deployment with security best practices
Real-time monitoring and metrics

Key benefits include proactive threat detection, automated security enforcement, comprehensive visibility into runtime behavior, and seamless integration with cloud-native ecosystems.

Remember to:

Enable Aqua runtime protection in production
Regularly update security policies
Monitor security metrics and alerts
Conduct regular security assessments
Integrate with your existing security infrastructure
Follow cloud-native security best practices