feat(security): log every command in webapp via a Falco custom rule

[leeclay95]

What

Adds a Falco customRules entry so every command run in the webapp namespace is logged — not just the shell spawn.

Follow-up to #25. The default Terminal shell in container rule fires when a shell opens, but the individual commands typed after a kubectl exec (id, cat /etc/shadow, ls) produce no default alert. That's the exact visibility Falco was added for, so this bakes in a rule to capture it.

Changes

• terraform/cluster/falco.tf — customRules → Command run in webapp container:

  condition: spawned_process and container and k8s.ns.name = webapp
  output:    "Command in webapp container (cmd=%proc.cmdline pod=%k8s.pod.name ...)"
  

• docs/falco.md — documents the two rules, the per-command test flow (no TTY needed now), and the shipper re-roll after a Falco restart.

Verified live (end to end)

• kubectl exec -n webapp POD -- sh -c 'id; cat /etc/hostname; ls /' → Falco fires one alert per command.
• Alerts ship to floci CloudWatch /k8s/falco:

  Command run in webapp container | webapp webapp-xxxx | id
  Command run in webapp container | webapp webapp-xxxx | cat /etc/hostname
  Command run in webapp container | webapp webapp-xxxx | ls /
  

• helm template renders the rule into the falco-rules ConfigMap; terraform validate clean; local security-gates.sh → all four gates PASS.

Note

The rule is noisy by design (every exec in webapp). Fine for the lab/demo; for real use, scope it or exclude known process names.

🤖 Generated with Claude Code