Ephemeral Debug Sidecars: Audited Access Without Permanent Prod Shells

Prod task definition:
 - app container only
 - readonlyRootFilesystem where possible
 - no SSH daemon, no shared host keys
Break-glass:
 - dual-control ticket + change ID
 - enable ECS Exec OR attach debug sidecar for N minutes
 - session logs to CloudWatch / S3
 - auto-disable after TTL

{
 "family": "checkout-api",
 "enableExecuteCommand": true,
 "containerDefinitions": [{
 "name": "app",
 "image": "123.dkr.ecr.us-east-1.amazonaws.com/checkout:sha-abc",
 "linuxParameters": { "initProcessEnabled": true }
 }]
}

# Break-glass (after approval)
aws ecs execute-command \
 --cluster prod \
 --task "$TASK_ARN" \
 --container app \
 --interactive \
 --command "/bin/sh"

# Require SSM Session Manager preferences: S3/CloudWatch logging + KMS

# kubectl debug / ephemeral container sketch
apiVersion: v1
kind: Pod
metadata:
 name: checkout-7f9
spec:
 ephemeralContainers:
 - name: debugger
 image: 123.dkr.ecr.us-east-1.amazonaws.com/debug-toolbox:2026.09
 targetContainerName: app
 securityContext:
 allowPrivilegeEscalation: false
 readOnlyRootFilesystem: true
 runAsNonRoot: true
 env:
 - name: DEBUG_TTL_SECONDS
 value: "1800"

// Step Functions / EventBridge: disable execute-command after TTL
export async function revokeExec(cluster: string, service: string) {
 // update service to enableExecuteCommand=false
 // notify ticket; require new approval to re-enable
}