Secure AI Sandboxes: Ephemeral ECS Tasks for Agent Tool Execution

// sandbox_launcher.ts
import { ECSClient, RunTaskCommand, StopTaskCommand } from "@aws-sdk/client-ecs";

export async function startAgentSandbox(sessionId: string) {
  const ecs = new ECSClient({});
  const out = await ecs.send(
    new RunTaskCommand({
      cluster: process.env.SANDBOX_CLUSTER!,
      taskDefinition: "agent-sandbox:47",
      launchType: "FARGATE",
      networkConfiguration: {
        awsvpcConfiguration: {
          subnets: process.env.SANDBOX_SUBNETS!.split(","),
          securityGroups: [process.env.SANDBOX_SG!],
          assignPublicIp: "DISABLED", // ✅ private only
        },
      },
      overrides: {
        containerOverrides: [
          {
            name: "agent",
            environment: [
              { name: "SESSION_ID", value: sessionId },
              { name: "MAX_RUNTIME_SEC", value: "1800" },
            ],
          },
        ],
        // Task role is session-scoped via intermediate assume-role if needed
      },
      tags: [{ key: "sessionId", value: sessionId }],
    })
  );
  return out.tasks?.[0]?.taskArn!;
}

// ❌ Reuse one fat EC2 instance for all tenants' agents

{
  "family": "agent-sandbox",
  "taskRoleArn": "arn:aws:iam::123:role/agent-sandbox-session",
  "ephemeralStorage": { "sizeInGiB": 20 },
  "containerDefinitions": [{
    "name": "agent",
    "linuxParameters": {
      "capabilities": { "drop": ["ALL"] },
      "readonlyRootFilesystem": true
    },
    "environment": [
      { "name": "HTTP_PROXY", "value": "http://egress-proxy.internal:3128" }
    ]
  }]
}

# IAM — illustrative least privilege for sandbox role
# ✅ S3 read on session bucket prefix only
# ✅ ECR pull
# ❌ s3:* on *
# ❌ iam:CreateAccessKey
# ❌ sts:AssumeRole on prod account roles

# watchdog.py
def enforce_ttl(task_arn: str, started_at: float, max_sec: int = 1800):
    if time.time() - started_at > max_sec:
        stop_task(task_arn, reason="ttl_exceeded")  # ✅ hard stop
        emit_metric("SandboxTtlKill", 1)

# Log every tool: command hash, exit code, bytes written — no secret values