This course was developed by members of AWS Technical Field Communities (TFC), an AWS community of technical experts. The content is intended to complement our standard training curriculum and augment your AWS learning journey. We are aware some courses have accessibility limitations and are working to address. If you require accommodation, please contact AWS Training and Certification Customer Support.
Learners in this course will gain practical skills for preserving volatile container evidence in Amazon EKS environments using the Kubelet Checkpoint API and CRIU. They will learn how to capture a container's runtime state -- including in-memory credentials, network connections, injected processes, and file system changes -- in seconds without stopping the workload. The course covers how to package and push checkpoints to Amazon ECR, helping teams avoid the tradeoff between terminating suspicious containers and preserving forensic evidence. Learners will also understand how this approach supports compliance with frameworks like PCI DSS and SOC 2.
