Collection of Terraform modules to manually deploy Vulnerability Scanning and IDS required infrastructure into an existing customer managed subnet in AWS.

• Overview
• Use Case: Customer provided subnet
• How to Use
• Appendix A

This template is intended to be used by the customer when manual deployment mode is selected for Detection.

The template included here will take care of the creation of the whole infrastructure required to create a working IDS appliance. However, further steps are required to have a fully functional appliance.

In this use case, the customer provides an existing subnet where the appliances are going to be deployed in.

NOTE: It is the customer's responsibility to properly configure network access to the chosen subnet. This includes management of IGW, Routes, NACLs and NAT associated with the existing subnet. Scan and IDS appliances must be able to communicate with our Datacenters via IGW or NAT Gateway/NAT instance.

In order to deploy the appliances these requirements must be done prior:

• A manual mode AWS deployment exist in the Alert Logic console
• manual mode deployments needs to have scope set to at least one VPC
• AWS VPC ID and CIDR where the appliances will be deployed in
• Subnet IDs and type (public, private) where the appliances are going to be deployed in

aws_profile = "aws_profile" // The AWS profile configured for credentials OR matching AWS_PROFILE environment variable
aws_cred_file = "~/.aws/credentials" // An AWS credentials file to specify your credentials
aws_region = "xx-xxxx-x" // The AWS region to deploy the appliance in
account_id = "123456" // Your AlertLogic Account ID
deployment_id = "xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxxx" // Your AlertLogic cloudinsight Deployment ID
stack = "US" // AlertLogic DataCenter where the appliance will be deployed in. Enter US or UK
create_ids = "1" // Set value to 1(true) to include IDS coverage for the "Professional" protection subscription tier, otherwise set to 0(false) if your scope of protection set to "Essentials/Scanning" only, IDS will not be deployed
vpc_id = "vpc-xxxxxxxx" // Specify the VPC ID where the appliance will be deployed in
vpc_cidr = "10.10.0.0/16" // Specify the VPC CIDR block
subnet_id = "subnet-xxxxxxxx" // Specify the existing subnet ID where the appliance will be deployed in
availability_zones = "us-east-1a,us-east-1b,us-east-1c" // List of availability zone(s) where the IDS appliances will be deployed in
subnet_type = "Public" // Select if the subnet is a public or private subnet. Enter Public or Private
ci_instance_type = "c5.large" // AlertLogic Security Appliance EC2 instance type. Enter m4.large, m4.xlarge, m4.2xlarge, m5.large, m5.xlarge, m5.2xlarge, c4.large, c4.xlarge, c4.2xlarge, c5.large, c5.xlarge or c5.2xlarge
ci_appliance_number = "1" // Number of Secuirty appliances to be deployed set by the Autoscaling group
ids_instance_type = "c5.xlarge" // AlertLogic IDS Appliance EC2 instance type. Enter m4.large, m4.xlarge, m4.2xlarge, m5.large, m5.xlarge, m5.2xlarge, c4.large, c4.xlarge, c4.2xlarge, c5.large, c5.xlarge or c5.2xlarge
ids_appliance_number = "1" // Number of IDS appliances to be deployed set by the Autoscaling group

The template will create the following resources in each Subnet provided (see Appendix A for details on each resource):

• A security group for the Scanning appliance
• A security launch configuration for the Scanning appliance
• A security auto scaling group with a single instance (default) for the Scanning appliance
• A security group for the IDS appliance (if create_ids is set to 1)
• A security launch configuration for the IDS appliance (if create_ids is set to 1)
• A security auto scaling group with a single instance (default) for the IDS appliance (if create_ids is set to 1)

1. clone or download the entire repository to your working directory, i.e. ~/aws-manual-deployment

├── deploy.tf
├── module
│   ├── ci_scan
│   │   ├── main.tf
│   │   ├── outputs.tf
│   │   ├── userdata.tpl
│   │   └── variables.tf
│   └── ids
│       ├── main.tf
│       ├── outputs.tf
│       └── variables.tf
├── README.md
└── vars.tfvars

3 directories, 10 files

2. add all the required variable values in a separate file under the same directory, i.e. vars.tfvars
3. run Terraform initialization and apply to create the security resources in AWS:

   terraform init
   terraform apply -var-file=vars.tfvars

Provider configuration: The configuration applied to this terraform uses a shared_credentials_file method. Credentials can be provided from separate file (default file name is credentials.tf) Variables can be loaded from separate file or passed as parameters. See https://www.terraform.io/docs/providers/aws/#authentication for more options.

This section provides details about each resource created by the template.

All resources created will have a set of shared tags as shown in the next table:

NOTE: A unique tag Name will be set per resource type.

Every security group is configured to have following attributes:

Following tags will be set on every security group:

As appliances needs to connect to Alert Logic back-end as well as access to customer infrastructure inside a VPC, the following rules are configured (taken from here):

For Scanning:

For IDS:

Every launch configuration is configured to have following attributes:

Following tags will be set on every launch configuration:

NOTE: The AMI IDs used are shared automatically with the AWS account by Alert Logic when the deployment is created in the UI.

Every group is configured to have following attributes:

The autosclaing group is configured to propagate the following tags to every launched instance (besides the previously defined list of shared tags):