This page guides you through deploying a customizable Terraform to add AI Runtime Security: Network intercept protection for AWS cloud
resources.
On this page, you will configure an AI Runtime Security: Network intercept in Strata
Cloud Manager, download the corresponding Terraform configuration, and deploy it in
your cloud environment. This setup will integrate the AI Runtime Security instance
into your cloud network architecture, enabling comprehensive monitoring and
protection of your assets.
After onboarding, the Strata Cloud Manager Command Center dashboard will
show asset discovery with no AI Runtime Security instance protection
deployed. Unprotected traffic paths to and from apps, models, and the internet are
marked in red until you add firewall protection. For more details, see Discover Your Cloud Resources.
Select Cloud Service Provider as AWS and choose Next.
In Firewall Placement, select:
All traffic to protect AI and non-AI applications.
Non AI traffic only to protect all traffic except the traffic
between your applications and the AI models.
Select Next.
In Regions & Application(s):
Select your cloud account to secure.
Select a region in which you want to protect the
applications.
In Selected applications,
Select the applications to secure from the drop-down list.
Select all applicable zones from the dropdown menu to secure
traffic for each application.
Provide unused CIDR for each zone.
Enable protection for the Undiscovered VPC(s).
Select Next.
In Protection Settings:
Select AI Runtime Security based on the type of traffic you
decided to protect under Firewall Placement in step 5.
Enter the number of firewalls to deploy.
Select zones to deploy firewalls.
Ensure the firewall zones cover all selected application zones you
selected for each application under Selected applications.
For example, in AWS region us-west-1, if App1 uses ZoneA and ZoneE,
and App2 uses ZoneB and ZoneD, the firewall must include ZoneA,
ZoneB, ZoneD, and ZoneE. This ensures that when Terraform creates
the GWLB service, all corresponding zones are covered.
Choose the instance type for the security VM (See Amazon EC2 instance types for
details). Following are the supported instance types:
c6in.xlarge,
c6in.8xlarge, and c6in.16xlarge.
In IP addressing scheme:
Enter the unused CIDR for security VPC. (Go to AWS Management Console > VPC,
select your VPC and get the CIDR for your VPC).
Choose Yes or No to Create transit gateway
or not:
If you choose No, select the existing TGW
ID from the drop-down list under Select
transit gateway (Go to AWS Management Console > VPC
dashboard > Transit Gateways to get the TGW ID).
If you choose Yes, you can optionally enter the
Autonomous system number (ASN) for the new Transit
Gateway. (Refer to create a transit
gateway for more information).
Enable the Cross-Zone load balancing check box to
distribute incoming traffic evenly across targets in multiple
availability zones. (This will create the NAT gateway and the
egress traffic will route from the security VPC IGW via the NAT
gateway).
Enter a unique Terraform template name. (Use
only alphanumeric characters and hyphens, avoid using a hyphen
at the beginning or end, and limit the name under 19
characters).
Review the topology for your AI network architecture.
Click Create terraform template.
Click Download terraform template.
Close the deployment workflow to exit.
Before you deploy the Terraform template,
authenticate with the AWS Console. Go to the AWS Marketplace and
subscribe. Subscribe for the same image that you will use for the AI Runtime
Security instance and the tag collector.
Unzip the downloaded file. Navigate to <unzipped-folder>
with 2 directories: `architecture` and `modules`. Deploy the Terraform templates
in your cloud environment following the `README.md` file in the `architecture`
folder.
cd architecture
cd security_project
terraform init
terraform plan
terraform apply
cd ../application_project
terraform init
terraform plan
terraform apply
Deploying the Terraform for the security project creates the
GWLB endpoints in your AWS account.
Select Workflows → NGFW Setup → Device Management. The AI Runtime security Instance
appears under Cloud Managed Devices.
Switch to the Cloud Managed Devices tab to view and
manage the connected state, the configuration sync state, and the licenses of
the deployed AI Runtime Security instances.
It takes a while before the Device Status shows as
connected.
