The Cequence Unified API Protection (UAP) platform is a security platform that protects your web applications and APIs from threats. This article guides you through the process of setting up the Cequence UAP platform on Amazon Web Services (AWS) using a virtual machine.

Before you start

Verify that your installation environment meets the following requirements before you begin.

• An AWS account with permission to create virtual machines. You'll need to launch a virtual server to run Cequence software.
• The AWS account also needs the ability to spin up Elastic Compute Cloud (EC2) instances from the AWS Marketplace.
• Create a ticket for Cequence with your AWS Account ID to enable Limited Visibility Cequence AMIs in your AWS account. See the Create a New Ticket: Enable AWS Marketplace AMI article for details. Cequence's software isn't publicly available. The Cequence support team needs to specifically enable your account to see and use their virtual machine images.
• Choose a server size based on your deployment scope.
  • Proof of value (POV) deployments: m6a.4xlarge, with 16 vCPU and 64 GB memory.
  • Full or scaled deployments: m6a.8xlarge, with 32 vCPU and 128 GB memory.
• Choose at least 70 GB of General Purpose SSD (gp3) storage to provide enough storage space for your data processing requirements.

Setting up the Cequence UAP platform

This section describes the procedure to install the Cequence UAP platform.

Step 1: Launch your virtual machine

1. Log in to the AWS EC2 console.
   In a browser, navigate to https://console.aws.amazon.com/ec2/.
2. Click Launch Instance.
3. From the left panel, select AWS Marketplace and search for Cequence CQAI.
   If the search has no results, contact your Cequence support team and verify that you've met all the prerequisites, including setting visibility for hidden AMIs.
4. Click Select.
   A dialog box opens that displays an overview of the AMI.
5. Click Subscribe on Instance Launch or Subscribe Now to proceed. These choices affect your billing.
6. Configure the details of your instance.
   • In Name and tags, type a descriptive name for your instance.
   • In Networking, choose the appropriate VPC, subnet, and Availability Zone.
   • In Security Groups, select an existing security group or create a new one using the defaults provided by Cequence.
   • In Configure Storage, enter the storage size recommended in the prerequisites.
7. Review the instance configuration details, then click Launch Instance.

After the instance launches, connect to the instance using the SSH client and the private key of your key pair. Monitor the status of the instance from the Amazon EC2 console.

Create DNS entries

Before you can access the Cequence UAP platform, create DNS entries that point to your virtual machine.

1. Identify a subdomain to use for the Cequence UAP platform resources, such as cqai.yourdomain.com.
2. After the virtual machine is running, use its routable IP address to create the following DNS entries. Point each entry to the same IP address.
   • auth.cqai.yourdomain.com
   • edge.cqai.yourdomain.com
   • ui.cqai.yourdomain.com
   • policy-engine.cqai.yourdomain.com
   • airflow.cqai.yourdomain.com

When you use AWS Route 53, create a single wildcard entry, such as *.cqai.yourdomain.com, to point to the virtual machine's IP address.

Step 2: Install and configure the Cequence UAP platform

Connect to your virtual machine using SSH with the following credentials. Optionally, use the private IP address of your EC2 instance instead of ui.cqai.yourdomain.com.

# ssh -i <your private key> ubuntu@ui.cqai.yourdomain.com

1. Choose a deployment option and run the corresponding setup command. Substitute yourdomain.com with your actual domain.

   To deploy the Cequence UAP platform on its own, run the following command.

   # /opt/cequence/bin/setup.sh cqai.yourdomain.com

   To deploy the Cequence UAP platform with a Prometheus and Grafana dashboard, run the following command.

   # /opt/cequence/bin/setup.sh cqai.yourdomain.com scaled

   To deploy the Cequence UAP platform with a Prometheus and Grafana dashboard and Redis, run the following command.

   # /opt/cequence/bin/setup.sh cqai.yourdomain.com full

   Setup takes approximately 15 minutes to complete.

2. Run the following command to display the password for the default account. Note the password for later use.

   kubectl get secret ui-default-user -n cequence --template={{.data.password}} | base64 -d

3. Navigate to https://auth.cqai.yourdomain.com and accept the self-signed certificate in the browser.
4. Navigate to https://ui.cqai.yourdomain.com and accept the self-signed certificate in the browser.
5. Log in with the default credentials. The default username is cq-ui. Use the default password from the earlier step.
6. After you log in with the default credentials, set a new password when prompted, then provide your email address, first name, and last name.

After completing these steps, you have access to the Cequence UAP platform web UI. Cequence UAP platform configuration is discussed in the product documentation.

Step 3: Configure HTTP traffic management

Configure a traffic filter to determine which requests the Cequence UAP platform processes. This procedure creates a filter that sends all traffic to the platform for processing.

Prerequisites

Verify that you have access to the Cequence UAP platform web UI.

Steps:

1. From the Cequence UAP platform portal, navigate to Gear icon (⛭) > General Settings > Traffic Management.
2. In the Traffic Filters section, click Add Traffic Filter.
3. In the Name and Description fields, type values such as "Send all traffic filter."

4. From the Application Tag dropdown, click Create Application Tag, then complete the following fields.

   • In App Tag, type a tag name, such as "Send all."
   • In Host, type *.
   • In Path, type /**.

   Click Save.

5. From Select Methods to be processed, select ALL.
6. From the Traffic Policy dropdown, select Send ALL Traffic.
7. Click Next without changing Advanced Options.
8. Using the toggle, enable or disable Sensitive Data Masking, then click Next.
9. Review the configuration, then click Save.

The new traffic filter displays on the Traffic Filters page.

What happens next

After completing these steps, your Cequence UAP platform is ready for basic operation. The system begins monitoring web traffic according to your configuration.

Next steps

• Configure data plane components (additional security modules).
• Set up more detailed security policies.
• Integrate with your existing applications.

See Getting Started - Defender Virtual Appliance for details on further configuration for the Defender component.

For advanced configuration and integration with your specific applications, refer to the detailed product documentation or contact Cequence support.

Common questions

Why do I need so many domain names?
Each domain name serves a different function in the platform. Separating them improves security and makes troubleshooting easier.

Can I use a smaller server?
The recommended server sizes ensure good performance. Smaller servers might work for testing, but Cequence does not recommend them for production use.

How long does the initial setup take?
Plan for about 30-45 minutes total: 5-10 minutes to launch the server, 15 minutes for software installation, and 10-15 minutes for configuration.

What if I can't find the Cequence software in AWS Marketplace?
Contact Cequence support with your AWS Account ID. Cequence support needs to enable access for your specific account.