This guide details the steps involved in deploying the Cequence Defender virtual appliance on the Amazon Web Services (AWS) platform. Defender operates as an inline component within the broader Cequence Unified API Protection (UAP) platform, safeguarding your APIs from various threats.
Prerequisites
- Pre-deployed Cequence UAP platform: Ensure your Cequence UAP platform is fully operational. Refer to the Cequence documentation for specific deployment instructions.
- AWS Permissions: You must possess the necessary permissions to launch EC2 instances from the AWS Marketplace.
- AWS Marketplace Visibility: Ensure Cequence AMIs are visible within your AWS account. Create a ticket with Cequence if they are not, referencing your AWS Account ID. Create a New Ticket: Enable AWS Marketplace AMI
- Recommended Instance Types: Choose an instance type with sufficient resources, such as t2.medium or better.
- Recommended Storage Types: Utilize gp2 or gp3 storage types for optimal performance.
- Cequence Product Visibility: Submit a request to Cequence to enable visibility of their products within the AWS Marketplace for your account.
Deployment Procedure
Launch Defender EC2 Instance:
- Access the Amazon EC2 console: https://console.aws.amazon.com/ec2/.
- Click "Launch Instance" on the dashboard.
- Under "Choose an Amazon Machine Image (AMI)," select the "AWS Marketplace" category.
- Search for "Cequence Defender." If not found, refer to the prerequisites for enabling limited visibility.
- Click "Select" on the desired AMI.
- Review the AMI details and click "Continue."
-
Configure instance details:
- Enter a descriptive name under "Name and tags."
- Choose the appropriate VPC, subnet, and Availability Zone under "Networking."
- Select an existing security group or create a new one using Cequence defaults under "Security Groups."
- Review all configuration settings and click "Launch Instance."
Defender Setup
Client ID and Secret
- Log in to the Cequence UAP web UI.
- Navigate to User Management, click on "Clients" and then click on "Add New Client"
- Provide a "Client Name", say defender-client-0 and select "Traffic Ingestion". Click "Save".
- Click on the secret icon.
- Dialog box with the Client Secret shows up.
- Hence forth, we will interchangeably refer to "Client Name" as "client-id" and "Client Secret" as "client-secret".
SSH to the virtual machine
SSH to the virtual machine using username ubuntu and ssh private key used during launch
Defender Config Setup
- Collect and note down the following and set them as environment variables for future reference:
- cqai.yourdomain.com: your subdomain used in the DNS for CQAI
- upstream.apiserver.com: your api upstream server
- client-id: "Client Name" created in the previous step
- client-secret: "Client Secret" created in the previous step
export UAP_SUBDOMAIN=<cqai.yourdomain.com> export UPSTREAM_SERVER=<upstream.apiserver.com> export CLIENT_ID=<client-id> export CLIENT_SECRET=<client-secret>
- Test connectivity with CQAI: Successful execution of the curl returns HTTP request with 200 OK.
curl -k -v -o /dev/null \
--location "https://auth.${UAP_SUBDOMAIN}/auth/realms/cequence/protocol/openid-connect/token" \
--header "Content-Type: application/x-www-form-urlencoded" \
--data-urlencode "client_id=${CLIENT_ID}" \
--data-urlencode "client_secret=${CLIENT_SECRET}" \
--data-urlencode "grant_type=client_credentials"- Run setup command with the same parameters:
/opt/cequence/bin/setup.sh \
${UAP_SUBDOMAIN} \
${UPSTREAM_SERVER} \
${CLIENT_ID} \
${CLIENT_SECRET}Note: For advanced configuration options and detailed troubleshooting procedures, please refer to the in-product Cequence documentation.
Verify Defender on the Cequence UAP Platform Portal
Once the Defender is successfully onboarded, on the Cequence UAP portal, navigate to System Diagnostics and scroll to the bottom of the page to list the Defender instances.
The newly added Defender can be identified as defender-<machine-id>, where machine-id is the virtual machine's unique identifier located in /etc/machine-id of the Defender Virtual Machine.