Task 2. Deploy your virtual machine on AWS

Deploy a virtual machine on AWS for Cortex XSOAR 8.10 On-prem.

Considerations

• Currently, only AWS Commercial Cloud, also known as AWS Global, is supported (not GovCloud).
• Cortex XSOAR supports only Nitro hypervisor-based instance types, for example m5.4xlarge. For more information, see Amazon EC2 instance types.
• If you set your Cortex XSOAR environment as a standalone (single node), you cannot add nodes to it and switch to a cluster. If you deploy three nodes, you can later add nodes and expand the cluster. For more information, see Manage nodes in a cluster.
• Before importing the VM image, export the VM from your virtualization environment. You need an Amazon S3 bucket in the correct region, and the VM image file must be uploaded to the S3 bucket.
• The VM Import/Export feature in AWS requires a role to perform certain operations on your behalf. You must create a service role named vmimport with a trust relationship policy document that allows VM Import/Export to assume the role, and you must attach an IAM policy to the role. This will allow the vmimport role to access the S3 bucket you created. For more information, see VM Import/Export Requirements, Required service role, and IAM Roles.

  Important

  Ensure the AWS VM role has gp2 ec2:CreateVolume permission.

High Availability and backup and restore

To implement built-in High Availability, deploy a cluster with three nodes (VMs), with each VM on a different hypervisor. This ensures that if one hypervisor fails, the other VMs continue to operate.

You then need to:

• Establish trust between all nodes in the cluster (Task 6).
• Set the Cluster FQDN to the reverse proxy/ingress controller IP address (Task 7). The reverse proxy/ingress controller serves as a single entry point to distribute traffic across the nodes in the cluster.
• Allow Volume Snapshots operations.

  For example, set up a custom policy as follows.

  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": [
                  "ec2:ListSnapshotsInRecycleBin",
                  "ec2:CopySnapshot",
                  "ec2:DeleteSnapshot",
                  "ec2:ModifySnapshotAttribute",
                  "ec2:DescribeSnapshotAttribute",
                  "ec2:CreateSnapshots",
                  "ec2:ResetSnapshotAttribute",
                  "ec2:CreateSnapshot",
                  "ec2:DescribeSnapshots",
                  "ec2:CreateTags"
              ],
              "Resource": "*"
          }
      ]
  }

  Note

  If you subsequently delete the node you backed up, you also need to delete the snapshot. For more information, see Back up data.

How to deploy your virtual machine on AWS

1. In AWS, under Region, confirm the correct region is selected.
2. On your local computer, rename the OVA file to include the prefix migrationhub-orchestrator-vmie-<filename> to follow the AWS naming convention.
3. Upload the OVA image file to a private and secure S3 bucket that you set up.

   1. Under General purpose buckets, select the bucket.
   2. Under Amazon S3 → Buckets → <your bucket name> → Objects, select the folder the OVA image file will upload to.

      The folder must be named with the prefix migrationhub-orchestrator-vmie-<folder-name> and must only contain one OVA file. For more information, see Import virtual machine images to AWS template.
   3. In the Upload info page, drag and drop the OVA image file and select Upload.
4. Create a workflow using AWS Migration Hub Orchestrator.

   Use the Import virtual machine images to AWS template to import an on-premises virtual machine image to AWS.

   1. Open the Migration Hub Orchestrator console.
   2. From the side menu, select Migration & Transfer → AWS Migration Hub.

      AWS Migration Hub is only available in certain regions.
   3. From the Migration Hub side menu, select Orchestrate → Workflows → Create workflow.
   4. On the Choose a workflow template page, select Import new virtual machine images to AWS, then select Next.
   5. Configure the workflow properties.

      • Set the workflow name.
      • Set Disk container as the path to the uploaded image.
      • Under Target environment configuration, confirm Boot mode - optional is legacy-bios.
   6. Select Next.
   7. Select the newly created workflow, then select Run.
5. Create a new identity and access management (IAM) role for the container storage interface (CSI).

   This role enables the virtual machine to create its own storage volume.

   1. From the side menu, select Security, Identity, & Compliance → IAM.
   2. From the IAM role side menu, select Roles, then create a new role.
   3. Under Select trusted entity:

      1. In the Trusted entity type section, select AWS service.
      2. In the Use case section, select EC2.
   4. Click Next.
   5. Under Add permissions, add AmazonEBSCSIDriverPolicy and ROSAAmazonEBSCSIDriverOperatorPolicy.
   6. Click Next.
   7. Under Name, review, and create, enter a name and description in Role details.

      Name and create IAM role example
   8. Click Create role.
6. Launch the virtual machine from the relevant AMI template.

   1. From the side menu, navigate to Services → Compute → EC2.
   2. From the side menu, go to Images → AMIs.
   3. Select the relevant AMI template from the newly created workflow, then select Launch instance from AMI.

      For example:
   4. Configure the virtual machine properties.

      • Instance type: Verify the virtual machine memory meets the CPU and memory requirements. For more information, see System Requirements.
      • Network settings: Create a static IP. Conform to any security group requirements, including a subnet.
      • Key pair (login): Under Key pair name - required, leave the default value Proceed without a key pair.
   5. Under Advanced details → IAM instance profile, select the created IAM role.
   6. Select Launch instance. Confirm by selecting Proceed without key pair and Launch instance again.
7. Repeat these steps for each VM in a cluster.
8. For first time login, open an external terminal and use the ssh admin<server ip address> command to SSH log in. The default user name and password is admin. You can then give the admin a new password.

   Give the admin a new password

   Save the SSH password securely. If you lose this password you cannot recover or change it, and to use SSH you will need to redeploy the cluster.

   The password must be at least eight characters long and contain at least:

   • One lower case letter
   • One upper case letter
   • One number, or one of the following special characters: !@#%

   If this is not a first time login, you can log in from the web console or from a terminal using the ssh admin@<server ip address> command to SSH log in.

   The textual UI menu opens with all the configuration and installation options.

   Navigate the textual UI

   • To start using the textual UI, click anywhere on the screen.
   • To move between the menu items, use the up and down arrow keys. To select a menu item, press the Enter key.
   • To navigate between fields within a menu item, use the Tab key. To save settings, tab to the Save button and press the Enter key.
   • To go back to the menu from a specific menu item field, press the esc key.