As a cloud security admin, you can secure your AWS workloads (EC2 instances) at the time of rollout through sensor installation scripts for the AWS Userdata, Ansible, Chef, or Puppet configuration management tools.

You can log in to the EC2 instance and run the sensor installation script commands directly into that instance, but it is a time consuming process. For efficiency, use the Carbon Black Cloud console to download the customized sensor install script and install it as part of the instance initialization.

Procedure

  1. On the navigation bar, click Inventory > AWS.
  2. In the AWS Workloads page, click the Sensor Options drop-down menu and select Download sensor install scripts.
    The Download Sensor Install Scripts window displays.
  3. Locate the OS version for your instance and use the Sensor Version drop-down menu to select the related sensor version to install.
    These scripts are customized with pre-populated Org Keys and selected platform details.
  4. Click Download Scripts.
  5. Unzip the downloaded package.
    The sensor installation folders are available for each of the configuration management tools.

    If you select the aws-userdata folder, it contains one script for Unix-based platforms and one PowerShell script for Windows.

  6. Use the script that is relevant to your configuration management tool.
    The following steps show how to create an EC2 instance with a Userdata script running as a part of the instance initialization.
    1. Click Launch instances in the AWS Management Console, select an IAM template, and select an instance type.
    2. Locate the Step 3: Configure Instance Details > Advanced Details > User data option and upload the aws-userdata script As file.
    3. To tag your instance, go to Step 5: Add Tags and define the key-value pairs.
      For example:
      Key Value
      Name latestSensorInstalled
      Priority P2
    4. Click Launch > Launch Instance.
      The sensor installation starts as part of the instance initialization.
  7. Optional: Create Auto Scaling Groups using the same aws-userdata script for easier sensor installations in frequently used images.

Results

After the sensor installs, the instance displays on the Enabled tab.