Before executing the CDK script, you must prepare the necessary AWS credentials and create a pre-configured IVX AMI.
Pre-requisites
The following must be configured prior to deployment:
Acquire IVX License
Trellix provides specific licenses that allow multiple predefined IVX bare metal instances to run simultaneously using the same license keys.
Contact your Trellix sales representative to obtain the licenses.
Prepare AWS environment
The CDK deployment script requires that you configure the following in your AWS environment before running the script:
AWS Credentials: Configure your AWS credentials using the AWS CLI command aws configure, or by exporting the access key, ID, and secret token from the AWS access portal.
AWS Resources: The user must configure the following in their AWS environment:
VPC
VPC Subnets
Security Groups
S3 Buckets (for monitoring, clean, and quarantine data)
Create the IVX custom AMI
A custom Amazon Machine Image (AMI) must be created from the base Trellix IVX AMI to ensure the IVX servers launch with the correct configuration.
Launch an EC2 instance from the Trellix IVX AMI
Set the instance type to c5.metal.
Select 1000 gb - gp2 for storage.
Configure the IVX EC2 instance
Log in to the instance and install the IVX activation code, licenses, and initial configuration.
Add required configurations, such as DA and live configuration for submission analysis.
Execute the CLI command to set the deployment mode: deployment mode cloud provider aws
Create new AMI: Select the configured IVX EC2 Instance and navigate to → . Specify an Image Name and ensure the 1000 gb - gp2 storage volume is included.
This AMI ID that is created must be provided in the config.json file for launching IVX servers.
IAM permissions required to execute the deployment script
The user or AWS Identity and Access Management (IAM) role you use to run the installer must have the necessary permissions to interact with AWS resources. These permissions include creating, modifying, and deleting AWS resources, such as Amazon EC2 instances, Amazon S3 buckets, and AWS Lambda functions.
The IAM user role executing the ./deploy_cdk.sh script must have the following permissions:
AWS Service | Required permissions |
|---|---|
CloudFormation | CreateStack, UpdateStack, DeleteStack, DescribeStacks, DescribeChangeSet, CreateChangeSet, ExecuteChangeSet, DeleteChangeSet, GetTemplate, DescribeStackEvents |
S3 | PutObject, GetObject, ListBucket, CreateBucket, GetBucketLocation, DeleteObject |
IAM | PassRole (to pass the CDK roles for deployment) |
SSM | GetParameter (to fetch output parameters) |
CodeBuild | ListBuildsForProject, BatchGetBuilds (to monitor execution status) |
EC2 | DescribeRegions, DescribeVpcs, DescribeSubnets, DescribeSecurityGroups, DescribeImages, TerminateInstances |
AutoScaling | DescribeAutoScalingGroups, UpdateAutoScalingGroup, DescribeLifecycleHooks, DeleteLifecycleHook, TerminateInstances (for deleting the stack) |
ACM | ListCertificates, DescribeCertificate, ImportCertificate |
WAF | CreateWebACL, UpdateWebACL, DeleteWebACL, GetWebACL, ListWebACLs, AssociateWebACL, DisassociateWebACL, CreateIPSet, UpdateIPSet, DeleteIPSet, GetIPSet, ListIPSets |
Principal permissions | cloudformation.amazonaws.com (to assume the IAM role to create, update, delete and manage the stacks). |