Deploy Secure App Connector V2 on AWS using CloudFormation Template

Last updated
Save as PDF

Secure App Connectors can be deployed in your Virtual Private Clouds (VPCs) for AWS. Secure App Connectors should be deployed across all availability zones to ensure continuity of service in the event of an incident. It should be in appropriate security groups to enable access to applications in the VPC.

Prerequisites

Skyhigh Security recommends Secure App Connector have at least 4CPU, 8GB RAM, and 50GB HDD.
Make sure that you have an Amazon Virtual Private Cloud (VPC) created and have full access to create EC2 instances.

Note: In case of any failure, delete the old stack and redeploy.

Steps to deploy

Download one of the following templates:
- CloudFormation Template if you wish to use AWS assigned IPs for the connector instance (skip step 17 when you download this template)
- CloudFormation Template if you wish to assign a static IP to the connector instance.
Log in to the AWS Management Console.
On the Console Home page, select CloudFormation.

Step 1_1.png

The CloudFormation page appears.

Step 2.png

On the CloudFormation page, click Create stack > With new resources (standard).

Step 4_1.png

In the Prerequisite - Prepare template section, select Template is ready.

Step 5_1.png

In the Specify template section, select Upload a template file.

Step 6_1.png

Click Choose file to upload a template file and make sure you browse to the location of the file.

Screenshot (239).png

Click Next.

Screenshot (240).png

Enter a Stack name.

MicrosoftTeams-image (127)-1.png

Select an EC2 InstanceType from the dropdown list.

NOTE: The c5.xlarge is the minimum supported instance size for the Connector V2. However, you can select a larger instance size based on your requirements.

MicrosoftTeams-image (127)-2.png

Select AWS Private Key Name from the dropdown list using it to login to the EC2 instance.

Note: AWS Secure App Connectors do not support password-based authentication as a login method.

MicrosoftTeams-image (127)-3.png

Enter Volume Size in GB.

Screenshot (245).png

Select the AWS SecurityGroupIds from the dropdown list which allows inbound access on port 22 (i.e. SSH) and outbound access on ports 443 & 8080.

Screenshot (246).png

Configure Proxy settings - BypassProxy and Proxy.

Set the Proxy parameter only when the connector uses a proxy server to reach the Internet (optional).
Bypass Proxy is the list of domains that can be added to bypass the proxy (optional). This parameter can be ignored if there are no domains that need to bypass the proxy, even when a proxy is used.

Note: 1st 3 DNS entries will be used, & the rest will be ignored.

Screenshot (247).png

Copy and paste the connector configuration content from SSE from the downloaded configuration file.

Screenshot (248).png

Enter DNS server (optional).

NOTE: Ensure that this DNS can resolve both public internet hosts and internal private applications.

Screenshot (249).png

Enter the private IP details if you have downloaded the CloudFormation for static private IP address template.

Note: Skip this step if you are using CloudFormation for AWS assigned IP template.

image (6).png

Enter private subnet details.

Screenshot (250).png

Click Next.

Screenshot (251).png

Click Add new tag to define the tag for the resources.

Enter the key name as Tag and the value (as per user).

Screenshot (11).png

Select Roll back all stack resources as behavior on the provisioning feature under Stack failure options and then click Next.

Step 21_1.png

Review all the settings and click Submit.

Screenshot (252).png

Check the resources tab to verify if the EC2 instance got created successfully.

Step 23_1.png

Use a standard SSH Client (like Putty) and enter the following command to log in to EC2 instance:

ssh -i <AWS Private Key> ec2-user@<App Connector Public Hostname or IP Address>

Connector deployment will take around 15-20 minutes.
You can validate your connector deployment, For more details, see Secure App Connector V2 CLI.