/SSM

Deploy Trend Micro Deep Security Agents with AWS SSM

Primary LanguagePowerShell

Deploy the DS Agent with SSM

AWS Systems Manager Distributor is a feature that you can use to securely store and distribute software packages, such as software agents, in your accounts. Distributor integrates with existing Systems Manager features to simplify and scale the package distribution, installation, and update process.

These instructions will walk you through how to use AWS Systems Manager Distributor to deploy the Trend Micro Deep Security Agent. We will assume you have a version of Deep Security Manager running and it is accessible to the instances running in AWS. If not, you can deploy the Deep Security Manager using our quick start on the AWS Marketplace.

This will create an AWS IAM Instance Profile for the EC2 instances that we want to deploy the Deep Security Agent on. We will use a CloudFormation Template to create the instance profile, along with two SSM Parameters for the Deep Security Manager Hostname. The CFT must be deployed in the same region as your instances because the SSM Parameters and Distributor are regional entities.

Prerequisites:

EC2 Instances -- Instances you want to install the agent on. See Support Operating Systems for SSM.

AWS CLI -- this is normally installed by default on most Windows and Amazon Linux AMIs

Systems Manager Agent -- latest version -- This is installed by default on most Windows and Amazon Linux AMIs but you will need to upgrade to the latest version to ensure compatibility

Create the Instance Profile and SSM Parameters via CloudFormation

  1. Clone repo: https://github.com/marykay25/SSM

  2. Go to: https://console.aws.amazon.com/cloudformation/

  1. Click Create Stack.

  2. Click Choose File.

  1. Select the file dsm_ssm.template from the repo.

  1. Click Next.

  2. Enter DSMSSM for the Stack Name.

  3. To fill out the template, reference the DSM deployment script by logging into your DSM, then clicking on Support at the top right and then select Deployment Scripts.

    • DSMActivation, enter the Activation URL from the DSM deployment script including the dsm prefix and trailing "/"
    • DSMManage, enter in the DSM Manager URL from deployment script including the https prefix and port
    • TenantID, Required only for DSaaS or Multi-Tenant Deployments, otherwise leave NON
    • Token, Required only for DSaaS or Multi-Tenant Deployments, otherwise leave NONE

  1. Click Next.

  2. Enter Name under Key and DSM SSM under Value.

  3. Click Next.

  1. Check the box next to: I acknowledge that AWS CloudFormation might create IAM resources with custom names.

  1. Click Create.

  1. Wait for the CloudFormation to complete.

Attach the Instance Profile to EC2 Instances

  1. Go to the EC2 Console.

  2. Select the instance you want to add to IAM Role.

  1. Select EC2SSMInstanceProfile.

  2. Click Apply.

  3. Repeat for any other additional instances.

Building the Distributor Package

  1. Go to the S3 Console: https://console.aws.amazon.com/s3/

  2. Select a bucket or create a new one.

  3. Click the bucket name.

  4. Click Create folder. Name the folder DSMDistributor.

  5. Click Save.

  6. Go into the folder DSMDistributor.

  7. Click Upload. Add the manifest.json, TrendMicro_Windows.zip, and TrendMicro_Linux.zip.

  8. Click Upload.

  1. Now click the manifest.json file and copy the link under Object URL up to the last '/'.

  2. Go to System Manager: https://console.aws.amazon.com/systems-manager/

  1. Click Distributor.

  2. Click Create Package.

  3. Enter a Name.

  4. Enter a Version name.

  5. Paste the URL from step 10 into S3 Bucket Location.

  6. Select Extract from package.

  1. Click Create Package.

  1. Wait a minute.

  2. On the left side, click Distributor.

  3. Click TrendMicroDSMAgent or the name you gave for the package.

  1. Click Install one time.

  1. Scroll down to Targets.

  2. Select some Target Instances to install the agent onto.

  1. Scroll to Output options.

  2. Uncheck Enable writing to an S3 bucket.

  1. Click Run.

  1. After a few minutes, the command will succeed.

  1. Now you can log into the Deep Security Manager console to see the new instances.