Table of contents
Topics on this page
Add your AWS account to Workload Security
Configure the activation type
Launch a master Amazon EC2 instance or Amazon WorkSpace
Deploy an agent on the master
Verify that the agent was installed and activated properly
Set up policy auto-assignment
Create an AMI or custom WorkSpace bundle based on the master
Use the AMI

Install the agent on an AMI or WorkSpace bundle

This page describes how to launch new Amazon EC2 instances and Amazon WorkSpaces with the agent baked in.

For information on how to protect existing Amazon EC2 instances and Amazon WorkSpaces with Workload Security, see Install the agent on Amazon EC2 and WorkSpace instances.

For information on how to protect Amazon WorkSpaces after already protecting your Amazon EC2 instances, see Protect Amazon WorkSpaces if you already added your AWS account.

Baking the agent is the process of launching an EC2 instance based on a public AMI, installing the agent on it, and then saving this custom EC2 image as an AMI. This AMI (with the agent baked in) can then be selected when launching new Amazon EC2 instances.

Similarly, if you want to deploy the agent on multiple Amazon WorkSpaces, you can create a custom WorkSpace bundle that includes the agent. The custom bundle can then be selected when launching new Amazon WorkSpaces.

To bake an AMI and create a custom WorkSpace bundle with a pre-installed and pre-activated agent, follow these steps:

  1. Add your AWS account to Workload Security
  2. Configure the activation type
  3. Launch a 'master' Amazon EC2 instance or Amazon WorkSpace
  4. Deploy an agent on the master
  5. Verify that the agent was installed and activated properly
  6. (Recommended) Set up policy auto-assignment
  7. Create an AMI or custom WorkSpace bundle based on the master
  8. Use the AMI

Add your AWS account to Workload Security

You need to add your AWS accounts to Workload Security. These are the AWS accounts that contain the Amazon EC2 instances and Amazon WorkSpaces that you want to protect.

See About adding AWS accounts for details.

Configure the activation type

You need to indicate whether or not to allow agent-initiated activation.

For instructions, see Install the agent on Amazon EC2 and WorkSpaces and Configure the activation type.

Launch a master Amazon EC2 instance or Amazon WorkSpace

You need to launch a master Amazon EC2 instance or Amazon WorkSpace:

  1. In AWS, launch an Amazon EC2 instance or Amazon WorkSpace. See the Amazon EC2 documentation and Amazon WorkSpaces documentation for details.
  2. Call the instance master.

The master instance is the basis for the EC2 AMI or WorkSpace bundle that you will create later.

Deploy an agent on the master

You need to install and activate the agent on the master. During this process, you can optionally install a policy.

For instructions, see Install the agent on Amazon EC2 and WorkSpaces and Deploy agents to your Amazon EC2 instances and WorkSpaces.

Ideally, if you bake the agent into your AMI or workspace bundle and then want to use a newer agent later, you should update the bundle to include the new agent. However, if this is not possible, you can use the Automatically upgrade agents on activation setting so when the agent in the AMI or bundle activates itself, Workload Security can automatically upgrade the agent to the latest version. For details, see Automatically upgrade agents on activation.

Verify that the agent was installed and activated properly

You should verify that the agent was installed and activated properly on the master before proceeding.

For instructions, see Install the agent on Amazon EC2 and WorkSpaces > Verify that the agent was installed and activated properly.

Set up policy auto-assignment

Optionally, you may need to set up policy auto-assignment depending on how you deployed the agent on the master:

  • If you used a deployment script, then a policy has already been assigned and no further action is required.
  • If you manually installed and activated the agent, no policy was assigned to the agent, and one should be assigned now so that the master is protected. The Amazon EC2 instances and Amazon WorkSpaces that are launched based on the master are also protected.

If you want to assign a policy to the master, as well as auto-assign a policy to future EC2 instances and WorkSpaces that are launched using the master, follow these instructions:

  1. In the Trend Cloud One - Endpoint & Workload Security console, create an event-based task with these parameters:

    • Set the Event to Agent-Initiated Activation.
    • Set Assign Policy to the policy you want to assign.
    • Optionally, set a condition to Cloud Instance Metadata, with either:
      • A tagKey of EC2 and a tagValue. of True (for an EC2 instance)
      • A tagKey of WorkSpaces and a tagValue. of True (for WorkSpaces)

    The preceding event-based task says:

    When an agent is activated, assign the specified policy, on condition that EC2=true or WorkSpaces=true exists in the Amazon EC2 instance or WorkSpace.

    If that key-value pair does not exist in the EC2 instance or WorkSpace, then the policy is not assigned (but the agent is still activated). If you do not specify a condition, then the policy is assigned on activation unconditionally.

    For details on creating event-based tasks, see Automatically assign policies based on AWS EC2 instance tags.

  2. If you added a key-value pair in the Workload Security console in the previous step, do the following:

    1. Go to AWS.
    2. Find your master EC2 instance or WorkSpace.
    3. Add tags to the master with a Key of EC2 or WorkSpaces and a Value of True.
      For details, see Amazon EC2 documentation on tagging, and Amazon WorkSpace documentation on tagging.
      You have now set up policy auto-assignment. New Amazon EC2 instances and Amazon WorkSpaces that are launched using the master are activated automatically (since the agent is pre-activated on the master), and then auto-assigned a policy through the event-based task.
  3. On the master EC2 instance or WorkSpace, reactivate the agent by rerunning the activation command on the agent, or by clicking Reactivate in the Workload Security console. For details, see Activate the agent.
    The reactivation causes the event-based task to assign the policy to the master. The master is protected.

You can now bake your AMI or create a custom WorkSpace bundle.

Create an AMI or custom WorkSpace bundle based on the master

When creating an AMI from AWS, remember to stop the instance prior to creation and do not select the AWS option No reboot. Images created with the No reboot option are not be protected by the agent.

You now have an AMI or WorkSpace bundle that includes a preinstalled and preactivated agent.

Use the AMI

Now that you have a custom AMI or WorkSpace bundle, you can use it as the basis for future Amazon EC2 instances and Amazon WorkSpaces. With the custom AMI or bundle, the agent starts up automatically, activates itself, and applies the protection policy assigned to it. It appears in the Workload Security console with a Status of Managed and a green dot next to it.