Terraform Modules for CloudGuard Network Security (CGNS) - AWS

Introduction

This repository provides a structured set of Terraform modules for deploying Check Point CloudGuard Network Security in Amazon Web Services (AWS). These modules automate the creation of Virtual Private Clouds (VPCs), Security Gateways, High-Availability architectures, and more, enabling secure and scalable cloud deployments.

Repository Structure

Submodules: Contains modular, reusable, production-grade Terraform components, each with its own documentation.

Examples: Demonstrates how to use the modules.

Available Submodules

Submodules:

• autoscale_gwlb - Deploys Auto Scaling Group of CloudGuard Security Gateways into an existing VPC.
• cme_iam_role - Creates AWS IAM Role for Cloud Management Extension (CME) on Security Management Server.
• cme_iam_role_gwlb - Creates AWS IAM Role for Cloud Management Extension (CME) manages Gateway Load Balancer Auto Scale Group on Security Management Server.
• gateway - Deploys Check Point CloudGuard Network Security Gateway into an existing VPC.
• gateway_master -Check Point CloudGuard Network Security Gateway into a new VPC.
• gwlb - Deploys AWS Auto Scaling group configured for Gateway Load Balancer into an existing VPC.
• gwlb_master - Deploys AWS Auto Scaling group configured for Gateway Load Balancer into a new VPC.
• management - Deploys CloudGuard Network Security Management Server into an existing VPC.

Internal Submodules:

• amis
• cloudwatch_policy
• elastic_ip
• gateway_instance
• instance_type
• internal_default_route
• load_balancer
• permissive_sg
• version_license
• vpc

---

AWS Terraform Security Group Configuration

Default Security Rules

Each submodule in this repository includes preconfigured security group rules designed to ensure the solution works properly out of the box. These rules are tailored for the default deployment scenarios but may require adjustments to meet your specific security and compliance requirements.

Example: To restrict inbound\outbound traffic, update the security_rules attribute in the submodule configuration:

  security_rules = [
    {
      direction   = "ingress"
      from_port   = 22
      to_port     = 22
      protocol    = "tcp"
      cidr_blocks = ["10.0.0.0/30"]
    }
  ]

Best Practices for Using CloudGuard Modules

Step 1: Use the Required Module

Add the required module in your Terraform configuration file (main.tf) to deploy resources. For example:

provider "aws" { }

module "example_module" {
  source  = "CheckPointSW/cloudguard-network-security/aws//modules/{module_name}"
  version = "{chosen_version}"
  # Add the required inputs
}

---

Step 2: Open the Terminal

Ensure you have the AWS CLI installed and navigate to the directory containing your main.tf file: is located, using the appropriate terminal:

• Linux/macOS: Terminal.
• Windows: PowerShell or Command Prompt.

---

Step 3: Set Environment Variables and Log in with AWS CLI

Set up your AWS credentials and configure the default region by setting environment variables:

Linux/macOS

export AWS_ACCESS_KEY_ID="{your-access-key-id}"
export AWS_SECRET_ACCESS_KEY="{your-secret-access-key}"
export AWS_DEFAULT_REGION="{your-region}"

aws configure

PowerShell (Windows)

$env:AWS_ACCESS_KEY_ID="{your-access-key-id}"
$env:AWS_SECRET_ACCESS_KEY="{your-secret-access-key}"
$env:AWS_DEFAULT_REGION="{your-region}"

aws configure

Command Prompt (Windows)

set AWS_ACCESS_KEY_ID="{your-access-key-id}"
set AWS_SECRET_ACCESS_KEY="{your-secret-access-key}"
set AWS_DEFAULT_REGION="{your-region}"

aws configure

---

Step 4: Deploy with Terraform

Use Terraform commands to deploy resources securely.

Initialize Terraform

Prepare the working directory and download required provider plugins:

terraform init

Plan Deployment

Preview the changes Terraform will make:

terraform plan

Apply Deployment

Apply the planned changes and deploy the resources:

terraform apply

Note: The terraform apply command might vary slightly depending on the submodule configurations. Pay close attention to any additional instructions provided in the submodules' documentation to ensure correct usage and handling of the resources.