Before you begin, make sure that:

  • You have obtained the Cryptographic Security Platform Compliance Manager for AWS build from the Amazon Marketplace.

  • You know the IP address and any required network connection information, such as the domain name and the DNS and gateway IP addresses, for the machine on which you are installing Cryptographic Security Platform Compliance Manager.

    Note: You must use an IPv4 address. Cryptographic Security Platform Compliance Manager does not support IPv6 addresses.

  • You have the required permissions to install software on the target system.
  • The target system meets the basic system requirements described in System Requirements.

CSP Compliance Manager does not support SSM Manager. To access the console, use the EC2 console.

To create an AWS instance

  1. Open a web browser and navigate to the Amazon Web Services login page for your company. 

    The default login page is https://aws.amazon.com

  2. Log in to the AWS Management Console with your AWS username and password.

  3. In the top menu bar, just after your login name, verify that the deployment region is correct. If you need to change it, click the current region and select the new region from the drop-down list.

  4. Create a new VPC to use for the Cryptographic Security Platform Vault node, or select an existing VPC.

  5. In the top menu bar, select Services > Compute > EC2.
  6. Click the blue Launch Instance button and complete the following wizard pages. 

Step 1: Choose an Amazon Machine Image (AMI)

On this page:

  1. Click AWS Marketplace in the left-hand pane.

  2. Search the Marketplace for "Entrust" and select Entrust Cryptographic Security Platform Compliance Manager for AWS BYOL (Bring Your Own License).

  3. Review the details and click Continue.

Step 2: Choose an Instance Type

On this page,

  1. select an instance type. You must choose a t3 image type family, and the minimum size is t3.large.
  2. Click Next: Configure Instance Details.

Step 3: Configure Instance Details

On this page, set the following options:

  • Number of Instances —Specify the number of instances you want to launch in this field. All instances will run in the same region using the same VPC and instance settings. 

    You can use this option to create a multi-node Cryptographic Security Platform Compliance Manager cluster on this VPC without needing to launch additional instances, but you can also add additional Cryptographic Security Platform Compliance Manager nodes to the cluster at any time after the initial node has been configured.

  • Network —Select the VPC you want to use for the Cryptographic Security Platform Compliance Manager node.
  • Set all other options on this page according to your corporate standards.

When you are done, click Next: Add Storage.

Step 4: Add Storage

On this page, set the following options: 

  • Volume Size —Set the disk size based on your configuration requirements. The default setting listed in System resource Recommendations should work for most CSP Compliance Manager installations.
  • Volume Type—For optimal performance, we recommend setting the volume type to one of the SSD options instead of the default Magnetic volume.
  • Delete on Termination—If you select this option and delete the instance, all keys stored on this Cryptographic Security Platform Compliance Manager node will be deleted. In a single-node configuration, this means you can't decrypt encrypted data because you'll lose the keys. If you want to use this option, decrypt all data before deleting the instance.

When you are done, click Next: Add Tags.

Step 5: Add Tags

On this page,

  1. click Add Tag and enter a Name tag for the instance:
    • Key —Enter "Name".
    • Value—Enter the name for this Cryptographic Security Platform Vault node.
  2. Add any other tags as desired.
  3. When you are done, click Next: Configure Security Group.

Step 6: Configure Security Group

On this page:

  1. Make sure that the Assign a security group field is set to Create a new security group. 

    You can use an existing security group as long as it opens all required ports.

  2. Optionally, enter a custom security group name and description in the Security group name and Description fields.
  3. For each required entry in the security group, set the Source IP addresses or security groups that can communicate with Cryptographic Security Platform Vault through the associated ports. 

    We strongly recommend avoiding the default 0.0.0.0/0 notation, which opens the ports to the world.

  4. Click Review and Launch.

Step 7: Review Instance Launch

On this page

  1. Verify your selections and click Launch.
  2. At the prompt, either select an existing key pair or select Create a new key pair, specify a key pair name, and download the new private key file.

  3. When you are done, click Launch Instances. AWS displays a confirmation page stating that your instance is launching and shows the instance ID. 

    Save the ID, as it will be your initial Cryptographic Security Platform Compliance Manager password.

  4. To verify the status of the instance, select Services > EC2 > Instances and locate the new instance in the table. 

    If you requested multiple instances on the Step 3: Configure Instance Details page, you will see multiple Cryptographic Security Platform Compliance Manager instances with the same name listed in the table. We recommend giving each instance a unique name so you can tell them apart as you configure them. To do so, hover over an instance name and click the pencil icon when it appears.