AWS S3 Installation Guide

Overview

Ransomware Defender for AWS provides real-time security for object data in Amazon S3. It monitors, alerts on, and automatically locks out accounts with malicious object I/O patterns against protected S3 buckets.

This is a separate product from the PowerScale, Qumulo, and VAST editions of Data Security, deployed entirely within your AWS account rather than as an on-premises virtual appliance.

note

Ransomware Defender for AWS is licensed per bucket, by subscription, in bundles of protected buckets. Licensing is based on 50 TB of protected data per hour.

Product architecture

Ransomware Defender for AWS deploys two EC2 instances into your AWS account:

• Eyeglass — the GUI and management appliance (1 instance).
• ECA (Extended Cluster Agent) — the analysis engine (2 instances, deployed as an autoscaling group).

The stack also provisions and uses AWS CloudTrail, SQS queues, a managed Kafka service (Amazon MSK), and an SNS topic to capture and analyze S3 protocol operations.

info

Object-access information is processed in a managed Kafka service that is private to your environment and retained for up to 48 hours before Kafka purges it. Detected ransomware and other event data is stored locally on the Eyeglass appliance, under /opt/superna/db, and can be purged on request through Superna Support. Ransomware Defender for AWS does not encrypt or decrypt customer data; the management UI is served over HTTPS.

Product requirements

The following AWS services are used by the deployed stack:

• EC2 — default configuration is 1 GUI VM (Eyeglass) and 2 analysis VMs (ECA).
• AWS Managed Kafka (Amazon MSK).
• CloudFormation templates.
• CloudTrail — logs S3 protocol operations and is the primary input for behavioral analysis.
• SNS.
• One or more S3 buckets to protect.
• An Eyeglass IAM service account with permission to stop attacks (shut down access).

Firewall requirements

Product usage ports

Port	Direction	Purpose
SMTP 25 TCP	Eyeglass VM → SMTP server	Send email alerts to an SMTP server.
Syslog 514 UDP/TCP	Eyeglass VM → syslog server	Send alarms over syslog to a syslog server.
HTTPS 443 (TLS 1.2/1.3)	Administrator → Web UI	Administrator login to the Web UI.
SSH 22 TCP	Administrator → instances	SSH access to the CLI.

VPC internal firewall ports

warning

Do not modify any security group firewall settings created by the stack. All ports are required for product operation.

Port	Security group	Direction	Purpose
HTTPS 443 TCP	Eyeglass	Inbound	Web GUI
SSH 22 TCP	Eyeglass	Inbound	SSH to Eyeglass
2013 TCP	Eyeglass	Inbound	WebSocket
5514 UDP	Eyeglass	Inbound	Syslog forwarding from ECA instances
9092 TCP	Eyeglass	Inbound	Kafka (MSK) service port
2181 TCP	Eyeglass	Inbound	Zookeeper (MSK) service port
9094 TCP	Eyeglass	Inbound	Kafka (MSK) service port
HTTPS 443 TCP	ECA instance	Inbound	Management UI, for debugging only
SSH 22 TCP	ECA instance	Inbound	SSH for CLI access to ECA instances

Deploy Ransomware Defender for AWS

Prerequisites

1. Decide which region the stack will be deployed in. Stack deployment is currently supported in these regions only: US East (N. Virginia), US East (Ohio), and Canada (Central).
2. Create an EC2 key pair in the target region and download the .pem key — it's used to SSH into all deployed EC2 instances. You'll need the key pair name during deployment.

Deploy from the AWS Marketplace

1. Open the Ransomware Defender for AWS Marketplace listing and subscribe to the product, then select Continue to configuration.

2. Select the fulfillment option (Superna Defender for AWS), the software version, and the region, then select Continue to Launch.

3. Review the configuration details, choose Launch CloudFormation as the action, then select Launch.

4. On the Create Stack page, choose:

   • Prepare template: Template is ready
   • Template source: Amazon S3 URL

   Select Next.

5. On Specify stack details, enter a unique Stack name and set the parameters:

   Parameter	Description
   AccessLocation	IP address range allowed to access the EC2 instances.
   AccessLocation2	Optional second IP address range allowed to access the EC2 instances.
   KeyName	Name of the existing EC2 key pair created in the prerequisites step, used for SSH access.
   OperatorEMail	Optional email address notified of scaling operations.

6. Select Next and leave the defaults on Configure stack options.

7. Select Next, review the stack details, accept the IAM role permissions under Capabilities, and submit the stack for deployment.

8. Deployment can take up to an hour or more. Track progress on the CloudFormation Events/Resources tabs. The stack reaches CREATE_COMPLETE status once deployment finishes.

9. Retrieve the public IPs of the deployed instances from the CloudFormation console:

   • Eyeglass: on the stack's Resources tab, find EyeglassInstance → open its physical ID → the instance → copy the public IP.
   • ECA: on the Resources tab, find ECAGroup → physical ID → Instance Management → the instance → copy the public IP.

10. Complete initial access setup:

    • SSH to the Eyeglass instance as ec2-user:

      ssh -i <path/to/key.pem> ec2-user@<eyeglass_instance_public_ip>

    • Set the admin user's password: sudo passwd admin

    • Switch to the admin user to review configuration files or logs: sudo su - admin

    • Access the Eyeglass Web UI at https://<public_dns>/eyeglass/ and sign in as admin with the password set above.

11. To access ECA instances for logs and configuration files:

    • SSH to the ECA instance as ec2-user:

      ssh -i <path/to/key.pem> ec2-user@<eca_instance_public_ip>

    • Set the ecaadmin user's password: sudo passwd ecaadmin

    • Switch to the ecaadmin user: sudo su - ecaadmin

Configure AWS from Eyeglass

1. Sign in to the Eyeglass GUI as an admin user at https://<public_dns>/eyeglass/.

2. From the main menu, select Add Managed Devices. This adds AWS S3 to the Eyeglass inventory and lets you select buckets to protect.

   note

   The Marketplace deployment applies IAM role permissions to the instances automatically, so no additional credentials are required by default. To use a custom IAM role instead, clear Use current EC2 instance credentials.

   Superna recommends leaving Preserve failed resources on deployment failure checked — if the event-capture stack fails to deploy, it won't be automatically deleted, which makes it easier to diagnose the failure from the CloudFormation console.

3. Select Next, then search or scroll the list of S3 buckets and check the box for each bucket to protect.

4. On the next page, regions are auto-detected from the buckets you selected. No action is needed here unless you want to customize the access and secret keys for a bucket — use Edit or Add to do so.

5. Select Submit. Eyeglass submits a job to deploy the superna-event-capture CloudFormation stack in the same region as the selected bucket(s), creating the required SQS queues, CloudTrail configuration, and EventBridge rules.

   Open the jobs icon and select the running job to monitor deployment progress. Your buckets are protected once the job completes.

6. To review what was created, open the CloudFormation section of the AWS console and check the stack's Outputs tab.

View protected buckets

To see the list of protected buckets from Eyeglass, either:

• Open Inventory View, or
• Open the Ransomware Defender GUI → Configuration tab → Configure AWS → select Show protected buckets only.

Add more buckets to an existing deployment

1. Open the Ransomware Defender GUI → Configuration tab → Configure AWS.
2. Select the additional bucket(s) and select Submit.

Eyeglass submits a job to update the protected-buckets list for the existing event-capture-stack if the new buckets are in the same region as the original deployment. If a newly added bucket is in a different region, Eyeglass deploys a new event-capture-stack in that region.

note

Billing for newly protected buckets begins once the job is submitted.

Next steps

Once your buckets are protected, see the Ransomware Defender for AWS Admin Guide for Security Guard configuration, monitoring, and day-to-day operation.