icon-dspm.svg
Posture Control (DSPM)

Deploying the Orchestrator Template

After adding the orchestrator details, deploy the orchestrator template that includes policies and permissions to create IAM roles that provide DSPM with read-only access to the account.

To download and deploy the template:

  1. For Template Type, select CloudFormation or Terraform.

      • Click Orchestrator to download the template as a ZIP file and extract it to your local system.

        Close
        1. Sign in to the orchestrator account on the AWS console and go to CloudFormation.
        2. In the left-side navigation, select StackSets.

        3. Click Create StackSet.

        4. On the Choose a template page:

          • IAM admin role ARN - optional: Select the IAM role name from the drop-down menu, and then select AWSCloudformationStackSetAdministratorRole.
          • IAM execution role name: AWSCloudformationStackSetExecutionRole is populated by default.
          • Prerequisite - Prepare template: Select Template is ready.
          • Specify template: Select Upload a template file and click Choose file. Select the downloaded template (YAML file), then click Open.

        5. Click Next.

        6. On the Specify StackSet Details page:

          • StackSet name: Enter a unique name for the StackSet.
          • Description (Optional): Enter a description for the StackSet.
          • Verify the other fields that are auto-populated.

        7. Click Next.

        8. On the Configure StackSet options page, under Capabilities, select the I acknowledge checkbox for AWS CloudFormation to create IAM resources with custom names and click Next.

        9. On the Set deployment options page:

          • Add stacks to stack set: Select Deploy new stacks.
          • Accounts:
            • Deployment locations: Select Deploy stacks in accounts.
            • Account numbers: Enter the orchestrator account ID that you selected in the DSPM Admin Portal.

            • Specify regions: Select the regions in which DSPM templates must be deployed.

              Select the primary region of the orchestrator as the first region, followed by other regions. DSPM supports all the 29 global regions that are supported by AWS.

          • Deployment options:
            • Region concurrency: Select Sequential to deploy StackSets in one region at a time.

        10. Click Next.

        11. On the Review page, review the StackSet details and then click Submit.

          On the Operations tab, you can see that the StackSet is successfully deployed.

        Close
      Close

      • Click Orchestrator to download the template as a ZIP file and extract it to your local system. The file includes:

        • Multiple Terraform files.
        • A README file with instructions for running the template.

        Close

        1. Update the backend.tf file with the name of the storage services where you want to store the Terraform state files in the orchestrator account. For example:

          • bucket: Enter the S3 bucket name.
          • region: Enter the primary region.
          • dynamoDB_table: Enter the DynamoDB table name.

        2. Open the Command Prompt or any other CLI app in your local system.
        3. Switch to the directory that contains the terraform template.
        4. Copy and paste the access keys of the orchestrator account and press Enter.
        5. Run the following commands:

          1. To initialize the Terraform working directory:

            terraform init

          2. To verify the changes in the Terraform configuration:

            terraform plan

          3. To run the Terraform script:

            terraform apply

            Under Do you want to perform these actions?, enter yes and then press Enter.

        Close
      Close

  2. Click Validate.

    If the template is successfully deployed, you are directed to the Overview page to add the target accounts that must be monitored.

Related Articles
Onboarding a Single AWS AccountAdding Orchestrator Details and Configuring RegionsDeploying the Orchestrator TemplateAdding Account Details and Deploying Templates