Amazon Web Services

These requirements apply regardless of which template you select.

Account is in the standard AWS partition

Only AWS Organizations and accounts in the standard AWS commercial partition are supported. Accounts in other partitions (such as AWS GovCloud or AWS China) are not supported.

Deployment in supported AWS region

Deploy the CloudFormation template in one of the AWS regions that are enabled by default by AWS (GovCloud and China regions are not supported):

US East (Northern Virginia)—us-east-1

US East (Ohio)—us-east-2

US West (Northern California)—us-west-1

US West (Oregon)—us-west-2

Asia Pacific (Mumbai)—ap-south-1

Asia Pacific (Osaka)—ap-northeast-3

Asia Pacific (Seoul)—ap-northeast-2

Asia Pacific (Singapore)—ap-southeast-1

Asia Pacific (Sydney)—ap-southeast-2

Asia Pacific (Tokyo)—ap-northeast-1

Canada (Central)—ca-central-1

Europe (Frankfurt)—eu-central-1

Europe (Ireland)—eu-west-1

Europe (London)—eu-west-2

Europe (Paris)—eu-west-3

Europe (Stockholm)—eu-north-1

South America (São Paulo)—sa-east-1

AWS account permissions

The AWS IAM principal (user or role) you use to deploy the CloudFormation stack must have sufficient permissions to create all of the resources the template provisions.

Required permission scope: AdministratorAccess, or a custom policy that allows creating:

•IAM roles and managed policies

•S3 buckets and bucket policies

•CloudTrail trails

•Lambda functions (invoked as CloudFormation custom resources)

•CloudFormation stacks and StackSets

If you are unsure whether your credentials are sufficient, check with your AWS administrator before proceeding.

Deploy the stack only once per account/organization

Each template creates resources with fixed names (for example, CwppServiceRole). Deploying a second stack in the same account will fail with a resource-already-exists error. If a previous deployment failed or needs to be redone, delete the existing CloudFormation stack first.

Exception for CWP service roles in explicit deny policies

If your AWS account or organization uses Service Control Policies (SCPs) or resource-based policies that contain an explicit Deny with a StringNotLike condition on aws:PrincipalARN, you must add an exception for the IAM role that CWP creates. Without this exception, the deny policy will block CWP from operating.

Required exceptions:

•All accounts

Add the following role to the allowlists: arn:aws:iam::*:role/CwppServiceRole.

•Management account (organization-wide deployment only)

For organization-wide deployments, you must also add to management account allowlists: arn:aws:iam::*:role/CwppManagementServiceRole.

This role only needs to be added to resource-based policies in the management account. SCPs do not apply to the management account, so no SCP update is required for this role.

Example policy:

{

  "Effect": "Deny",

  "Resource": "*",

  "Condition": {

    "StringNotLike": {

      "aws:PrincipalARN": "arn:aws:iam::*:role/CwppServiceRole"

    }

  }

}

Ensure that the required roles are included in the StringNotLike allowlist of any such policy before deploying the CloudFormation stack.

The CwppManagementServiceRole is only relevant for organization-wide deployments and only within the management account’s resource-based policies.

These additional requirements apply when using either organization template.

Deploy from the management account

Organization templates must be deployed while logged into your AWS Organizations management account. You cannot use a member account for this deployment.

Locate your Root Organizational Unit ID

During deployment, you will be asked for your root organizational unit ID, which is used to deploy StackSets to all accounts. To find it:

1.Open the AWS Organizations console.

2.Click the Root entry at the top of the organizational tree.

3.Copy the ID—it has the format r-xxxx.

For detailed instructions, see the AWS documentation on navigating your organization’s hierarchy.

Permission to activate CloudFormation–Organizations trusted access

The template automatically activates trusted access between CloudFormation and AWS Organizations (via a Lambda custom resource). The deploying principal must be allowed to call cloudformation:ActivateOrganizationsAccess. This is included in AdministratorAccess. If you use a scoped permission set, ensure this action is explicitly allowed.

These additional requirements apply when using either DHMC template variant.

No conflicting Default Host Management Configuration (DHMC)

If you previously used AWS SSM Quick Setup to configure DHMC, even partially, you cannot use the organization-wide onboarding with DHMC setup. The two configurations will conflict. In that case:

1.Use the non-DHMC organization onboarding.

2.In your existing SSM Quick Setup configuration, ensure DHMC is active in all member accounts and all regions where CWP will be deployed.

Permissions for SSM Quick Setup

In addition to the base organization permissions, the deploying principal needs:

•ssm-quicksetup:UpdateServiceSettings

•organizations:EnableAWSServiceAccess

•Permission to create service-linked roles

These are all included in AdministratorAccess. The template creates a Lambda that performs these steps automatically, you do not need to run any commands manually.

Enabling VM (EC2 instance) protection in CWP for AWS EC2 instances involves two levels of requirements. The EC2 instance must first be registered as an SSM-managed instance (account-level setup), and then each individual instance must meet VM-level requirements before the protection product can be installed on it. Other CWP functionality works on accounts that do not meet these prerequisites.

Account prerequisites

These requirements apply at the AWS account level. CWP configures them automatically during onboarding when the DHMC template variant is used. For accounts where DHMC was not set up during onboarding (or before), these steps must be completed manually before VM protection can be enabled.

•Supported regions for protection deployment

VM Protection can be deployed to EC2 instances in the following AWS regions without additional manual configuration of Default Host Management Configuration (DHMC):

US East (Ohio)—us-east-2

US East (Northern Virginia)—us-east-1

US West (Northern California)—us-west-1

US West (Oregon)—us-west-2

Asia Pacific (Mumbai)—ap-south-1

Asia Pacific (Seoul)—ap-northeast-2

Asia Pacific (Singapore)—ap-southeast-1

Asia Pacific (Sydney)—ap-southeast-2

Asia Pacific (Tokyo)—ap-northeast-1

Canada (Central)—ca-central-1

Europe (Frankfurt)—eu-central-1

Europe (Stockholm)—eu-north-1

Europe (Ireland)—eu-west-1

Europe (London)—eu-west-2

Europe (Paris)—eu-west-3

South America (São Paulo)—sa-east-1

•EC2 instance must be an SSM-managed instance

CWP deploys the ESET protection product through AWS Systems Manager (SSM). For SSM to reach an EC2 instance, that instance must be registered as an SSM-managed instance. The recommended way to ensure this for all instances in an account is to enable Default Host Management Configuration (DHMC), which automatically registers every EC2 instance in an account and region without requiring a dedicated IAM instance profile on each instance.

DHMC can be enabled per region in the AWS console under Systems Manager > Fleet Manager > Account management, or organization-wide via SSM Quick Setup. See the AWS DHMC documentation for details.

VM-level requirements

These requirements apply to each individual EC2 instance. When the account-level setup is in place, the protection product can be deployed to an instance only if it meets all of the following.

•EC2 instance must have outbound internet access

Each EC2 instance targeted for protection deployment must have outbound internet access. Instances in private subnets without a NAT gateway, outbound internet access must be configured before protection can be deployed.

•SSM Agent must be installed and running

AWS SSM communicates with EC2 instances through the SSM Agent. Most AWS-provided AMIs (Amazon Linux, Ubuntu Server, Windows Server) include the SSM Agent pre-installed. For custom or third-party AMIs, verify that the agent is installed and running.

See the AWS SSM Agent documentation for installation instructions and how to verify the agent status on a running instance.

To have a functional deployment of protection to EC2 instances for Linux in AWS, the protected account or organization needs to have AWS System Manager enabled, and EC2 instances need to have the SSM Agent installed.

•VM must run a supported operating system

CWP can only deploy the ESET protection product on instances running a supported OS distribution. For the full list of supported OS distributions, see the reference below.

•VM must meet the protection product system requirements

Each VM targeted for protection deployment must satisfy the minimum hardware and software requirements for the ESET protection product.

Windows Server

oProcessor: Intel or AMD single-core x64

oMemory: 256 MB of free RAM

oHard drive: 700 MB of free disk space

Linux

oProcessor: Intel/AMD x64 with 2 cores (vCPUs)

oMemory: 2 GB of RAM

oHard drive: 700 MB of free disk space

oGlibc 2.28 or later

oLinux kernel version 4.18 or later

oAny UTF-8 encoding locale

oSecure Boot must be disabled

ocurl or wget must be installed

oother packages depend on Live Installer, which needs to have its dependencies/libraries installed in order to run:

oglibc

olibgcc

oopenssl (libssl)

ocurl (libcurl)

otar

1.Go to AWS CloudFormation > Stacks.

2.Find your CWP stack (the name you used when deploying; the default name is CWPP-Integration).

3.Click the stack name.

4.Click the Delete button.

5.Click Delete stack to confirm.

6.Wait for the deletion to complete (check the Events tab to monitor).

1.Go to AWS S3 > Buckets.

2.Look for bucket names that start with eset-cwpp-ct- followed by your account ID.

1.Navigate to the AWS Organizations console.

2.In the navigation pane, select Services.

3.From the list of services, select AWS CloudFormation StackSets.

4.Click Disable trusted access and confirm the action.

5.Navigate to IAM > Roles.

6.Locate and delete the AWSServiceRoleForCloudFormationStackSetsOrgAdmin service-linked role.

1.Navigate to the AWS Organizations console.

2.In the navigation pane, select Services.

3.From the list of services, select Systems Manager.

4.Click the Disable trusted access button.

5.Confirm the action when prompted.

1. Navigate to the AWS Organizations console.

2.In the navigation pane, select Services.

3.From the list of services, select QuickSetup.

4.Click the Disable trusted access button.

5.Confirm the action when prompted.

1.Navigate to IAM > Roles.

2.Search for AWS-QuickSetup-SSM-RoleForEnablingExplorer.

3.When you find it, click the role name.

4.Click the Delete role button.

5.Confirm the deletion.

The following service-linked roles may have been created:

AWSServiceRoleForAmazonSSM

ServiceRoleForAccountDiscoverySSM

AWSServiceRoleForSSMQuickSetup

Delete the specified roles in the same way as you deleted the Explorer role described in the previous step.

1.Navigate to AWS Systems Manager > Fleet Manager.

2.Click Account management.

3.Disable the Enable Default Host Management Configuration option if the DHMC is not needed, or select an existing IAM role if you want to continue using DHMC.

4.Click Configure to save the changes.

5.Repeat these steps in all AWS Regions.