terraform.md

Terraform

AWS inital setup

Create an AWS account

Follow the steps on this page to create an AWS account

Select a region anda avability zone

Once you login into AWS it should automatically select the nearest datacenter based on your IP address. This repo has been created and tested on the US East - Ohio datacenter and avablility zone B. This repo should be compatible with any region and avability zone but pick the best region based on your location/users. As a side note, dedicated hosts to run macOS only exist in certain regions and avability zones which is why we selected Ohio for the region and B for the avability zone.

Install/Setup AWS CLI and Terraform on macOS

• AWS CLI Windows install
• AWS CLI Linux install
• AWS CLI macOS install

Generate AWS access keys

1. Select <YOUR username> in the top-right then "My Security Credentials"
2. Scroll down to "Access keys for CLI..."
3. Select "Create access key"
4. Save your generated access key ID and secret access key in a safe location

Install/Setup AWS CLI with AWS access keys

1. Open terminal
2. curl "https://awscli.amazonaws.com/AWSCLIV2.pkg" -o /tmp/AWSCLIV2.pkg
3. Download AWS CLI v2
4. sudo installer -pkg /tmp/AWSCLIV2.pkg -target /
5. Install AWS CLI v2
6. aws configure
7. Paste the access key ID generated from above
8. Paste the access key generated from above
9. Enter your region - Ohio is us-east-2
10. Leave ouput format as default
11. 
12. Credentails are saved at ~/.aws/credentials

Install/Setup Terraform

Install Terraform on macOS

It should be noted that this repo only supports Terraform v0.15 and greater.

• Terraform install on Windows
• Terraform install on Linux
• Terraform install on macOS

1. brew tap hashicorp/tap
2. brew install hashicorp/tap/terraform

Spin up Terraform environment

Generate SSH key pair

You might be curious why you need to generate SSH keys rather than using a pre-existing key pair. The reason I create a SSH key is because when you create a Winodws machine on AWS the only way to get the password is provide your SSH PRIVATE KEY. Personally, I am not a huge fan of providing this to AWS so I prefer to generate a key pair that I can burn after the worskhop. Additionally, you can share this SSH key pair with your team for the duration of the workshop.

1. git clone https://github.com/OTRF/macos-workshops
2. cd macos-workshops/terraform
3. ssh-keygen -b 4096 -t rsa -m pem -f ssh_keys/id_rsa -q -N ""

Setup variables.tf

1. vim variables.tf and set:
2. VPC_NAME - Set this to a generic name like OTR_DEFCON_2021. It's important to note that all resouces created will be prepended with this variable. For example, the EC2 name for the Elastic box will be OTR_DEFCON_2021_jump_box.
3. vpcCIDRblock - This defines the network subnet for the VPC. The subnet should be a Class B because Class C subnets will be created inside the VPC. - Default is 172.16.0.0/16 1. managementCIDRblock - This subnet hosts the VPN/jumpbox and the red team boxes. Set this value to a class C subnet inside the subnet defined above - default 172.16.21.0/24. 1. publicCIDRblock - This subnet hosts the boxes that will be interacted by workshop participants so the SIEM boxes - default 172.16.43.0/16 1. corpCIDRblock - This subnet hosts the boxes that will emulate an enterprise environment - default 172.16.50.0/16
4. availabilityZone - The AWS region to create resources in. Be default this is set to Ohio: us-east-2b.
5. ubunut-ami - Set this to the AMI UID 1. AWS Services > Compute > EC2 > Images > AMIs 1. Search for Ubuntu 20.04 1. Copy the AMI ID
6. windows-ami - Set this to the AMI UID 1. AWS Services > Compute > EC2 > Images > AMIs 1. Search for windows 2019 1. Copy the AMI ID
7. macos-ami - Set this to the AMI UID 1. AWS Services > Compute > EC2 > Images > AMIs 1. Search for macOS catalina 1. Copy the AMI ID
8. Repeat the same steps for the Ubuntu AMI for the Windows server AMI
9. siem_servers_map - This maps SIEM names to IP addresses for the local subnet. It's best to leave this set as default.
10. management_subnet_map - Same as the map above
11. corp_servers_map - Same as the maps above

Creating dedicated hosts

1. aws ec2 allocate-hosts --instance-type mac1.metal --availability-zone <availabilityZone - terraform/variables.tf> --auto-placement on --quantity 3 --region <availabilityZone - terraform/variables.tf - leave AZ off>
   1. 
   2. 
   3. Copy the host ID and press q
2. vim terraform/variables.tf scroll down to macos_dedicated_hosts section
   1. Enter the host ID for one openings
   2. 

Spin up Terraform environment

1. terraform init
2. terraform plan
3. terraform apply

References

Terraform

• Install Terraform
• Resource: aws_eip
• Resource: aws_nat_gateway
• How to use Terraform variables
• Github - angristan/openvpn-install
• aws_eip_association
• aws_ec2_traffic_mirror_filter_rule
• aws_network_interface
• aws_route53_record
• Private hosted zones

AWS

• How do I create and activate a new AWS account?
• Elastic IP addresses
• AWS CLI Windows install
• AWS CLI Linux install
• AWS CLI macOS install
• Quick configuration with aws configure
• Using Terraform to Manage DNS Records
• What is a DNS MX record?