This Quick Start deployment guide provides instructions for deploying an Amazon Elastic Compute Cloud (Amazon EC2) instance with Suricata, an open-source tool for monitoring network traffic with Amazon VPC Traffic Mirroring.

This Quick Start is for security, DevSecOps, and network engineers who want to monitor Amazon EC2 instance network traffic using Suricata.

The Quick Start provides AWS CloudFormation templates for deploying Suricata on a single Amazon Linux 2 EC2 instance for limited scale deployments or behind a Network Load Balancer in an Auto Scaling group for highly available larger deployments.

Suricata is an open-source network intrusion detection system (IDS), intrusion prevention system (IPS), and network security monitoring (NSM) engine. Suricata supports Virtual Extensible LAN (VXLAN) for packet decapsulation. You can install Suricata on an EC2 instance to monitor VPC traffic using Traffic Mirroring, a feature of Amazon VPC.

Using Traffic Mirroring, you can copy network traffic from an elastic network interface of Amazon EC2 instances and then send the traffic to out-of-band security and monitoring appliances. Traffic Mirroring is used for troubleshooting, content inspection, and threat monitoring.

You can deploy Suricata’s security and monitoring appliances as individual instances, or as a fleet of instances behind a Network Load Balancer with a User Datagram Protocol (UDP) listener. Traffic Mirroring supports filters and packet truncation, so you extract only the desired traffic of interest using a monitoring tool such as Suricata.

You are responsible for the cost of the AWS services and any third-party licenses used while running this Quick Start. There is no additional cost for using the Quick Start.

The AWS CloudFormation templates for Quick Starts include configuration parameters that you can customize. Some of the settings, such as the instance type, affect the cost of deployment. For cost estimates, see the pricing pages for each AWS service you use. Prices are subject to change.

This Quick Start installs Suricata on an Amazon Linux 2 EC2 instance. The Suricata source code is licensed under version 2 of the GNU General Public License.

Deploying this Quick Start for a new virtual private cloud (VPC) with default parameters builds the following Suricata on Amazon Linux 2 environment in the AWS Cloud.

As shown in Figure 1, the Quick Start sets up the following:

*The template that deploys the Quick Start into an existing VPC skips the components marked by asterisks and prompts you for your existing VPC configuration.

Perform the following steps to verify that Suricata is installed and running on the target instances.

Q. I encountered a CREATE_FAILED error when I launched the Quick Start.

A. If AWS CloudFormation fails to create the stack, relaunch the template with Rollback on failure set to Disabled. This setting is under Advanced in the AWS CloudFormation console on the Configure stack options page. With this setting, the stack’s state is retained, and the instance keeps running so that you can troubleshoot the issue. (For Windows, look at the log files in %ProgramFiles%\Amazon\EC2ConfigService and C:\cfn\log.)

For more information, see Troubleshooting AWS CloudFormation.

Q. I encountered a size-limitation error when I deployed the AWS CloudFormation templates.

A. Launch the Quick Start templates from the links in this guide or from another S3 bucket. If you deploy the templates from a local copy on your computer or from a location other than an S3 bucket, you might encounter template-size limitations. For more information, see AWS CloudFormation quotas.

Q. I am using the Network Load Balancer as the VPC Traffic Mirroring target, but I don’t see mirrored traffic.

A. By default, each load balancer node distributes traffic across the registered targets in its Availability Zone only. Verify that the EC2 instances running Suricata are instantiated in both the Availability Zones. You can also research how to enable cross-zone load balancing.

After you successfully deploy this Quick Start, confirm that your resources and services are updated and configured — including any required patches — to meet your security and other needs. For more information, see the AWS Shared Responsibility Model.

To post feedback, submit feature ideas, or report bugs, use the Issues section of the GitHub repository for this Quick Start. To submit code, see the Quick Start Contributor’s Guide.

See the AWS Quick Start home page.

Visit our GitHub repository to download the templates and scripts for this Quick Start, to post your comments, and to share your customizations with others.

This document is provided for informational purposes only. It represents AWS’s current product offerings and practices as of the date of issue of this document, which are subject to change without notice. Customers are responsible for making their own independent assessment of the information in this document and any use of AWS’s products or services, each of which is provided “as is” without warranty of any kind, whether expressed or implied. This document does not create any warranties, representations, contractual commitments, conditions, or assurances from AWS, its affiliates, suppliers, or licensors. The responsibilities and liabilities of AWS to its customers are controlled by AWS agreements, and this document is not part of, nor does it modify, any agreement between AWS and its customers.

The software included with this paper is licensed under the Apache License, version 2.0 (the "License"). You may not use this file except in compliance with the License. A copy of the License is located at http://aws.amazon.com/apache2.0/ or in the accompanying "license" file. This code is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either expressed or implied. See the License for specific language governing permissions and limitations.