This page guides you through deploying a customizable Terraform to add AI Runtime Security: Network intercept protection for Azure cloud
resources.
On this page, you will configure an AI Runtime Security: Network intercept in Strata
Cloud Manager, download the corresponding Terraform configuration, and deploy it in
your cloud environment. This setup will integrate the AI Runtime Security instance
into your cloud network architecture, enabling comprehensive monitoring and
protection of your assets.
After onboarding, the Strata Cloud Manager Command Center dashboard will
show asset discovery with no AI Runtime Security instance protection
deployed. Unprotected traffic paths to and from apps, models, and the internet are
marked in red until you add firewall protection. For more details, see Discover Your Cloud Resources.
Select Cloud Service Provider as Azure and select
Next.
In Firewall Placement, select one or more traffic flows to
inspect.
The following table shows the network traffic type the AI Runtime Security
instance or the VM-Series firewall can support:
Traffic Type
AI Runtime Security instance
VM-Series
AI Traffic - Traffic between your applications
and AI Models
✅
Non-AI Traffic and namespaces (example,
kube-system)
✅
Cluster Traffic
✅
Non-AI and non-cluster traffic
✅
✅
If you select the `kube-system` namespace,
the VM-Series firewall option will be grayed out, as only an AI Runtime
Security instance can protect these namespaces.
Select Next.
In Region & application(s):
Select your cloud account to secure from the onboarded cloud
accounts list.
Select a region from the available options.
In Selected applications, select the applications to secure from
the drop-down list.
This list includes application workloads such as namespaces, or vNets. If you
select the kube-system namespace, the VM-Series firewall option will be grayed
out, as only AI Runtime Security can protect these namespaces.
Enable protection for the vNet by selecting the Added vNet tab
and enter the following:
A vNet Name (Get the vNet name from Azure portal →
Virtual Networks page).
vNet CIDR (To view the vNet CIDR, go to the Azure portal →
Virtual networks and Select your virtual network.
Under Settings, click on the Address space to view
the CIDR block).
Enter a unique Terraform template name (use only alphanumeric
characters and hyphens, avoid using a hyphen at the beginning or end,
and limit the name under 19 characters).
Review the topology for your AI network architecture.
Click Create terraform template.
Click Download terraform template.
Close the deployment workflow to exit.
Unzip the downloaded file. Navigate to <unzipped-folder>
with 2 directories: `architecture` and `modules`. Deploy the Terraform templates
in your cloud environment following the `README.md` file in the `architecture`
folder.
cd architecture
cd security_project
terraform init
terraform plan
terraform apply
cd ../application_project
terraform init
terraform plan
terraform apply
Select Workflows → NGFW Setup → Device Management. The AI Runtime Security: Network intercept appears under Cloud
Managed Devices.
Switch to the Cloud Managed Devices tab to view and
manage the connected state, the configuration sync state, and the licenses of
the deployed AI Runtime Security: Network intercept
(instances).
It takes a while before the Device Status shows as
connected.
