Cloud install

Ensure that you meet the following prerequisites.
Entity	Requirement
Target host	Meets the system requirements Set up to synchronize time with authoritative sources: AWS, GCP, Azure Can connect to *.aporeto.com, *.prismacloud.io, and *.network.prismacloud.io
Local host	apoctl
Privileges	namespace.administrator privileges in the target Microsegmentation namespace Administrator access to the target instance
Cloud credentials	AWS: an IAM role attached to the target host with read-only access to tags (ec2:DescribeTags) GCP: GCP service account attached to the target host Azure: target host assigned a managed identity
Construct a Microsegmentation tag that identifies your cloud account, project, tenant, or organization.
The tag must begin with @auth: followed by a key-value pair. Refer to the table below for some common examples.
Cloud provider	Value	Microsegmentation tag syntax	Microsegmentation tag example
AWS	AWS account ID 1	@auth:account=<AWS_ACCOUNT_ID>	@auth:account=942613894219
GCP	GCP project ID	@auth:projectid=<GCP_PROJECT_ID>	@auth:projectid=acme-dev
Azure	Microsoft tenant ID 2	@auth:tenantid=<TENANT_ID>	@auth:tenantid=cd629cb5-2826-4126-82fd-3f2df5f5bc7
GCP and Azure	Name of organization	@auth:organization=<ORGANIZATION>	@auth:organization=acme
1
You can find your AWS account ID under
My security credentials
in the AWS Management Console.
2
To learn how to find your tenant ID, refer to the Microsoft documentation.
On your local host, set a CLOUD_ID_TAG environment variable containing the Microsegmentation tag you’ve constructed to identify authorized enforcers.
If the target virtual machine is hosted on AWS, also set an AWS_IAM_ROLE environment variable containing the name of the IAM role attached to the instance prepended with @auth:rolename=. See below for examples.
Windows local host:

AWS

$env:CLOUD_ID_TAG="@auth:account=942613894219"
$env:AWS_IAM_ROLE="@auth:rolename=aporeto"

GCP

$env:CLOUD_ID_TAG="@auth:projectid=acme-dev"

Azure

$env:CLOUD_ID_TAG="@auth:tenantid=cd629cb5-2826-4126-82fd-3f2df5f5bc7"

macOS/Linux local host:

AWS

export CLOUD_ID_TAG="@auth:account=942613894219"
export AWS_IAM_ROLE="@auth:rolename=aporeto"

GCP

export CLOUD_ID_TAG="@auth:projectid=acme-dev"

Azure

export CLOUD_ID_TAG="@auth:tenantid=cd629cb5-2826-4126-82fd-3f2df5f5bc7"
Set a TARGET_NS environment variable containing the Microsegmentation namespace of this enforcer.
It should be a grandchild namespace.
Windows
$env:TARGET_NS="/acme/aws-dev/vm1"
macOS/Linux
export TARGET_NS=/acme/aws-dev/vm1
Use one of the following commands to create an API authorization that allows the enforcer to access the Microsegmentation Console.
Select the tab that corresponds to the cloud provider of the target host and whether or not you are using the optional mapping.
Windows local host:

AWS

Set-Content -Path enf-api-auth.yml -Value @"
APIVersion: 0
label: ec2-enforcerd-auth
data:
 apiauthorizationpolicies:
   - authorizedIdentities:
       - '@auth:role=enforcer'
     authorizedNamespace: $($env:TARGET_NS)
     authorizedSubnets: []
     name: Authorize EC2 enforcer to access Microsegmentation Console
     propagate: true
     subject:
       - - "@auth:realm=awssecuritytoken"
         - "$($env:AWS_IAM_ROLE)"
         - "$($env:CLOUD_ID_TAG)"
"@ ; if ($?)
{ apoctl api import -f enf-api-auth.yml }

GCP

Set-Content -Path enf-api-auth.yml -Value @"
APIVersion: 0
label: gcp-enforcerd-auth
data:
 apiauthorizationpolicies:
   - authorizedIdentities:
       - '@auth:role=enforcer'
     authorizedNamespace: $($env:TARGET_NS)
     authorizedSubnets: []
     name: Authorize GCP enforcer to access Microsegmentation Console
     propagate: true
     subject:
       - - "@auth:realm=gcpidentitytoken"
         - "$($env:CLOUD_ID_TAG)"
"@ ; if ($?)
{ apoctl api import -f enf-api-auth.yml }

Azure

Set-Content -Path enf-api-auth.yml -Value @"
APIVersion: 0
label: azure-enforcerd-auth
data:
 apiauthorizationpolicies:
   - authorizedIdentities:
       - '@auth:role=enforcer'
     authorizedNamespace: $($env:TARGET_NS)
     authorizedSubnets: []
     name: Authorize Azure enforcer to access Microsegmentation Console
     propagate: true
     subject:
       - - "@auth:realm=azureidentitytoken"
         - "$($env:CLOUD_ID_TAG)"
"@ ; if ($?)
{ apoctl api import -f enf-api-auth.yml }

macOS/Linux local host:

AWS

cat << EOF | apoctl api import -f -
APIVersion: 0
label: ec2-enforcerd-auth
data:
 apiauthorizationpolicies:
   - authorizedIdentities:
       - '@auth:role=enforcer'
     authorizedNamespace: $TARGET_NS
     authorizedSubnets: []
     name: Authorize EC2 enforcer to access Microsegmentation Console
     propagate: true
     subject:
       - - "@auth:realm=awssecuritytoken"
         - "$AWS_IAM_ROLE"
         - "$CLOUD_ID_TAG"
EOF

GCP

cat << EOF | apoctl api import -f -
APIVersion: 0
label: gcp-enforcerd-auth
data:
 apiauthorizationpolicies:
   - authorizedIdentities:
       - '@auth:role=enforcer'
     authorizedNamespace: $TARGET_NS
     authorizedSubnets: []
     name: Authorize GCP enforcer to access Microsegmentation Console
     propagate: true
     subject:
       - - "@auth:realm=gcpidentitytoken"
         - "$CLOUD_ID_TAG"
EOF

Azure

cat << EOF | apoctl api import -f -
APIVersion: 0
label: azure-enforcerd-auth
data:
 apiauthorizationpolicies:
   - authorizedIdentities:
       - '@auth:role=enforcer'
     authorizedNamespace: $TARGET_NS
     authorizedSubnets: []
     name: Authorize Azure enforcer to access Microsegmentation Console
     propagate: true
     subject:
       - - "@auth:realm=azureidentitytoken"
         - "$CLOUD_ID_TAG"
EOF
Retrieve the URL of your Microsegmentation Console API.
Windows
echo $Env:MICROSEG_API
macOS/Linux
echo $MICROSEG_API
Access the target host, such as via Microsoft Remote Desktop.
Set a MICROSEG_API environment variable containing the URL of your Microsegmentation Console API that you just echoed on your local host.
$env:MICROSEG_API="https://api.microsegmentation.acme.co"
Confirm that the host can connect to the Microsegmentation Console API and trusts its certificate.
Invoke-WebRequest -URI $($env:MICROSEG_API)
Set a TARGET_NS environment variable containing the Microsegmentation namespace of this enforcer.
It should be a grandchild namespace.
$env:TARGET_NS="/acme/aws-dev/vm1"
Download the apoctl MSI to the target host and execute it in quiet mode.
curl https://download.aporeto.com/releases/release-5.0.12/apoctl/windows/apoctl.msi -o apoctl.msi; `
if ($?) {. .\apoctl.msi /quiet}
if ($?) {$env:PATH+="C:\Program Files\Apoctl;"}
Use the following command to install the enforcer.
 apoctl enforcer install windows --auth-mode cloud `
                                 --namespace $($env:TARGET_NS) `
                                 --api $($env:MICROSEG_API) `
                                 --repo https://repo.aporeto.com/releases/release-5.0.12/windows/prisma-enforcer.msi
Refer to Enforcer configuration options if you wish to modify the enforcer’s default settings. You can also run apoctl enforcer install windows -h to review its flags. You can find more information about the enforcer install windows command in the apoctl.
Open the Microsegmentation Console web interface, select
Enforcers
under
Manage
, and navigate to the enforcer’s namespace.
You should find your enforcer listed with a status of
connected
. Click the enforcer and review its metadata.
Select
Platform
in the side navigation menu.
You should see your host as a processing unit, with a dashed green line to a Somewhere external network. Your host is in discovery mode.
Return to your Remote Desktop session.
Uninstall apoctl, remove the apoctl.msi file, and remove the .apoctl directory.
 Start-Process msiexec.exe -ArgumentList '/x apoctl.msi /quiet' -Wait ; `
 if($?) {rm 'apoctl.msi'} ; `
 if($?) {rm '.apoctl' -r -fo}
Refer to Securing host communications to learn how to allow the desired traffic and disable discovery mode.