Enter a Basic Configuration as User Data (AWS, Azure, or GCP)

• authcodes—The authcode use to Register the VM-Series Firewall. For example, authcodes=I7115398.
• mgmt-interface-swap—Used to swap the management interface when the VM-Series firewall is behind a load balancer in an AWS or GCP deployment. For example, mgmt-interface-swap=enable.

• AWS User Data—Use a semicolon or newline (\n). If a parameter has more than one option, separate options with a comma. For example:
  If you choose to Save a Basic Configuration in the AWS Secrets Manager, enter the secret name as a key-value pair in the user data field. For example:

    type=dhcp-client
    hostname=palo1
    panorama-server=<PANORAMA-1 IP>
    panorama-server-2=<PANORAMA-2 IP>
    tplname=STK-NGFW-01
    dgname=DG-NGFW-01
    dns-primary=169.254.169.253
    dns-secondary=8.8.8.8
    op-command-modes=mgmt-interface-swap
    dhcp-send-hostname=yes
    dhcp-send-client-id=yes
    dhcp-accept-server-hostname=yes
    dhcp-accept-server-domain=yes
    vm-auth-key= <YOUR AUTH KEY HERE>
    authcodes= <<YOUR AUTH CODE HERE>
                                                                                           

• Azure Custom Data—Use a semicolon. If a parameter has more than one option, separate options with a comma. For example:

  type=dhcp-client; op-command-modes=jumbo-frame;
  vm-series-auto-registration-pin-id=abcdefgh1234****;
  vm-series-auto-registration-pin-value=zyxwvut-0987****

• GCP Custom Metadata—In a file, such as a YAML file or Terraform template, use a newline (\n) for each parameter, and if a parameter has multiple options, use commas to separate them. For example:

  type=dhcp-client
  op-command-modes=mgmt-interface-swap,jumbo-frame
  vm-series-auto-registration-pin-id=abcdefgh1234****
  vm-series-auto-registration-pin-value=zyxwvut-0987****

Save a Basic Configuration in the AWS Secrets Manager

• The secret creator must have full Secrets Manager administrator permissions. A Secrets Manager administrator can permit others to use the secret, as described in Authentication and access control for AWS Secrets Manager.
  For example, the following policy statement allows you to get the secret value:

  {
    "Version": "2012-10-17",
      {
        "Effect": "Allow",
        "Action": "secretsmanager:GetSecretValue",
        "Resource": 
        "arn:aws:secretsmanager:us-east-1:688382******:secret:My_bts-******"
      }
  }

  Refer to Actions, Resources, and Context Keys You Can Use in an IAM Policy or Secret Policy for AWS Secrets Manager to see actions that require permission, such as list, get, and rotate secret.
• (Optional) To encrypt the secret you can use the DefaultEncryptionKey from AWS Secrets Manager.

1. Log in to the AWS console and under Security, Identity and Compliance, select Secrets Manager and select Store a new secret.
2. Select other type of secrets.
   1. Enter the key-value pairs to define the basic configuration.
      mgmt-interface-swap does not work as a key-value pair in an AWS secret. It must be entered as: op-command-modes=mgmt-interface-swap
   2. Select the DefaultEncryptionKey, and click Next.
3. Supply the secret name and description.
   1. Edit the resource permissions to securely access secrets across AWS accounts. For example:

      {
          "Version": "2012-10-17",
          "Statement": [
          {
              "Sid": "VisualEditor0",
              "Effect": "Allow",
              "Action": "s3:ListBucket",
              "Resource": "arn:aws:s3:::sn-bootstrap"
          },
          {
              "Sid": "VisualEditor1",
              "Effect": "Allow",
              "Action": "s3:GetObject",
              "Resource": "arn:aws:s3:::sn-bootstrap/*"
          },
          {
              "Effect": "Allow",
              "Action": "secretsmanager:GetSecretValue",
              "Resource": "arn:aws:secretsmanager:us-east-1:688382******:
                                 secret:My_bootstrap"
          }
        ]
      }

4. (Optional) You can examine the secret from the command line (if you have permission). For example:

   # aws secretsmanager get-secret-value --secret-id My_bootstrap
   {
       "ARN": "arn:aws:secretsmanager:us-east-1:688382******:
                   secret:My_bootstrap",
       "Name": "My_bootstrap",
       "VersionId": "01b6853d-e187-479f-***********",
       "SecretString": "{\"mgmt-interface-swap\":\"enable\",
           \"vm-auth-key\":\"AAA\",\"panorama-server\":\"10.*.*.1\",
           \"panorama-server-2\":\"10.*.*.2\",\"dgname\":\"dg-s0000h\",
           \"tplname\":\"tpl-santosh\",\"license-authcode\":\"AAAA\"}",
       "VersionStages": [ "AWSCURRENT" ],
       "CreatedDate": 1581018411.847
   }