Terraform Modules for CloudGuard Network Security (CGNS) - AWS

Introduction

This repository provides a structured set of Terraform modules for deploying Check Point CloudGuard Network Security in Amazon Web Services (AWS). These modules automate the creation of Virtual Private Clouds (VPCs), Security Gateways, High-Availability architectures, and more, enabling secure and scalable cloud deployments.

Repository Structure

Submodules: Contains modular, reusable, production-grade Terraform components, each with its own documentation.

Examples: Demonstrates how to use the modules.

Available Submodules

Submodules:

• autoscale - Deploys Auto Scaling Group of CloudGuard Security Gateways into an existing VPC.
• autoscale_gwlb - Deploys Auto Scaling Group of CloudGuard Security Gateways into an existing VPC.
• cluster - Deploys CloudGuard Network Security Cluster into an existing VPC on AWS.
• cluster_master - Deploys CloudGuard Network Security Cluster into a new VPC.
• cme_iam_role - Creates AWS IAM Role for Cloud Management Extension (CME) on Security Management Server.
• cme_iam_role_gwlb - Creates AWS IAM Role for Cloud Management Extension (CME) manages Gateway Load Balancer Auto Scale Group on Security Management Server.
• cross_az_cluster - Deploys Check Point CloudGuard Network Security Cross AZ Cluster into an existing VPC on AWS.
• cross_az_cluster_master - Deploys Check Point CloudGuard Network Security Cross AZ Cluster into into a new VPC.
• gateway - Deploys Check Point CloudGuard Network Security Gateway into an existing VPC.
• gateway_master -Check Point CloudGuard Network Security Gateway into a new VPC.
• gwlb - Deploys AWS Auto Scaling group configured for Gateway Load Balancer into an existing VPC.
• gwlb_master - Deploys AWS Auto Scaling group configured for Gateway Load Balancer into a new VPC.
• management - Deploys CloudGuard Network Security Management Server into an existing VPC.
• mds - Deploys CloudGuard Network Multi-Domain Server into an existing VPC.
• qs_autoscale - Deploys CloudGuard Network Security Gateway Auto Scaling Group, an external ALB/NLB, and optionally a Security Management Server and a web server Auto Scaling Group.
• qs_autoscale_master - Deploys CloudGuard Network Security Gateway Auto Scaling Group, an external ALB/NLB, and optionally a Security Management Server and a web server Auto Scaling Group in a new VPC.
• standalone - Check Point CloudGuard Network Security Gateway & Management (Standalone) instance into an existing VPC.
• standalone_master - CloudGuard Network Security Gateway & Management (Standalone) instance into a new VPC.
• tap - Deploys TAP solution in an existing VPC on AWS.
• tgw_asg - Deploys CloudGuard Network Security Gateway Auto Scaling Group for Transit Gateway with an optional Management Server into an existing VPC.
• tgw_asg_master - CloudGuard Network Security Gateway Auto Scaling Group for Transit Gateway with an optional Management Server in a new VPC.
• tgw_cross_az_cluster - Deploys CloudGuard Network Security Cross AZ Cluster into an existing VPC on AWS for Transit Gateway.
• tgw_cross_az_cluster_master - Deploys CloudGuard Network Security Cross AZ Cluster with a new VPC on AWS for Transit Gateway.
• tgw_gwlb - Deploys WS Auto Scaling group configured for Gateway Load Balancer into existing Centralized Security VPC for Transit Gateway.
• tgw_gwlb_master - Deploys AWS Auto Scaling group configured for Gateway Load Balancer into new Centralized Security VPC for Transit Gateway.

Internal Submodules:

• amis
• cloudwatch_policy
• cluster_iam_role
• custom_autoscale
• elastic_ip
• gateway_instance
• instance_type
• internal_default_route
• load_balancer
• permissive_sg
• version_license
• vpc

---

Best Practices for Using CloudGuard Modules

Step 1: Use the Required Module

Add the required module in your Terraform configuration file (main.tf) to deploy resources. For example:

provider "aws" { }

module "example_module" {
  source  = "CheckPointSW/cloudguard-network-security/aws//modules/{module_name}"
  version = "{chosen_version}"
  # Add the required inputs
}

---

Step 2: Open the Terminal

Ensure you have the AWS CLI installed and navigate to the directory containing your main.tf file: is located, using the appropriate terminal:

• Linux/macOS: Terminal.
• Windows: PowerShell or Command Prompt.

---

Step 3: Set Environment Variables and Log in with AWS CLI

Set up your AWS credentials and configure the default region by setting environment variables:

Linux/macOS

export AWS_ACCESS_KEY_ID="{your-access-key-id}"
export AWS_SECRET_ACCESS_KEY="{your-secret-access-key}"
export AWS_DEFAULT_REGION="{your-region}"

aws configure

PowerShell (Windows)

$env:AWS_ACCESS_KEY_ID="{your-access-key-id}"
$env:AWS_SECRET_ACCESS_KEY="{your-secret-access-key}"
$env:AWS_DEFAULT_REGION="{your-region}"

aws configure

Command Prompt (Windows)

set AWS_ACCESS_KEY_ID="{your-access-key-id}"
set AWS_SECRET_ACCESS_KEY="{your-secret-access-key}"
set AWS_DEFAULT_REGION="{your-region}"

aws configure

---

Step 4: Deploy with Terraform

Use Terraform commands to deploy resources securely.

Initialize Terraform

Prepare the working directory and download required provider plugins:

terraform init

Plan Deployment

Preview the changes Terraform will make:

terraform plan

Apply Deployment

Apply the planned changes and deploy the resources:

terraform apply

Note: The terraform apply command might vary slightly depending on the submodule configurations. Pay close attention to any additional instructions provided in the submodules' documentation to ensure correct usage and handling of the resources.