Deploy Device Protection with Terraform

Terraform creates machines, it does not keep software converged on machines that already exist. So Terraform's job here is to make sure every Linux instance it creates comes up with Device Protection already installed.

Read Install Device Protection for Linux first for the token, the packages, and the install options that every method uses. The Linux Rollout Reference covers the rest: token handling, reboots, repeat runs, and device identity.

Install on new instances

Pass a cloud-init document as user_data. Keep the document in its own file so it stays readable and can be reused outside Terraform. See cloud-init for the document itself and its options.

variable "aikido_token" {
  type      = string
  sensitive = true
}

resource "aws_instance" "workstation" {
  ami           = var.workstation_ami
  instance_type = "m7i.large"

  user_data = templatefile("${path.module}/aikido-user-data.yaml.tftpl", {
    package      = "EndpointProtection-amd64.deb"
    aikido_token = var.aikido_token
  })

  tags = {
    Name = "workstation"
  }
}

#cloud-config
runcmd:
  - curl -fsSLo /tmp/${package} https://github.com/AikidoSec/safechain-internals/releases/latest/download/${package}
  - AIKIDO_TOKEN=${aikido_token} apt-get install -y /tmp/${package}
  - rm -f /tmp/${package}

Keep the token out of state and metadata

Anything Terraform renders into user_data is stored in state, and user_data is readable from the instance metadata service by anything running on the machine. Pass the name of a secret instead of the token, and let the boot script fetch the value:

  user_data = templatefile("${path.module}/aikido-user-data.yaml.tftpl", {
    package         = "EndpointProtection-amd64.deb"
    token_parameter = "/aikido/device-protection-token"
  })

Grant the instance profile read access to that parameter, and use the boot-time lookup in aikido-user-data.yaml.tftpl, with ${token_parameter} and ${package} in place of the hardcoded parameter name and package file. The aikido_token variable then drops out entirely, so nothing sensitive reaches Terraform state.

Install on instances Terraform already manages

For a one-off push at create time, use a remote-exec provisioner:

resource "aws_instance" "workstation" {
  # ...

  connection {
    type        = "ssh"
    host        = self.public_ip
    user        = "ubuntu"
    private_key = file(var.ssh_private_key)
  }

  provisioner "remote-exec" {
    inline = [
      "curl -fsSLo /tmp/EndpointProtection-amd64.deb https://github.com/AikidoSec/safechain-internals/releases/latest/download/EndpointProtection-amd64.deb",
      "sudo AIKIDO_TOKEN=${var.aikido_token} apt-get install -y /tmp/EndpointProtection-amd64.deb",
      "rm -f /tmp/EndpointProtection-amd64.deb",
    ]
  }
}

Provisioners come with real limits, which is why HashiCorp calls them a last resort:

• They run once, at create time. They never run again, so drift is never corrected.
• A failed provisioner marks the resource tainted, and the next apply destroys and recreates the instance.
• Terraform needs SSH reachability from wherever you run it, including from CI.

Verify the rollout

On a new instance:

cloud-init status --wait
systemctl is-active aikido-endpoint-protection
aikidoctl version

The device then appears in your device list with an Active status.

Troubleshooting