How Do I Deploy the Wazuh/Wazuh:latest Docker Image on AWS EC2 With TypeScript?

Introduction

This guide explains how to deploy the wazuh/wazuh:latest Docker image on an AWS EC2 instance using Pulumi and TypeScript. The process involves creating an EC2 instance, setting up Docker, and running the Wazuh container. This setup is ideal for those looking to leverage AWS infrastructure to host their Wazuh instance efficiently.

Step-by-Step Process

1. Create a Security Group:

   • Begin by creating a security group that allows HTTP and SSH access. This is crucial for managing the instance and accessing the Wazuh service.

2. Launch an EC2 Instance:

   • Deploy an EC2 instance using the Amazon Linux 2 AMI. This instance will be configured to run Docker and host the Wazuh container.

3. Install Docker:

   • Once the instance is running, update the system packages and install Docker using Amazon Linux Extras. Start the Docker service and add the ec2-user to the Docker user group for permissions.

4. Deploy the Wazuh Container:

   • Use Docker to pull and run the wazuh/wazuh:latest image. The container will be set to run in detached mode and expose the necessary ports.

5. Export Instance Details:

   • Finally, export the public IP and DNS of the instance, which are essential for accessing the Wazuh service remotely.

import * as pulumi from "@pulumi/pulumi";
import * as aws from "@pulumi/aws";

// Create a new security group for the EC2 instance
const securityGroup = new aws.ec2.SecurityGroup("wazuh-sg", {
    description: "Allow HTTP and SSH",
    ingress: [
        { protocol: "tcp", fromPort: 22, toPort: 22, cidrBlocks: ["0.0.0.0/0"] },
        { protocol: "tcp", fromPort: 80, toPort: 80, cidrBlocks: ["0.0.0.0/0"] },
    ],
});

// Create an EC2 instance
const server = new aws.ec2.Instance("wazuh-server", {
    instanceType: "t2.micro",
    ami: "ami-0c55b159cbfafe1f0", // Amazon Linux 2 AMI
    securityGroups: [securityGroup.name],
    userData: `#!/bin/bash
    sudo yum update -y
    sudo amazon-linux-extras install docker -y
    sudo service docker start
    sudo usermod -a -G docker ec2-user
    sudo docker run -d -p 80:55000 wazuh/wazuh:latest
    `,
    tags: {
        Name: "wazuh-server",
    },
});

// Export the public IP of the instance
export const publicIp = server.publicIp;
export const publicHostName = server.publicDns;

Summary

In this guide, we successfully deployed the wazuh/wazuh:latest Docker image on an AWS EC2 instance. We covered the creation of a security group, launching an EC2 instance, installing Docker, and running the Wazuh container. The instance is configured for HTTP and SSH access, making the Wazuh service accessible on port 80. This setup provides a scalable and efficient way to manage security monitoring using AWS and Docker.