AWS Elastic Container Service
Running Keeper Automator with the AWS ECS (Fargate) service
![](https://docs.keeper.io/~gitbook/image?url=https%3A%2F%2F2503956294-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MB_i6vKdtG6Z2n6zWgJ%252Fuploads%252F3kFZhdXIOYTbTYZDHfGx%252FKeeper%2520Automator.jpg%3Falt%3Dmedia%26token%3Da0068e4d-af6c-4b72-a798-acfbca2227b4&width=768&dpr=4&quality=100&sign=10e51325&sv=1)
Overview
This example demonstrates how to launch the Keeper Automator service in Amazon ECS in the most simple way, with as few dependencies as needed.
Requirements:
A managed SSL certificate via the AWS
(1) Create an Automator Config key
Generate a 256-bit AES key in URL-encoded format using one of the methods below, depending on your operating system:
Mac/Linux
Windows
Save this value for the environmental variables set in the task definition.
(2) Create a VPC
If your VPC does not exist, a basic VPC with multiple subnets, a route table and internet gateway must be set up. In this example, there are 3 subnets in the VPC with an internet gateway as seen in the resource map below:
![](https://docs.keeper.io/~gitbook/image?url=https%3A%2F%2F2503956294-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MB_i6vKdtG6Z2n6zWgJ%252Fuploads%252F9KzPDgaRyS0pb6Rdmprz%252FScreenshot%25202023-04-16%2520at%252011.48.19%2520AM.png%3Falt%3Dmedia%26token%3D7be5fc3d-efc3-4774-a3a2-11e8d8a83b5f&width=768&dpr=4&quality=100&sign=e5ca1a5b&sv=1)
(3) Create CloudWatch Log Group
If you would like to capture logs (recommended), Go to CloudWatch > Create log group
Name the log group "automator-logs".
![](https://docs.keeper.io/~gitbook/image?url=https%3A%2F%2F2503956294-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MB_i6vKdtG6Z2n6zWgJ%252Fuploads%252FduoVKiCTtdZIpnwBeQG1%252FScreenshot%25202023-04-16%2520at%252012.11.45%2520PM.png%3Falt%3Dmedia%26token%3D3440fb29-65f3-4982-a1d9-3d633ad93d7c&width=768&dpr=4&quality=100&sign=677b122b&sv=1)
(4) Create an Execution IAM Role
Go to IAM > Create role
Select AWS service
Then search for Elastic Container Service and select it.
Select "Elastic Container Service Task" and click Next
![](https://docs.keeper.io/~gitbook/image?url=https%3A%2F%2F2503956294-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MB_i6vKdtG6Z2n6zWgJ%252Fuploads%252FY299VofMs6mjkh1XxL9Q%252FScreenshot%25202023-04-16%2520at%252010.34.41%2520AM.png%3Falt%3Dmedia%26token%3D9078a2b7-8d38-437a-8aa5-c750ee081e48&width=768&dpr=4&quality=100&sign=a087d1bf&sv=1)
Add the "AmazonECSTaskExecution" policy to the role and click Next
![](https://docs.keeper.io/~gitbook/image?url=https%3A%2F%2F2503956294-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MB_i6vKdtG6Z2n6zWgJ%252Fuploads%252FuGRHj9wzDVWl7zVT4x4s%252FScreenshot%25202023-04-16%2520at%252010.35.02%2520AM.png%3Falt%3Dmedia%26token%3Df0e64e9c-78ad-4420-898a-9a569e699445&width=768&dpr=4&quality=100&sign=10f486db&sv=1)
Assign the name "ECSTaskWritetoLogs" and then create the role.
![](https://docs.keeper.io/~gitbook/image?url=https%3A%2F%2F2503956294-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MB_i6vKdtG6Z2n6zWgJ%252Fuploads%252FcCHhl5Ni7pAkJvoRWICs%252FScreenshot%25202023-04-16%2520at%252010.35.29%2520AM.png%3Falt%3Dmedia%26token%3D1a2d9273-6fe6-488a-aa7d-2fecb7b3bad0&width=768&dpr=4&quality=100&sign=f71db0b8&sv=1)
Make note of the ARN for this Role, as it will be used in the next steps.
In this example, it is arn:aws:iam::373699066757:role/ECSTaskWritetoLogs
![](https://docs.keeper.io/~gitbook/image?url=https%3A%2F%2F2503956294-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MB_i6vKdtG6Z2n6zWgJ%252Fuploads%252FtEWSZXZKzq25Cos4RIA6%252FScreenshot%25202023-04-16%2520at%252012.25.39%2520PM.png%3Falt%3Dmedia%26token%3Dc92440e9-3a95-4d19-8dd6-853255483574&width=768&dpr=4&quality=100&sign=e3206a94&sv=1)
(5) Create a Security Group for ECS
Go to EC2 > Security Groups and click on "Create security group"
Depending on what region your Keeper tenant is hosted, you need to create inbound rules that allow https port 443 from the Keeper cloud. The list of IPs for each tenant location is located below. In the example below, this is the US data center.
We also recommend adding your workstation's external IP address for testing and troubleshooting.
Assign a name like "MyAutomatorService" and then click "Create".
![](https://docs.keeper.io/~gitbook/image?url=https%3A%2F%2F2503956294-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MB_i6vKdtG6Z2n6zWgJ%252Fuploads%252FaS9qtK3n5hroO9nM4JKH%252FScreenshot%25202023-04-15%2520at%25208.45.19%2520AM.png%3Falt%3Dmedia%26token%3D14b995cc-e412-4b44-990f-ed9e4ebaf477&width=768&dpr=4&quality=100&sign=c9acce68&sv=1)
Keeper Tenant Region | IP1 | IP2 |
---|---|---|
US | 54.208.20.102/32 | 34.203.159.189/32 |
US GovCloud | 18.252.135.74/32 | 18.253.212.59/32 |
EU | 52.210.163.45/32 | 54.246.185.95/32 |
AU | 3.106.40.41/32 | 54.206.208.132/32 |
CA | 35.182.216.11/32 | 15.223.136.134/32 |
JP | 54.150.11.204/32 | 52.68.53.105/32 |
Remember to add your own IP which you can find from this URL:
(6) Add the Security Group to the list of inbound rules
After saving the security group, edit the inbound rules again. This time, make the following additions:
Add HTTP port 8089 with the Source set to the security group. This allows traffic from the ALB to the container inside the network and for processing health checks.
![](https://docs.keeper.io/~gitbook/image?url=https%3A%2F%2F2503956294-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MB_i6vKdtG6Z2n6zWgJ%252Fuploads%252Ff1RmCyHsXtSILzHZ2erf%252FScreenshot%25202023-11-02%2520at%25202.32.20%25E2%2580%25AFPM.jpg%3Falt%3Dmedia%26token%3D9c4c8b6b-396a-4ccc-8f94-3ae7996df78a&width=768&dpr=4&quality=100&sign=b4e2d016&sv=1)
(7) Create Elastic Container Service Cluster
Navigate to the Amazon Elastic Container Service.
Select "Create cluster" and assign the cluster name and VPC. In this example we are using the default "AWS Fargate (serverless)" infrastructure option.
The Default namespace can be called "automator"
The "Infrastructure" is set to AWS Fargate (serverless)
Click Create
(8) Create ECS Task Definition
In your favorite text editor, copy the below JSON task definition file and save it.
Important: Make the following changes to the JSON file:
Change the XXX (REPLACE THIS) XXX on line 24 to the secret key created in Step 1 above.
Replace lines 37-39 with the name and location of the log group from Step 3
Change the XXX on line 44 for the role ID as specific to your AWS role (from Step 4, e.g. 373699066757)
Next, go to Elastic Container Service > Task definitions > Create Task from JSON
![](https://docs.keeper.io/~gitbook/image?url=https%3A%2F%2F2503956294-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MB_i6vKdtG6Z2n6zWgJ%252Fuploads%252Fm3lm796QfQhfGaZ2I709%252FScreenshot%25202023-04-16%2520at%252012.33.12%2520PM.png%3Falt%3Dmedia%26token%3D0a0ffce9-e0db-4a7b-a2d8-9ed036862cf6&width=768&dpr=4&quality=100&sign=8ec6de62&sv=1)
Remove the existing JSON and copy-paste the modified JSON file into the box, then click Create.
This task definition can be modified according to your instance CPU/Memory requirements.
(9) Upload SSL Cert to AWS Certificate Manager
In order for an application load balancer in AWS to serve requests for Automator, the SSL certificate must be managed by the AWS Certificate Manager. You can either import or create a certificate that is managed by AWS.
From AWS console, open the "Certificate Manager"
Click on Request
Request a public certificate and click Next
Enter the domain name for the automator service, e.g. automator.lurey.com
Select your preferred validation method and key algorithm
Click Request
Click on the certificate request from the list of certs
If you use Route53 to manage the domain, you can click on the certificate and then select "Create Records in Route53" to instantly validate the domain and create the certificate. If you use a different DNS provider, you need to create the CNAME record as indicated on the screen.
Once create the CNAME record, the domain will validate within a few minutes.
This certificate will be referenced in Step 11 when creating the application load balancer.
(10) Create a Target Group
Go to EC2 > Target Groups and click Create target group
Select "IP Addresses" as the target type
Enter the Target group name of "automatortargetgroup" or whatever you prefer
Select HTTP Protocol with Port 8089
Select the VPC which contains the ECS cluster
Select HTTP1
Under Health checks, select the Health check protocol "HTTP"
Type
/health
as the Health check pathExpand the "Advanced health check settings"
Select Override and then enter port 8089
Click Next
Don't select any targets yet, just click Create target group
(11) Create Application Load Balancer (ALB)
Go to EC2 > Load balancers > Create load balancer
Select Application Load Balancer > Create
Assign name such as "automatornalb" or whatever you prefer
Scheme is "Internet-facing"
IP address type: IPv4
In the Network Mapping section, select the VPC and the subnets which will host the ECS service.
In the Security groups, select "MyAutomatorService" as created in Step 4.
In the Listeners and routing section, select HTTPS port 443 and in the target group select the Target group as created in the prior step (automatortargetgroup).
In the Secure listener settings, select the SSL certificate "from ACM" that was uploaded to the AWS Certificate Manager in Step 9.
Click Create load balancer
(12) Create ECS Service
Go to Elastic Container Service > Task definitions > Select the task created in Step 8.
From this Task definition, click on Deploy > Create Service
![](https://docs.keeper.io/~gitbook/image?url=https%3A%2F%2F2503956294-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MB_i6vKdtG6Z2n6zWgJ%252Fuploads%252FELJzPJLTxOBdLMi2ChZE%252FScreenshot%25202023-04-16%2520at%252012.35.25%2520PM.png%3Falt%3Dmedia%26token%3Dbaa672ef-7e01-43e3-b167-a389a68a1fac&width=768&dpr=4&quality=100&sign=52dea67c&sv=1)
Select Existing cluster of "automator"
Assign Service name of "automatorservice" or whatever name you prefer
For the number of Desired tasks, set this to 1 for now. After configuration is complete, you can increase to the number of tasks you would like to have running.
Under Networking, select the VPC, subnets and replace the existing security group with the ECS security group created in Step 4. In this case, it is called "MyAutomatorService".
For Public IP, turn this ON.
Under Load balancing, select Load balancer type "Application Load Balancer"
Use an existing load balancer and select "automatoralb" created in Step 11.
Use an existing listener, and select the 443:HTTPS listener
Use an existing target group, and select the Target Group from Step 10
Set the Health check path to "/health"
Set the Health check protocol to "HTTP"
Click Create
After a few minutes, the service should start up.
(13) Update DNS
Assuming that the DNS name is hosted and managed by Route53:
Go to Route53 > Create or Edit record
Create an A-record
Set as "Alias"
Route traffic to "Alias to Application and Classic Load Balancer"
Select AWS Region
Select the "automatoralb" Application Load Balancer
Select "Simple Routing"
Select "Save"
The next step is to configure Automator using Keeper Commander while only having one task running.
(14) Install Keeper Commander
At this point, the service is running but it is not able to communicate with Keeper yet.
On your workstation, server or any computer, install the Keeper Commander CLI. This is just used for initial setup. The installation instructions including binary installers are here:
Installing Keeper Commander
After Commander is installed, you can type keeper shell
to open the session, then login using the login
command. In order to set up Automator, you must login as a Keeper Administrator, or an Admin with the ability to manage the SSO node.
(15) Initialize with Commander
Login to Keeper Commander and activate the Automator using a series of commands, starting with automator create
The Node Name (in this case "Azure Cloud") comes from the Admin Console UI as seen below.
The output of the command will display the Automator settings, including metadata from the identity provider.
Run the "automator edit" command as displayed below, which sets the URL and also sets up the skills (team
, team_for_user
and device
).
Next we exchange keys: The enterprise private key encrypted with the Automator public key is provided to Automator:
Initialize the Automator with the new configuration
Enable the service
At this point, the configuration is complete.
For automated health checks, you can use the below URL:
https://<server>/health
Example curl
command:
In this example setup, the load balancer will be forwarding /health checks to the target instances over HTTP port 8089.
(16) Testing the User Experience
Now that Keeper Automator is deployed with a single task running, you can test the end-user experience. No prompts for approval will be required after the user authenticates with the SSO identity provider.
The easiest way to test is to open an incognito mode window to the Keeper Web Vault and login with SSO Cloud. You will not be prompted for device approval.
Assuming that the approval worked, you can now increase the number of tasks running.
(17) Update Task Definition (Optional)
The Keeper Automator service can run quite well on a single container without any issue due to the low number of requests that it processes. However if you would like to have multiple containers running, please follow the below steps:
Click on the "automatorservice" from the ECS services screen
Click on "Update service"
Select the checkbox on "Force new deployment"
Ensure that the latest task revision is selected
Set the Desired Tasks to the number of containers you would like running
Click "Update"
After a few minutes, the new containers will deploy. Wait until all containers are active.
Launch Keeper Commander (or it might still be open)
For every container, the automator setup, automator init and automator enable must be executed.
For example, if there are 3 containers running:
Logging and Monitoring
The Automator logs can be searched and monitored in the "Logs" tab of the ECS service, or in CloudWatch.
![](https://docs.keeper.io/~gitbook/image?url=https%3A%2F%2F2503956294-files.gitbook.io%2F%7E%2Ffiles%2Fv0%2Fb%2Fgitbook-x-prod.appspot.com%2Fo%2Fspaces%252F-MB_i6vKdtG6Z2n6zWgJ%252Fuploads%252FEAdPAidSx00B11SYTaO9%252FScreenshot%25202023-07-12%2520at%252012.42.07%2520PM.jpg%3Falt%3Dmedia%26token%3D676b59c7-e5d2-43cd-9a1c-523e2dbf98e0&width=768&dpr=4&quality=100&sign=895f0e7f&sv=1)
Last updated