Single gateway on AWS — Marketplace AMI

Downloads

• 📄 Download this guide as a PDF
• 📦 Download the deployment artifacts (Terraform + CloudFormation, .zip)

A minimal, production-shaped landing zone for the Enforza NVA — one VPC, one firewall in a public subnet, and two private workload subnets whose internet-bound traffic is routed through the firewall for secure NAT and Layer-7 egress filtering. Deploy it with Terraform or CloudFormation — both build the identical architecture.

Marketplace-AMI variant

The firewall launches from the Enforza AWS Marketplace AMI and self-registers on first boot using the EC2 Instance Identity Document — no bootstrap key or token to supply. (Don’t want a Marketplace subscription? See Single gateway — Terraform / CloudFormation, which installs onto a stock base image with a deployment key.)

Architecture

                         Internet  (0.0.0.0/0)
                              │
                       Internet Gateway
                              │
   VPC · enforza-single-gateway · 10.0.0.0/16
   ┌────────────────────────────────────────────────────────┐
   │  Public subnet · 10.0.0.0/24 · AZ 0                     │
   │     enforza-fw (NVA) · c6i.large · src/dest check OFF   │
   │     SNAT egress · L7 filtering · Elastic IP             │
   │     public-rt: 0.0.0.0/0 → IGW                          │
   │                                                        │
   │  Private subnet A          Private subnet B            │
   │  10.0.1.0/24 · AZ 0        10.0.2.0/24 · AZ 1          │
   │   workloads (no public IP)  workloads (no public IP)   │
   │   private-rt-a:             private-rt-b:              │
   │   0.0.0.0/0 → firewall ENI  0.0.0.0/0 → firewall ENI   │
   └────────────────────────────────────────────────────────┘

What it deploys

• One VPC (10.0.0.0/16) and one Internet Gateway.
• One public subnet (10.0.0.0/24, AZ 0) hosting the Enforza firewall with an Elastic IP.
• Two private workload subnets (10.0.1.0/24 AZ 0, 10.0.2.0/24 AZ 1).
• One Enforza EC2 instance (default c6i.large) on the Enforza Marketplace AMI, source/destination check disabled.
• A public route table (0.0.0.0/0 → IGW) and two private route tables (0.0.0.0/0 → the firewall's network interface).

All resources are tagged Project=enforza and Scenario=01-single-gateway.

How it registers on first boot

1. The instance launches from the Enforza Marketplace AMI — the engine is already baked in.
2. On first boot it self-registers with the Enforza cloud using the EC2 Instance Identity Document.
3. There is no bootstrap key or token to supply — nothing to paste, nothing to expire.
4. Once running, the firewall appears in the console, ready to claim.

The Marketplace AMI proves its identity with the signed EC2 Instance Identity Document, so no secret changes hands. The networking is identical to the deployment-key variant; only the image and the way the engine registers differ.

Prerequisites

• An active Enforza AWS Marketplace subscription and the resulting AMI id for your region.
• An AWS account, a region, and credentials configured.
• Terraform ≥ 1.5 (AWS provider ~> 5.0) or the AWS CLI / Console for CloudFormation.

Subscribe and get the AMI id

AWS Marketplace: subscribe to Enforza, then find the AMI id for your target region:

• Ensure your AWS Marketplace subscription is active.
• Note the AMI id for the region you’ll deploy into; it looks like ami-xxxxxxxxxxxxxxxxx.

The Marketplace AMI is region-specific — the id differs per region, so grab the one that matches where you’re deploying. Unlike the deployment-key variant, there’s no key to generate: the AMI self-registers on first boot.

Option A — Deploy with Terraform

Work in the terraform/ directory and pass the Marketplace AMI id as a variable:

cd terraform
terraform init
terraform plan  -var enforza_ami_id=ami-xxxxxxxxxxxxxxxxx
terraform apply -var enforza_ami_id=ami-xxxxxxxxxxxxxxxxx

The whole VPC, subnets, route tables, firewall instance and Elastic IP come up together; the firewall self-registers on first boot — no key to pass.

Optional overrides:

-var instance_type=c6i.xlarge
-var ssh_key_name=my-key
# CIDRs: vpc_cidr, public_subnet_cidr, private_subnet_a_cidr, private_subnet_b_cidr

Option B — Deploy with CloudFormation (CLI)

One self-contained template builds the identical architecture. Pass the AMI id as a parameter override:

aws cloudformation deploy \
  --template-file cloudformation/template.yaml \
  --stack-name enforza-single-gateway \
  --parameter-overrides EnforzaAmiId=ami-xxxxxxxxxxxxxxxxx \
  --capabilities CAPABILITY_NAMED_IAM

CAPABILITY_NAMED_IAM is required because the stack creates a named IAM role for the instance. Optional parameters: InstanceType, SshKeyName, and the CIDR parameters (VpcCidr, PublicSubnetCidr, PrivateSubnetACidr, PrivateSubnetBCidr).

Prefer clicking to typing? Upload the template in the AWS Console

1. Download the template — grab cloudformation/template.yaml from the deployment artifacts bundle.
2. Open CloudFormation → Create stack → With new resources (standard).
3. Choose the template → Template is ready → Upload a template file → select template.yaml → Next.
4. Name it and set parameters — Stack name enforza-single-gateway; paste EnforzaAmiId = ami-xxxxxxxxxxxxxxxxx; leave the rest at defaults (or set InstanceType, SshKeyName, CIDRs) → Next.
5. Stack options — nothing required → Next.
6. Acknowledge IAM & submit — tick the IAM acknowledgement → Submit.
7. Watch it build — the Outputs tab shows FirewallInstanceId — the instance you’ll claim in the console.

Claim the firewall, and how traffic flows

The Marketplace AMI self-registers on first boot using the EC2 Instance Identity Document — no bootstrap key or token. Once the instance is running, claim it in the Enforza console using your AWS account id and the instance id (the firewall_instance_id / FirewallInstanceId output).

End-to-end path:

1. A workload in a private subnet sends traffic to the internet.
2. Its private route table sends 0.0.0.0/0 to the firewall’s network interface.
3. The engine inspects and filters the egress at Layer 7, then SNATs the packet to the firewall’s Elastic IP.
4. The public route table sends 0.0.0.0/0 to the Internet Gateway, and the packet leaves.
5. Return traffic follows the reverse path back through the firewall to the workload.

Why source/destination check is disabled

A NAT/forwarding appliance handles packets addressed to other hosts (the private workloads). EC2’s source/destination check would drop those; disabling it (SourceDestCheck: false) is what permits the instance to forward them. Without it, the gateway would drop all transit traffic.

Teardown — stop the meter

# Terraform
cd terraform
terraform destroy -var enforza_ami_id=ami-xxxxxxxxxxxxxxxxx

# CloudFormation
aws cloudformation delete-stack --stack-name enforza-single-gateway

Then delete the firewall from the Enforza console.