Complete Wazuh Deployment Guide on AWS ECS Fargate - Production Ready

Table of Contents#

Introduction#

Deploying Wazuh on AWS ECS Fargate can be challenging due to its multi-container architecture and complex networking requirements. This comprehensive guide provides a complete, production-ready deployment of Wazuh SIEM (Security Information and Event Management) on AWS ECS Fargate.

Wazuh is an open-source security platform that provides:

Intrusion detection
Log data analysis
File integrity monitoring
Vulnerability detection
Configuration assessment
Incident response
Regulatory compliance

This guide will deploy:

Wazuh Indexer: Based on OpenSearch, stores and indexes security data
Wazuh Manager: Central component that analyzes data from agents
Wazuh Dashboard: Web interface for visualization and management

Component Communication Flow#

1
sequenceDiagram
2
    participant Agent as Wazuh Agent
3
    participant NLB as Network LB
4
    participant Manager as Wazuh Manager
5
    participant Indexer as Wazuh Indexer
6
    participant Dashboard as Wazuh Dashboard
7
    participant User as Security Analyst
8

9
    Agent->>NLB: Send logs/events (1514/1515)
10
    NLB->>Manager: Forward to Manager
11
    Manager->>Manager: Analyze & Process
12
    Manager->>Indexer: Store processed data
13

14
    User->>Dashboard: Access UI
15
    Dashboard->>Manager: API Request (55000)
16
    Dashboard->>Indexer: Query data (9200)
17
    Indexer-->>Dashboard: Return results
18
    Dashboard-->>User: Display data
19

20
    Note over Manager,Indexer: Internal communication via Service Discovery

Prerequisites#

Before starting, ensure you have:

AWS Account with the following permissions:
- ECS Full Access
- EC2 (for networking)
- EFS Access
- IAM (for roles)
- CloudWatch Logs
- Application Load Balancer
- Service Discovery
AWS CLI installed and configured:
Terminal window
```
1
aws --version
2
aws configure
```
Required AWS Resources:
- VPC with public and private subnets
- Internet Gateway attached to VPC
- NAT Gateway for private subnets (if using private deployment)
Tools:
- jq for JSON parsing
- openssl for certificate generation
- Text editor for configuration files

Architecture Overview#

Here’s the complete architecture we’ll be building:

1
graph TB
2
    subgraph "Internet"
3
        I[Internet Users]
4
        A[Wazuh Agents]
5
    end
6

7
    subgraph "AWS Network"
8
        subgraph "Load Balancers"
9
            ALB[Application Load Balancer<br/>Port 80/443]
10
            NLB[Network Load Balancer<br/>Ports 1514, 1515, 514]
11
        end
12

13
        subgraph "ECS Fargate Cluster"
14
            subgraph "Wazuh Dashboard"
15
                WD[Wazuh Dashboard<br/>Port 5601]
16
            end
17

18
            subgraph "Wazuh Manager"
19
                WM[Wazuh Manager<br/>Ports 1514, 1515, 514, 55000]
20
            end
21

22
            subgraph "Wazuh Indexer"
23
                WI[Wazuh Indexer<br/>Port 9200]
24
            end
25
        end
26

27
        subgraph "Storage"
28
            EFS[(Amazon EFS<br/>Persistent Storage)]
29
        end
30

31
        subgraph "Service Discovery"
32
            SD[AWS Cloud Map<br/>Namespace: wazuh]
33
        end
34
    end
35

36
    I -->|HTTPS| ALB
37
    A -->|TCP/UDP| NLB
38
    ALB -->|Port 5601| WD
39
    NLB -->|Port 1514| WM
40
    NLB -->|Port 1515| WM
41
    NLB -->|Port 514| WM
42
    WD -->|API Port 55000| WM
43
    WM -->|Port 9200| WI
44
    WD -->|Port 9200| WI
45
    WD -.->|Mount| EFS
46
    WM -.->|Mount| EFS
47
    WI -.->|Mount| EFS
48
    WD -.->|DNS| SD
49
    WM -.->|DNS| SD
50
    WI -.->|DNS| SD
51

52
    classDef aws fill:#FF9900,stroke:#232F3E,stroke-width:2px,color:#fff
53
    classDef wazuh fill:#00A9E0,stroke:#005A86,stroke-width:2px,color:#fff
54
    classDef storage fill:#569A31,stroke:#3B6829,stroke-width:2px,color:#fff
55
    classDef network fill:#7B3FF2,stroke:#5A2FB2,stroke-width:2px,color:#fff
56

57
    class ALB,NLB,SD aws
58
    class WD,WM,WI wazuh
59
    class EFS storage
60
    class I,A network

Deployment Process Overview#

1
flowchart LR
2
    subgraph "Phase 1: Infrastructure"
3
        A[Create VPC & Subnets] --> B[Create ECS Cluster]
4
        B --> C[Set up EFS Storage]
5
        C --> D[Generate SSL Certificates]
6
    end
7

8
    subgraph "Phase 2: Networking"
9
        D --> E[Create Security Groups]
10
        E --> F[Create Load Balancers]
11
        F --> G[Set up Service Discovery]
12
    end
13

14
    subgraph "Phase 3: Deployment"
15
        G --> H[Deploy Wazuh Indexer]
16
        H --> I[Deploy Wazuh Manager]
17
        I --> J[Deploy Wazuh Dashboard]
18
    end
19

20
    subgraph "Phase 4: Configuration"
21
        J --> K[Configure Agents]
22
        K --> L[Set up Monitoring]
23
        L --> M[Enable Auto-scaling]
24
    end
25

26
    style A fill:#f9f,stroke:#333,stroke-width:2px
27
    style M fill:#9f9,stroke:#333,stroke-width:2px

Step 1: Create ECS Fargate Cluster#

Let’s start by creating the ECS cluster:

1
# Create ECS cluster using AWS CLI
2
aws ecs create-cluster \
3
  --cluster-name wazuh-prod-cluster \
4
  --capacity-providers FARGATE FARGATE_SPOT \
5
  --default-capacity-provider-strategy capacityProvider=FARGATE,weight=1 \
6
  --region us-west-2
7

8
# Verify cluster creation
9
aws ecs describe-clusters --clusters wazuh-prod-cluster --region us-west-2

Or use the AWS Console:

Navigate to ECS → Clusters
Click “Create Cluster”
Choose “Networking only” template
Name: wazuh-prod-cluster
Enable Container Insights
Create

Step 2: Set Up EFS for Persistent Storage#

Create EFS File System#

1
# Create security group for EFS
2
aws ec2 create-security-group \
3
  --group-name wazuh-efs-sg \
4
  --description "Security group for Wazuh EFS" \
5
  --vpc-id vpc-xxxxxxxxx \
6
  --region us-west-2
7

8
# Get security group ID
9
EFS_SG_ID=$(aws ec2 describe-security-groups \
10
  --group-names wazuh-efs-sg \
11
  --query 'SecurityGroups[0].GroupId' \
12
  --output text \
13
  --region us-west-2)
14

15
# Allow NFS traffic from VPC CIDR
16
aws ec2 authorize-security-group-ingress \
17
  --group-id $EFS_SG_ID \
18
  --protocol tcp \
19
  --port 2049 \
20
  --cidr 10.0.0.0/16 \
21
  --region us-west-2
22

23
# Create EFS file system
24
aws efs create-file-system \
25
  --creation-token wazuh-efs \
26
  --performance-mode generalPurpose \
27
  --throughput-mode bursting \
28
  --encrypted \
29
  --tags Key=Name,Value=wazuh-efs \
30
  --region us-west-2
31

32
# Get EFS ID
33
EFS_ID=$(aws efs describe-file-systems \
34
  --creation-token wazuh-efs \
35
  --query 'FileSystems[0].FileSystemId' \
36
  --output text \
37
  --region us-west-2)
38

39
echo "EFS ID: $EFS_ID"
40

41
# Create mount targets for each subnet
42
SUBNET_IDS=$(aws ec2 describe-subnets \
43
  --filters "Name=vpc-id,Values=vpc-xxxxxxxxx" \
44
  --query 'Subnets[*].SubnetId' \
45
  --output text \
46
  --region us-west-2)
47

48
for subnet in $SUBNET_IDS; do
49
  aws efs create-mount-target \
50
    --file-system-id $EFS_ID \
51
    --subnet-id $subnet \
52
    --security-groups $EFS_SG_ID \
53
    --region us-west-2
54
done

Prepare EFS Directories#

To create the required directories, we need to mount EFS temporarily on an EC2 instance:

1
# Launch a temporary EC2 instance in the same VPC
2
aws ec2 run-instances \
3
  --image-id ami-0c94855ba95c71c0a \
4
  --instance-type t3.micro \
5
  --key-name your-key-pair \
6
  --security-group-ids $EFS_SG_ID \
7
  --subnet-id subnet-xxxxxxxxx \
8
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=wazuh-efs-setup}]' \
9
  --region us-west-2
10

11
# SSH into the instance and run:
12
sudo yum install -y amazon-efs-utils
13
sudo mkdir /efs
14
sudo mount -t efs $EFS_ID:/ /efs
15

16
# Create all required directories
17
sudo mkdir -p /efs/{filebeat_etc,wazuh-indexer-data,wazuh_etc,wazuh_var_multigroups,filebeat_var,wazuh_active_response,wazuh_integrations,wazuh_wodles,wazuh-dashboard-config,wazuh_agentless,wazuh_logs,wazuh-dashboard-custom,wazuh_api_configuration,wazuh_queue}
18

19
# Set proper permissions
20
sudo chmod -R 755 /efs
21
sudo chown -R 1000:1000 /efs/wazuh-indexer-data
22
sudo chown -R 999:999 /efs/wazuh_*
23
sudo chown -R 1000:1000 /efs/wazuh-dashboard-*
24

25
# Create initial certificate files (we'll update these later)
26
sudo mkdir -p /efs/wazuh_etc/ssl
27
sudo mkdir -p /efs/filebeat_etc/ssl
28

29
# Unmount and terminate instance when done
30
sudo umount /efs

Step 3: Generate SSL/TLS Certificates#

Before creating task definitions, we need to generate SSL certificates for secure communication between components.

Create Certificate Generation Script#

Create a file named generate-wazuh-certs.sh:

1
#!/bin/bash
2
# Variables
3
CERT_DIR="./wazuh-certificates"
4
DAYS_VALID=3650
5

6
# Create certificate directory
7
mkdir -p $CERT_DIR
8
cd $CERT_DIR
9

10
# Generate Root CA private key
11
openssl genrsa -out root-ca.key 2048
12

13
# Generate Root CA certificate
14
openssl req -new -x509 -days $DAYS_VALID -key root-ca.key -out root-ca.pem -subj "/C=US/ST=CA/L=California/O=Wazuh/OU=Security/CN=Wazuh Root CA"
15

16
# Generate admin certificate
17
openssl genrsa -out admin.key 2048
18
openssl req -new -key admin.key -out admin.csr -subj "/C=US/ST=CA/L=California/O=Wazuh/OU=Security/CN=admin"
19
openssl x509 -req -in admin.csr -CA root-ca.pem -CAkey root-ca.key -CAcreateserial -out admin.pem -days $DAYS_VALID
20

21
# Generate node certificates
22
for node in wazuh-indexer wazuh-manager filebeat wazuh-dashboard; do
23
    openssl genrsa -out ${node}.key 2048
24
    openssl req -new -key ${node}.key -out ${node}.csr -subj "/C=US/ST=CA/L=California/O=Wazuh/OU=Security/CN=${node}.wazuh"
25

26
    # Create extensions file for SAN
27
    cat > ${node}.ext <<EOF
28
subjectAltName = DNS:${node}.wazuh, DNS:${node}, DNS:localhost, IP:127.0.0.1
29
EOF
30

31
    openssl x509 -req -in ${node}.csr -CA root-ca.pem -CAkey root-ca.key -CAcreateserial -out ${node}.pem -days $DAYS_VALID -extfile ${node}.ext
32
    rm ${node}.ext ${node}.csr
33
done
34

35
# Create kibanaserver certificate
36
openssl genrsa -out kibanaserver.key 2048
37
openssl req -new -key kibanaserver.key -out kibanaserver.csr -subj "/C=US/ST=CA/L=California/O=Wazuh/OU=Security/CN=kibanaserver"
38
openssl x509 -req -in kibanaserver.csr -CA root-ca.pem -CAkey root-ca.key -CAcreateserial -out kibanaserver.pem -days $DAYS_VALID
39

40
echo "Certificates generated successfully in $CERT_DIR"
41
ls -la $CERT_DIR

Run the script:

1
chmod +x generate-wazuh-certs.sh
2
./generate-wazuh-certs.sh

Upload Certificates to EFS#

1
# Mount EFS on temporary instance again and copy certificates
2
sudo mount -t efs $EFS_ID:/ /efs
3

4
# Copy certificates to appropriate directories
5
sudo cp wazuh-certificates/root-ca.pem /efs/wazuh_etc/ssl/
6
sudo cp wazuh-certificates/wazuh-manager.* /efs/wazuh_etc/ssl/
7
sudo cp wazuh-certificates/filebeat.* /efs/filebeat_etc/ssl/
8
sudo cp wazuh-certificates/root-ca.pem /efs/filebeat_etc/ssl/
9
sudo cp wazuh-certificates/admin.* /efs/wazuh-indexer-data/
10

11
# Set permissions
12
sudo chmod 400 /efs/wazuh_etc/ssl/*
13
sudo chmod 400 /efs/filebeat_etc/ssl/*

Step 4: Create Security Groups#

Create Security Groups for Each Service#

1
# Create security group for ECS tasks
2
aws ec2 create-security-group \
3
  --group-name wazuh-ecs-sg \
4
  --description "Security group for Wazuh ECS tasks" \
5
  --vpc-id vpc-xxxxxxxxx \
6
  --region us-west-2
7

8
ECS_SG_ID=$(aws ec2 describe-security-groups \
9
  --group-names wazuh-ecs-sg \
10
  --query 'SecurityGroups[0].GroupId' \
11
  --output text \
12
  --region us-west-2)
13

14
# Configure security group rules
15
# Wazuh Indexer
16
aws ec2 authorize-security-group-ingress \
17
  --group-id $ECS_SG_ID \
18
  --protocol tcp \
19
  --port 9200 \
20
  --source-group $ECS_SG_ID \
21
  --region us-west-2
22

23
# Wazuh Manager API
24
aws ec2 authorize-security-group-ingress \
25
  --group-id $ECS_SG_ID \
26
  --protocol tcp \
27
  --port 55000 \
28
  --source-group $ECS_SG_ID \
29
  --region us-west-2
30

31
# Wazuh Manager - Agent registration
32
aws ec2 authorize-security-group-ingress \
33
  --group-id $ECS_SG_ID \
34
  --protocol tcp \
35
  --port 1514 \
36
  --cidr 0.0.0.0/0 \
37
  --region us-west-2
38

39
# Wazuh Manager - Agent communication
40
aws ec2 authorize-security-group-ingress \
41
  --group-id $ECS_SG_ID \
42
  --protocol tcp \
43
  --port 1515 \
44
  --cidr 0.0.0.0/0 \
45
  --region us-west-2
46

47
# Syslog
48
aws ec2 authorize-security-group-ingress \
49
  --group-id $ECS_SG_ID \
50
  --protocol udp \
51
  --port 514 \
52
  --cidr 0.0.0.0/0 \
53
  --region us-west-2
54

55
# Wazuh Dashboard
56
aws ec2 authorize-security-group-ingress \
57
  --group-id $ECS_SG_ID \
58
  --protocol tcp \
59
  --port 5601 \
60
  --cidr 0.0.0.0/0 \
61
  --region us-west-2

Step 5: Create IAM Execution Role#

1
# Create IAM policy for ECS task execution
2
cat > ecs-task-execution-policy.json <<EOF
3
{
4
    "Version": "2012-10-17",
5
    "Statement": [
6
        {
7
            "Effect": "Allow",
8
            "Action": [
9
                "ecr:GetAuthorizationToken",
10
                "ecr:BatchCheckLayerAvailability",
11
                "ecr:GetDownloadUrlForLayer",
12
                "ecr:BatchGetImage",
13
                "logs:CreateLogStream",
14
                "logs:PutLogEvents",
15
                "logs:CreateLogGroup"
16
            ],
17
            "Resource": "*"
18
        }
19
    ]
20
}
21
EOF
22

23
# Create IAM role
24
aws iam create-role \
25
  --role-name ecsTaskExecutionRole \
26
  --assume-role-policy-document '{
27
    "Version": "2012-10-17",
28
    "Statement": [
29
      {
30
        "Effect": "Allow",
31
        "Principal": {
32
          "Service": "ecs-tasks.amazonaws.com"
33
        },
34
        "Action": "sts:AssumeRole"
35
      }
36
    ]
37
  }' \
38
  --region us-west-2
39

40
# Attach policy
41
aws iam attach-role-policy \
42
  --role-name ecsTaskExecutionRole \
43
  --policy-arn arn:aws:iam::aws:policy/service-role/AmazonECSTaskExecutionRolePolicy \
44
  --region us-west-2

Step 6: Create Task Definitions#

Wazuh Indexer Task Definition#

Create a file named wazuh-indexer-task-definition.json:

1
{
2
  "family": "wazuh-prod-indexer",
3
  "containerDefinitions": [
4
    {
5
      "name": "wazuh-indexer",
6
      "image": "wazuh/wazuh-indexer:4.8.0",
7
      "cpu": 0,
8
      "portMappings": [
9
        {
10
          "name": "wazuh-indexer",
11
          "containerPort": 9200,
12
          "hostPort": 9200,
13
          "protocol": "tcp",
14
          "appProtocol": "http"
15
        }
16
      ],
17
      "essential": true,
18
      "environment": [
19
        {
20
          "name": "OPENSEARCH_JAVA_OPTS",
21
          "value": "-Xms2g -Xmx2g"
22
        },
23
        {
24
          "name": "bootstrap.memory_lock",
25
          "value": "true"
26
        },
27
        {
28
          "name": "discovery.type",
29
          "value": "single-node"
30
        },
31
        {
32
          "name": "cluster.name",
33
          "value": "wazuh-cluster"
34
        },
35
        {
36
          "name": "node.name",
37
          "value": "wazuh-indexer"
38
        },
39
        {
40
          "name": "network.host",
41
          "value": "0.0.0.0"
42
        },
43
        {
44
          "name": "DISABLE_SECURITY_PLUGIN",
45
          "value": "false"
46
        }
47
      ],
48
      "environmentFiles": [],
49
      "mountPoints": [
50
        {
51
          "sourceVolume": "wazuh-indexer-data",
52
          "containerPath": "/var/lib/wazuh-indexer",
53
          "readOnly": false
54
        },
55
        {
56
          "sourceVolume": "wazuh-indexer-certs",
57
          "containerPath": "/usr/share/wazuh-indexer/config/certs",
58
          "readOnly": true
59
        }
60
      ],
61
      "volumesFrom": [],
62
      "ulimits": [
63
        {
64
          "name": "memlock",
65
          "softLimit": -1,
66
          "hardLimit": -1
67
        },
68
        {
69
          "name": "nofile",
70
          "softLimit": 65536,
71
          "hardLimit": 65536
72
        }
73
      ],
74
      "logConfiguration": {
75
        "logDriver": "awslogs",
76
        "options": {
77
          "awslogs-group": "/ecs/wazuh-prod-indexer",
78
          "mode": "non-blocking",
79
          "awslogs-create-group": "true",
80
          "max-buffer-size": "25m",
81
          "awslogs-region": "us-west-2",
82
          "awslogs-stream-prefix": "ecs"
83
        },
84
        "secretOptions": []
85
      },
86
      "healthCheck": {
87
        "command": [
88
          "CMD-SHELL",
89
          "curl -k -u admin:SecretPassword https://localhost:9200/_cluster/health || exit 1"
90
        ],
91
        "interval": 30,
92
        "timeout": 10,
93
        "retries": 5,
94
        "startPeriod": 120
95
      },
96
      "systemControls": []
97
    }
98
  ],
99
  "taskRoleArn": "arn:aws:iam::ACCOUNT_ID:role/ecsTaskExecutionRole",
100
  "executionRoleArn": "arn:aws:iam::ACCOUNT_ID:role/ecsTaskExecutionRole",
101
  "networkMode": "awsvpc",
102
  "volumes": [
103
    {
104
      "name": "wazuh-indexer-data",
105
      "efsVolumeConfiguration": {
106
        "fileSystemId": "fs-XXXXXXXXX",
107
        "rootDirectory": "/wazuh-indexer-data",
108
        "transitEncryption": "ENABLED",
109
        "authorizationConfig": {
110
          "accessPointId": "",
111
          "iam": "DISABLED"
112
        }
113
      }
114
    },
115
    {
116
      "name": "wazuh-indexer-certs",
117
      "efsVolumeConfiguration": {
118
        "fileSystemId": "fs-XXXXXXXXX",
119
        "rootDirectory": "/wazuh_etc/ssl",
120
        "transitEncryption": "ENABLED"
121
      }
122
    }
123
  ],
124
  "placementConstraints": [],
125
  "requiresCompatibilities": ["FARGATE"],
126
  "cpu": "4096",
127
  "memory": "8192",
128
  "runtimePlatform": {
129
    "cpuArchitecture": "X86_64",
130
    "operatingSystemFamily": "LINUX"
131
  },
132
  "enableFaultInjection": false
133
}

1
# Replace ACCOUNT_ID and fs-XXXXXXXXX with your values
2
sed -i 's/ACCOUNT_ID/YOUR_ACCOUNT_ID/g' wazuh-indexer-task-definition.json
3
sed -i 's/fs-XXXXXXXXX/YOUR_EFS_ID/g' wazuh-indexer-task-definition.json
4

5
aws ecs register-task-definition \
6
  --cli-input-json file://wazuh-indexer-task-definition.json \
7
  --region us-west-2

Wazuh Manager Task Definition#

Create a file named wazuh-manager-task-definition.json:

1
{
2
  "family": "wazuh-prod-manager",
3
  "containerDefinitions": [
4
    {
5
      "name": "wazuh-manager",
6
      "image": "wazuh/wazuh-manager:4.8.0",
7
      "cpu": 0,
8
      "portMappings": [
9
        {
10
          "name": "1514-tcp",
11
          "containerPort": 1514,
12
          "hostPort": 1514,
13
          "protocol": "tcp",
14
          "appProtocol": "http"
15
        },
16
        {
17
          "name": "1515-tcp",
18
          "containerPort": 1515,
19
          "hostPort": 1515,
20
          "protocol": "tcp",
21
          "appProtocol": "http"
22
        },
23
        {
24
          "name": "514-udp",
25
          "containerPort": 514,
26
          "hostPort": 514,
27
          "protocol": "udp"
28
        },
29
        {
30
          "name": "55000-tcp",
31
          "containerPort": 55000,
32
          "hostPort": 55000,
33
          "protocol": "tcp",
34
          "appProtocol": "http"
35
        }
36
      ],
37
      "essential": true,
38
      "environment": [
39
        {
40
          "name": "INDEXER_URL",
41
          "value": "https://wazuh-indexer.wazuh:9200"
42
        },
43
        {
44
          "name": "INDEXER_USERNAME",
45
          "value": "admin"
46
        },
47
        {
48
          "name": "INDEXER_PASSWORD",
49
          "value": "SecretPassword"
50
        },
51
        {
52
          "name": "FILEBEAT_SSL_VERIFICATION_MODE",
53
          "value": "full"
54
        },
55
        {
56
          "name": "SSL_CERTIFICATE_AUTHORITIES",
57
          "value": "/etc/ssl/root-ca.pem"
58
        },
59
        {
60
          "name": "SSL_CERTIFICATE",
61
          "value": "/etc/ssl/filebeat.pem"
62
        },
63
        {
64
          "name": "SSL_KEY",
65
          "value": "/etc/ssl/filebeat.key"
66
        },
67
        {
68
          "name": "API_USERNAME",
69
          "value": "wazuh-wui"
70
        },
71
        {
72
          "name": "API_PASSWORD",
73
          "value": "MyS3cr37P450r.*-"
74
        }
75
      ],
76
      "environmentFiles": [],
77
      "mountPoints": [
78
        {
79
          "sourceVolume": "wazuh_api_configuration",
80
          "containerPath": "/var/ossec/api/configuration",
81
          "readOnly": false
82
        },
83
        {
84
          "sourceVolume": "wazuh_etc",
85
          "containerPath": "/var/ossec/etc",
86
          "readOnly": false
87
        },
88
        {
89
          "sourceVolume": "wazuh_logs",
90
          "containerPath": "/var/ossec/logs",
91
          "readOnly": false
92
        },
93
        {
94
          "sourceVolume": "wazuh_queue",
95
          "containerPath": "/var/ossec/queue",
96
          "readOnly": false
97
        },
98
        {
99
          "sourceVolume": "wazuh_var_multigroups",
100
          "containerPath": "/var/ossec/var/multigroups",
101
          "readOnly": false
102
        },
103
        {
104
          "sourceVolume": "wazuh_integrations",
105
          "containerPath": "/var/ossec/integrations",
106
          "readOnly": false
107
        },
108
        {
109
          "sourceVolume": "wazuh_active_response",
110
          "containerPath": "/var/ossec/active-response/bin",
111
          "readOnly": false
112
        },
113
        {
114
          "sourceVolume": "wazuh_agentless",
115
          "containerPath": "/var/ossec/agentless",
116
          "readOnly": false
117
        },
118
        {
119
          "sourceVolume": "wazuh_wodles",
120
          "containerPath": "/var/ossec/wodles",
121
          "readOnly": false
122
        },
123
        {
124
          "sourceVolume": "filebeat_etc",
125
          "containerPath": "/etc/filebeat",
126
          "readOnly": false
127
        },
128
        {
129
          "sourceVolume": "filebeat_var",
130
          "containerPath": "/var/lib/filebeat",
131
          "readOnly": false
132
        }
133
      ],
134
      "volumesFrom": [],
135
      "logConfiguration": {
136
        "logDriver": "awslogs",
137
        "options": {
138
          "awslogs-group": "/ecs/wazuh-prod-manager",
139
          "mode": "non-blocking",
140
          "awslogs-create-group": "true",
141
          "max-buffer-size": "25m",
142
          "awslogs-region": "us-west-2",
143
          "awslogs-stream-prefix": "ecs"
144
        }
145
      },
146
      "healthCheck": {
147
        "command": ["CMD", "/var/ossec/bin/wazuh-control", "status"],
148
        "interval": 30,
149
        "timeout": 10,
150
        "retries": 5,
151
        "startPeriod": 300
152
      },
153
      "systemControls": []
154
    }
155
  ],
156
  "taskRoleArn": "arn:aws:iam::ACCOUNT_ID:role/ecsTaskExecutionRole",
157
  "executionRoleArn": "arn:aws:iam::ACCOUNT_ID:role/ecsTaskExecutionRole",
158
  "networkMode": "awsvpc",
159
  "volumes": [
160
    {
161
      "name": "wazuh_api_configuration",
162
      "efsVolumeConfiguration": {
163
        "fileSystemId": "fs-XXXXXXXXX",
164
        "rootDirectory": "/wazuh_api_configuration",
165
        "transitEncryption": "ENABLED"
166
      }
167
    },
168
    {
169
      "name": "wazuh_etc",
170
      "efsVolumeConfiguration": {
171
        "fileSystemId": "fs-XXXXXXXXX",
172
        "rootDirectory": "/wazuh_etc",
173
        "transitEncryption": "ENABLED"
174
      }
175
    },
176
    {
177
      "name": "wazuh_logs",
178
      "efsVolumeConfiguration": {
179
        "fileSystemId": "fs-XXXXXXXXX",
180
        "rootDirectory": "/wazuh_logs",
181
        "transitEncryption": "ENABLED"
182
      }
183
    },
184
    {
185
      "name": "wazuh_queue",
186
      "efsVolumeConfiguration": {
187
        "fileSystemId": "fs-XXXXXXXXX",
188
        "rootDirectory": "/wazuh_queue",
189
        "transitEncryption": "ENABLED"
190
      }
191
    },
192
    {
193
      "name": "wazuh_var_multigroups",
194
      "efsVolumeConfiguration": {
195
        "fileSystemId": "fs-XXXXXXXXX",
196
        "rootDirectory": "/wazuh_var_multigroups",
197
        "transitEncryption": "ENABLED"
198
      }
199
    },
200
    {
201
      "name": "wazuh_integrations",
202
      "efsVolumeConfiguration": {
203
        "fileSystemId": "fs-XXXXXXXXX",
204
        "rootDirectory": "/wazuh_integrations",
205
        "transitEncryption": "ENABLED"
206
      }
207
    },
208
    {
209
      "name": "wazuh_active_response",
210
      "efsVolumeConfiguration": {
211
        "fileSystemId": "fs-XXXXXXXXX",
212
        "rootDirectory": "/wazuh_active_response",
213
        "transitEncryption": "ENABLED"
214
      }
215
    },
216
    {
217
      "name": "wazuh_agentless",
218
      "efsVolumeConfiguration": {
219
        "fileSystemId": "fs-XXXXXXXXX",
220
        "rootDirectory": "/wazuh_agentless",
221
        "transitEncryption": "ENABLED"
222
      }
223
    },
224
    {
225
      "name": "wazuh_wodles",
226
      "efsVolumeConfiguration": {
227
        "fileSystemId": "fs-XXXXXXXXX",
228
        "rootDirectory": "/wazuh_wodles",
229
        "transitEncryption": "ENABLED"
230
      }
231
    },
232
    {
233
      "name": "filebeat_etc",
234
      "efsVolumeConfiguration": {
235
        "fileSystemId": "fs-XXXXXXXXX",
236
        "rootDirectory": "/filebeat_etc",
237
        "transitEncryption": "ENABLED"
238
      }
239
    },
240
    {
241
      "name": "filebeat_var",
242
      "efsVolumeConfiguration": {
243
        "fileSystemId": "fs-XXXXXXXXX",
244
        "rootDirectory": "/filebeat_var",
245
        "transitEncryption": "ENABLED"
246
      }
247
    }
248
  ],
249
  "placementConstraints": [],
250
  "requiresCompatibilities": ["FARGATE"],
251
  "cpu": "2048",
252
  "memory": "4096",
253
  "runtimePlatform": {
254
    "cpuArchitecture": "X86_64",
255
    "operatingSystemFamily": "LINUX"
256
  },
257
  "enableFaultInjection": false
258
}

1
# Replace values and register
2
sed -i 's/ACCOUNT_ID/YOUR_ACCOUNT_ID/g' wazuh-manager-task-definition.json
3
sed -i 's/fs-XXXXXXXXX/YOUR_EFS_ID/g' wazuh-manager-task-definition.json
4

5
aws ecs register-task-definition \
6
  --cli-input-json file://wazuh-manager-task-definition.json \
7
  --region us-west-2

Wazuh Dashboard Task Definition#

Create a file named wazuh-dashboard-task-definition.json:

1
{
2
  "family": "wazuh-prod-dashboard",
3
  "containerDefinitions": [
4
    {
5
      "name": "wazuh-dashboard",
6
      "image": "wazuh/wazuh-dashboard:4.8.0",
7
      "cpu": 0,
8
      "portMappings": [
9
        {
10
          "name": "5601-tcp",
11
          "containerPort": 5601,
12
          "hostPort": 5601,
13
          "protocol": "tcp",
14
          "appProtocol": "http"
15
        }
16
      ],
17
      "essential": true,
18
      "environment": [
19
        {
20
          "name": "INDEXER_USERNAME",
21
          "value": "admin"
22
        },
23
        {
24
          "name": "INDEXER_PASSWORD",
25
          "value": "SecretPassword"
26
        },
27
        {
28
          "name": "WAZUH_API_URL",
29
          "value": "https://wazuh-manager.wazuh"
30
        },
31
        {
32
          "name": "API_USERNAME",
33
          "value": "wazuh-wui"
34
        },
35
        {
36
          "name": "API_PASSWORD",
37
          "value": "MyS3cr37P450r.*-"
38
        },
39
        {
40
          "name": "DASHBOARD_USERNAME",
41
          "value": "kibanaserver"
42
        },
43
        {
44
          "name": "DASHBOARD_PASSWORD",
45
          "value": "kibanaserver"
46
        },
47
        {
48
          "name": "SERVER_HOST",
49
          "value": "0.0.0.0"
50
        },
51
        {
52
          "name": "OPENSEARCH_HOSTS",
53
          "value": "https://wazuh-indexer.wazuh:9200"
54
        }
55
      ],
56
      "environmentFiles": [],
57
      "mountPoints": [
58
        {
59
          "sourceVolume": "wazuh-dashboard-config",
60
          "containerPath": "/usr/share/wazuh-dashboard/data/wazuh/config",
61
          "readOnly": false
62
        },
63
        {
64
          "sourceVolume": "wazuh-dashboard-custom",
65
          "containerPath": "/usr/share/wazuh-dashboard/plugins/wazuh/public/assets/custom",
66
          "readOnly": false
67
        }
68
      ],
69
      "volumesFrom": [],
70
      "ulimits": [],
71
      "logConfiguration": {
72
        "logDriver": "awslogs",
73
        "options": {
74
          "awslogs-group": "/ecs/wazuh-prod-dashboard",
75
          "mode": "non-blocking",
76
          "awslogs-create-group": "true",
77
          "max-buffer-size": "25m",
78
          "awslogs-region": "us-west-2",
79
          "awslogs-stream-prefix": "ecs"
80
        },
81
        "secretOptions": []
82
      },
83
      "healthCheck": {
84
        "command": [
85
          "CMD-SHELL",
86
          "curl -s http://localhost:5601/api/status | grep -q '\"state\":\"green\"' || exit 1"
87
        ],
88
        "interval": 30,
89
        "timeout": 10,
90
        "retries": 5,
91
        "startPeriod": 300
92
      },
93
      "systemControls": []
94
    }
95
  ],
96
  "taskRoleArn": "arn:aws:iam::ACCOUNT_ID:role/ecsTaskExecutionRole",
97
  "executionRoleArn": "arn:aws:iam::ACCOUNT_ID:role/ecsTaskExecutionRole",
98
  "networkMode": "awsvpc",
99
  "volumes": [
100
    {
101
      "name": "wazuh-dashboard-config",
102
      "efsVolumeConfiguration": {
103
        "fileSystemId": "fs-XXXXXXXXX",
104
        "rootDirectory": "/wazuh-dashboard-config",
105
        "transitEncryption": "ENABLED"
106
      }
107
    },
108
    {
109
      "name": "wazuh-dashboard-custom",
110
      "efsVolumeConfiguration": {
111
        "fileSystemId": "fs-XXXXXXXXX",
112
        "rootDirectory": "/wazuh-dashboard-custom",
113
        "transitEncryption": "ENABLED"
114
      }
115
    }
116
  ],
117
  "placementConstraints": [],
118
  "requiresCompatibilities": ["FARGATE"],
119
  "cpu": "2048",
120
  "memory": "4096",
121
  "runtimePlatform": {
122
    "cpuArchitecture": "X86_64",
123
    "operatingSystemFamily": "LINUX"
124
  },
125
  "enableFaultInjection": false
126
}

1
# Replace values and register
2
sed -i 's/ACCOUNT_ID/YOUR_ACCOUNT_ID/g' wazuh-dashboard-task-definition.json
3
sed -i 's/fs-XXXXXXXXX/YOUR_EFS_ID/g' wazuh-dashboard-task-definition.json
4

5
aws ecs register-task-definition \
6
  --cli-input-json file://wazuh-dashboard-task-definition.json \
7
  --region us-west-2

Step 7: Create Load Balancers#

Create Application Load Balancer (ALB)#

1
# Create ALB for HTTP/HTTPS traffic
2
aws elbv2 create-load-balancer \
3
  --name wazuh-alb \
4
  --subnets subnet-xxxxx subnet-yyyyy \
5
  --security-groups $ECS_SG_ID \
6
  --region us-west-2
7

8
# Get ALB ARN
9
ALB_ARN=$(aws elbv2 describe-load-balancers \
10
  --names wazuh-alb \
11
  --query 'LoadBalancers[0].LoadBalancerArn' \
12
  --output text \
13
  --region us-west-2)
14

15
# Create target group for Wazuh Dashboard
16
aws elbv2 create-target-group \
17
  --name wazuh-dashboard-tg \
18
  --protocol HTTP \
19
  --port 5601 \
20
  --vpc-id vpc-xxxxxxxxx \
21
  --target-type ip \
22
  --health-check-path /api/status \
23
  --health-check-interval-seconds 30 \
24
  --health-check-timeout-seconds 10 \
25
  --healthy-threshold-count 3 \
26
  --unhealthy-threshold-count 2 \
27
  --region us-west-2
28

29
# Create listener for ALB
30
aws elbv2 create-listener \
31
  --load-balancer-arn $ALB_ARN \
32
  --protocol HTTP \
33
  --port 80 \
34
  --default-actions Type=forward,TargetGroupArn=$(aws elbv2 describe-target-groups --names wazuh-dashboard-tg --query 'TargetGroups[0].TargetGroupArn' --output text --region us-west-2) \
35
  --region us-west-2

Create Network Load Balancer (NLB)#

1
# Create NLB for TCP/UDP traffic
2
aws elbv2 create-load-balancer \
3
  --name wazuh-nlb \
4
  --subnets subnet-xxxxx subnet-yyyyy \
5
  --type network \
6
  --scheme internet-facing \
7
  --region us-west-2
8

9
# Get NLB ARN
10
NLB_ARN=$(aws elbv2 describe-load-balancers \
11
  --names wazuh-nlb \
12
  --query 'LoadBalancers[0].LoadBalancerArn' \
13
  --output text \
14
  --region us-west-2)
15

16
# Create target groups for Wazuh Manager
17
# Target group for agent registration (1514)
18
aws elbv2 create-target-group \
19
  --name wazuh-manager-1514-tg \
20
  --protocol TCP \
21
  --port 1514 \
22
  --vpc-id vpc-xxxxxxxxx \
23
  --target-type ip \
24
  --health-check-protocol TCP \
25
  --health-check-port 1514 \
26
  --region us-west-2
27

28
# Target group for agent communication (1515)
29
aws elbv2 create-target-group \
30
  --name wazuh-manager-1515-tg \
31
  --protocol TCP \
32
  --port 1515 \
33
  --vpc-id vpc-xxxxxxxxx \
34
  --target-type ip \
35
  --health-check-protocol TCP \
36
  --health-check-port 1515 \
37
  --region us-west-2
38

39
# Target group for syslog (514)
40
aws elbv2 create-target-group \
41
  --name wazuh-manager-514-tg \
42
  --protocol UDP \
43
  --port 514 \
44
  --vpc-id vpc-xxxxxxxxx \
45
  --target-type ip \
46
  --region us-west-2
47

48
# Create listeners for NLB
49
# Listener for 1514
50
aws elbv2 create-listener \
51
  --load-balancer-arn $NLB_ARN \
52
  --protocol TCP \
53
  --port 1514 \
54
  --default-actions Type=forward,TargetGroupArn=$(aws elbv2 describe-target-groups --names wazuh-manager-1514-tg --query 'TargetGroups[0].TargetGroupArn' --output text --region us-west-2) \
55
  --region us-west-2
56

57
# Listener for 1515
58
aws elbv2 create-listener \
59
  --load-balancer-arn $NLB_ARN \
60
  --protocol TCP \
61
  --port 1515 \
62
  --default-actions Type=forward,TargetGroupArn=$(aws elbv2 describe-target-groups --names wazuh-manager-1515-tg --query 'TargetGroups[0].TargetGroupArn' --output text --region us-west-2) \
63
  --region us-west-2
64

65
# Listener for 514 UDP
66
aws elbv2 create-listener \
67
  --load-balancer-arn $NLB_ARN \
68
  --protocol UDP \
69
  --port 514 \
70
  --default-actions Type=forward,TargetGroupArn=$(aws elbv2 describe-target-groups --names wazuh-manager-514-tg --query 'TargetGroups[0].TargetGroupArn' --output text --region us-west-2) \
71
  --region us-west-2

Step 8: Create Service Discovery Namespace#

1
# Create private DNS namespace
2
aws servicediscovery create-private-dns-namespace \
3
  --name wazuh \
4
  --vpc vpc-xxxxxxxxx \
5
  --region us-west-2
6

7
# Get namespace ID
8
NAMESPACE_ID=$(aws servicediscovery list-namespaces \
9
  --filters Name=NAME,Values=wazuh \
10
  --query 'Namespaces[0].Id' \
11
  --output text \
12
  --region us-west-2)

Step 9: Create ECS Services#

Deploy Wazuh Indexer Service#

1
# Create service discovery service for indexer
2
aws servicediscovery create-service \
3
  --name wazuh-indexer \
4
  --namespace-id $NAMESPACE_ID \
5
  --dns-config "NamespaceId=$NAMESPACE_ID,DnsRecords=[{Type=A,TTL=10}]" \
6
  --region us-west-2
7

8
# Get service discovery ARN
9
SD_INDEXER_ARN=$(aws servicediscovery list-services \
10
  --filters Name=NAMESPACE_ID,Values=$NAMESPACE_ID \
11
  --query "Services[?Name=='wazuh-indexer'].Arn | [0]" \
12
  --output text \
13
  --region us-west-2)
14

15
# Create ECS service for Wazuh Indexer
16
aws ecs create-service \
17
  --cluster wazuh-prod-cluster \
18
  --service-name wazuh-indexer \
19
  --task-definition wazuh-prod-indexer:1 \
20
  --desired-count 1 \
21
  --launch-type FARGATE \
22
  --network-configuration "awsvpcConfiguration={subnets=[subnet-xxxxx,subnet-yyyyy],securityGroups=[$ECS_SG_ID],assignPublicIp=ENABLED}" \
23
  --service-registries "registryArn=$SD_INDEXER_ARN" \
24
  --region us-west-2

Wait for the indexer to be healthy before proceeding:

1
# Check service status
2
aws ecs describe-services \
3
  --cluster wazuh-prod-cluster \
4
  --services wazuh-indexer \
5
  --query 'services[0].runningCount' \
6
  --region us-west-2

Deploy Wazuh Manager Service#

1
# Create service discovery service for manager
2
aws servicediscovery create-service \
3
  --name wazuh-manager \
4
  --namespace-id $NAMESPACE_ID \
5
  --dns-config "NamespaceId=$NAMESPACE_ID,DnsRecords=[{Type=A,TTL=10}]" \
6
  --region us-west-2
7

8
# Get service discovery ARN
9
SD_MANAGER_ARN=$(aws servicediscovery list-services \
10
  --filters Name=NAMESPACE_ID,Values=$NAMESPACE_ID \
11
  --query "Services[?Name=='wazuh-manager'].Arn | [0]" \
12
  --output text \
13
  --region us-west-2)
14

15
# Get target group ARNs
16
TG_1514_ARN=$(aws elbv2 describe-target-groups \
17
  --names wazuh-manager-1514-tg \
18
  --query 'TargetGroups[0].TargetGroupArn' \
19
  --output text \
20
  --region us-west-2)
21

22
TG_1515_ARN=$(aws elbv2 describe-target-groups \
23
  --names wazuh-manager-1515-tg \
24
  --query 'TargetGroups[0].TargetGroupArn' \
25
  --output text \
26
  --region us-west-2)
27

28
TG_514_ARN=$(aws elbv2 describe-target-groups \
29
  --names wazuh-manager-514-tg \
30
  --query 'TargetGroups[0].TargetGroupArn' \
31
  --output text \
32
  --region us-west-2)

Create the ECS service with multiple load balancers:

1
# Create the service with all load balancers
2
aws ecs create-service \
3
  --cluster wazuh-prod-cluster \
4
  --service-name wazuh-manager \
5
  --task-definition wazuh-prod-manager:1 \
6
  --desired-count 1 \
7
  --launch-type FARGATE \
8
  --network-configuration "awsvpcConfiguration={subnets=[subnet-xxxxx,subnet-yyyyy],securityGroups=[$ECS_SG_ID],assignPublicIp=ENABLED}" \
9
  --load-balancers "[
10
    {
11
      \"targetGroupArn\": \"$TG_1514_ARN\",
12
      \"containerName\": \"wazuh-manager\",
13
      \"containerPort\": 1514
14
    },
15
    {
16
      \"targetGroupArn\": \"$TG_1515_ARN\",
17
      \"containerName\": \"wazuh-manager\",
18
      \"containerPort\": 1515
19
    },
20
    {
21
      \"targetGroupArn\": \"$TG_514_ARN\",
22
      \"containerName\": \"wazuh-manager\",
23
      \"containerPort\": 514
24
    }
25
  ]" \
26
  --service-registries "registryArn=$SD_MANAGER_ARN" \
27
  --region us-west-2

Deploy Wazuh Dashboard Service#

1
# Create service discovery service for dashboard
2
aws servicediscovery create-service \
3
  --name wazuh-dashboard \
4
  --namespace-id $NAMESPACE_ID \
5
  --dns-config "NamespaceId=$NAMESPACE_ID,DnsRecords=[{Type=A,TTL=10}]" \
6
  --region us-west-2
7

8
# Get service discovery ARN
9
SD_DASHBOARD_ARN=$(aws servicediscovery list-services \
10
  --filters Name=NAMESPACE_ID,Values=$NAMESPACE_ID \
11
  --query "Services[?Name=='wazuh-dashboard'].Arn | [0]" \
12
  --output text \
13
  --region us-west-2)
14

15
# Get dashboard target group ARN
16
TG_DASHBOARD_ARN=$(aws elbv2 describe-target-groups \
17
  --names wazuh-dashboard-tg \
18
  --query 'TargetGroups[0].TargetGroupArn' \
19
  --output text \
20
  --region us-west-2)
21

22
# Create ECS service for Wazuh Dashboard
23
aws ecs create-service \
24
  --cluster wazuh-prod-cluster \
25
  --service-name wazuh-dashboard \
26
  --task-definition wazuh-prod-dashboard:1 \
27
  --desired-count 1 \
28
  --launch-type FARGATE \
29
  --network-configuration "awsvpcConfiguration={subnets=[subnet-xxxxx,subnet-yyyyy],securityGroups=[$ECS_SG_ID],assignPublicIp=ENABLED}" \
30
  --load-balancers "[{
31
    \"targetGroupArn\": \"$TG_DASHBOARD_ARN\",
32
    \"containerName\": \"wazuh-dashboard\",
33
    \"containerPort\": 5601
34
  }]" \
35
  --service-registries "registryArn=$SD_DASHBOARD_ARN" \
36
  --region us-west-2

Step 10: Verify Deployment#

Deployment Health Check Flow#

1
flowchart TD
2
    A[Start Health Check] --> B{ECS Services Running?}
3
    B -->|No| C[Check CloudWatch Logs]
4
    C --> D[Fix Issues]
5
    D --> B
6
    B -->|Yes| E{Load Balancers Healthy?}
7
    E -->|No| F[Check Target Groups]
8
    F --> G[Verify Security Groups]
9
    G --> E
10
    E -->|Yes| H{Service Discovery Working?}
11
    H -->|No| I[Check DNS Resolution]
12
    I --> J[Verify Namespace]
13
    J --> H
14
    H -->|Yes| K{Can Access Dashboard?}
15
    K -->|No| L[Check ALB Configuration]
16
    L --> M[Verify Port Mappings]
17
    M --> K
18
    K -->|Yes| N[Deployment Successful]
19

20
    style A fill:#ff6b6b,stroke:#333,stroke-width:2px
21
    style N fill:#51cf66,stroke:#333,stroke-width:2px
22
    style C,F,I,L fill:#ffd43b,stroke:#333,stroke-width:2px

Check Service Status#

1
# Check all services
2
for service in wazuh-indexer wazuh-manager wazuh-dashboard; do
3
  echo "Checking $service..."
4
  aws ecs describe-services \
5
    --cluster wazuh-prod-cluster \
6
    --services $service \
7
    --query 'services[0].{Status:status,Running:runningCount,Desired:desiredCount}' \
8
    --region us-west-2
9
done
10

11
# Check CloudWatch logs
12
for log_group in /ecs/wazuh-prod-indexer /ecs/wazuh-prod-manager /ecs/wazuh-prod-dashboard; do
13
  echo "Recent logs from $log_group:"
14
  aws logs tail $log_group --since 5m --region us-west-2 | head -20
15
done

Access Wazuh Dashboard#

1
# Get ALB DNS name
2
ALB_DNS=$(aws elbv2 describe-load-balancers \
3
  --names wazuh-alb \
4
  --query 'LoadBalancers[0].DNSName' \
5
  --output text \
6
  --region us-west-2)
7

8
echo "Access Wazuh Dashboard at: http://$ALB_DNS"
9
echo "Default credentials: admin / admin"

Step 11: Configure Wazuh Agents#

Install Wazuh Agent on Linux#

1
# Get NLB DNS for agent registration
2
NLB_DNS=$(aws elbv2 describe-load-balancers \
3
  --names wazuh-nlb \
4
  --query 'LoadBalancers[0].DNSName' \
5
  --output text \
6
  --region us-west-2)
7

8
# Download and install agent
9
curl -s https://packages.wazuh.com/4.x/apt/key/GPG-KEY-WAZUH | apt-key add -
10
echo "deb https://packages.wazuh.com/4.x/apt/ stable main" | tee /etc/apt/sources.list.d/wazuh.list
11
apt-get update
12
apt-get install wazuh-agent
13

14
# Configure agent
15
sed -i "s/MANAGER_IP/$NLB_DNS/g" /var/ossec/etc/ossec.conf
16

17
# Start agent
18
systemctl daemon-reload
19
systemctl enable wazuh-agent
20
systemctl start wazuh-agent

Install Wazuh Agent on Windows#

1
# Download agent
2
Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.8.0-1.msi -OutFile wazuh-agent.msi
3

4
# Install with manager address
5
msiexec.exe /i wazuh-agent.msi /q WAZUH_MANAGER="NLB_DNS_HERE" WAZUH_REGISTRATION_PORT="1514"
6

7
# Start service
8
Start-Service -Name WazuhSvc

Step 12: Post-Deployment Configuration#

Configure SSL/TLS#

Generate proper SSL certificates for production use
Update load balancer listeners to use HTTPS
Configure certificate validation in agents

Set Up Monitoring#

1
# Create CloudWatch dashboard
2
aws cloudwatch put-dashboard \
3
  --dashboard-name WazuhMonitoring \
4
  --dashboard-body file://wazuh-dashboard.json \
5
  --region us-west-2
6

7
# Create SNS topic for alerts
8
aws sns create-topic --name wazuh-alerts --region us-west-2
9

10
# Create CloudWatch alarms
11
for service in wazuh-indexer wazuh-manager wazuh-dashboard; do
12
  aws cloudwatch put-metric-alarm \
13
    --alarm-name "$service-health" \
14
    --alarm-description "Alert when $service is unhealthy" \
15
    --metric-name ServiceHealthy \
16
    --namespace AWS/ECS \
17
    --statistic Average \
18
    --period 300 \
19
    --threshold 1 \
20
    --comparison-operator LessThanThreshold \
21
    --evaluation-periods 2 \
22
    --dimensions Name=ServiceName,Value=$service Name=ClusterName,Value=wazuh-prod-cluster \
23
    --region us-west-2
24
done

Enable Auto Scaling#

1
# Register scalable targets
2
for service in wazuh-indexer wazuh-manager wazuh-dashboard; do
3
  aws application-autoscaling register-scalable-target \
4
    --service-namespace ecs \
5
    --resource-id service/wazuh-prod-cluster/$service \
6
    --scalable-dimension ecs:service:DesiredCount \
7
    --min-capacity 1 \
8
    --max-capacity 3 \
9
    --region us-west-2
10
done
11

12
# Create scaling policies
13
for service in wazuh-indexer wazuh-manager wazuh-dashboard; do
14
  aws application-autoscaling put-scaling-policy \
15
    --policy-name $service-scale-out \
16
    --service-namespace ecs \
17
    --resource-id service/wazuh-prod-cluster/$service \
18
    --scalable-dimension ecs:service:DesiredCount \
19
    --policy-type TargetTrackingScaling \
20
    --target-tracking-scaling-policy-configuration '{
21
      "TargetValue": 70.0,
22
      "PredefinedMetricSpecification": {
23
        "PredefinedMetricType": "ECSServiceAverageCPUUtilization"
24
      },
25
      "ScaleOutCooldown": 300,
26
      "ScaleInCooldown": 300
27
    }' \
28
    --region us-west-2
29
done

Troubleshooting Guide#

Troubleshooting Decision Tree#

1
flowchart TD
2
    A[Issue Detected] --> B{What type of issue?}
3

4
    B -->|Container Won't Start| C[Container Issues]
5
    C --> C1{Health Check Failing?}
6
    C1 -->|Yes| C2[Check Logs<br/>aws logs tail /ecs/service-name]
7
    C1 -->|No| C3[Check Task Definition]
8
    C2 --> C4{Memory/CPU Error?}
9
    C4 -->|Yes| C5[Increase Resources]
10
    C4 -->|No| C6[Check Permissions]
11

12
    B -->|Can't Connect| D[Network Issues]
13
    D --> D1{Security Group OK?}
14
    D1 -->|No| D2[Update SG Rules]
15
    D1 -->|Yes| D3{Service Discovery?}
16
    D3 -->|No| D4[Check DNS Resolution]
17
    D3 -->|Yes| D5[Check Load Balancer]
18

19
    B -->|Performance| E[Performance Issues]
20
    E --> E1{High CPU/Memory?}
21
    E1 -->|Yes| E2[Scale Out Services]
22
    E1 -->|No| E3{EFS Throttling?}
23
    E3 -->|Yes| E4[Enable Provisioned Throughput]
24
    E3 -->|No| E5[Check Indexer Settings]
25

26
    B -->|Data Issues| F[Data Pipeline Issues]
27
    F --> F1{Agents Connected?}
28
    F1 -->|No| F2[Check Agent Config]
29
    F1 -->|Yes| F3{Data in Indexer?}
30
    F3 -->|No| F4[Check Manager Logs]
31
    F3 -->|Yes| F5[Check Dashboard Query]
32

33
    style A fill:#ff6b6b,stroke:#333,stroke-width:2px
34
    style C5,D2,E2,E4 fill:#51cf66,stroke:#333,stroke-width:2px

Common Issues and Solutions#

1. Container Health Checks Failing#

1
# Check container logs
2
aws logs tail /ecs/wazuh-prod-indexer --follow --region us-west-2
3

4
# Common issues:
5
# - Certificate permissions: Ensure certificates have 400 permissions
6
# - Memory issues: Increase container memory allocation
7
# - Network connectivity: Verify security group rules

2. Service Discovery Issues#

1
# Test DNS resolution
2
nslookup wazuh-indexer.wazuh
3
nslookup wazuh-manager.wazuh
4

5
# Verify service registration
6
aws servicediscovery list-instances \
7
  --service-id $(aws servicediscovery list-services --filters Name=NAMESPACE_ID,Values=$NAMESPACE_ID --query "Services[?Name=='wazuh-indexer'].Id | [0]" --output text) \
8
  --region us-west-2

3. Agent Connection Issues#

1
# On the agent, test connectivity
2
telnet NLB_DNS_HERE 1514
3
telnet NLB_DNS_HERE 1515
4

5
# Check agent logs
6
tail -f /var/ossec/logs/ossec.log
7

8
# Common fixes:
9
# - Ensure NLB security group allows agent IPs
10
# - Verify agent authentication keys
11
# - Check firewall rules on agent systems

4. EFS Performance Issues#

1
# Monitor EFS metrics
2
aws cloudwatch get-metric-statistics \
3
  --namespace AWS/EFS \
4
  --metric-name BurstCreditBalance \
5
  --dimensions Name=FileSystemId,Value=$EFS_ID \
6
  --start-time $(date -u -d '1 hour ago' +%Y-%m-%dT%H:%M:%S) \
7
  --end-time $(date -u +%Y-%m-%dT%H:%M:%S) \
8
  --period 300 \
9
  --statistics Average \
10
  --region us-west-2
11

12
# If burst credits are low, consider:
13
# - Provisioned throughput mode
14
# - Multiple EFS file systems
15
# - EFS performance mode change

Performance Optimization#

1. Optimize Wazuh Indexer#

1
# Update indexer settings via API
2
curl -k -u admin:SecretPassword -X PUT "https://wazuh-indexer.wazuh:9200/_cluster/settings" -H 'Content-Type: application/json' -d'
3
{
4
  "persistent": {
5
    "cluster.routing.allocation.disk.watermark.low": "85%",
6
    "cluster.routing.allocation.disk.watermark.high": "90%",
7
    "cluster.routing.allocation.disk.watermark.flood_stage": "95%"
8
  }
9
}'
10

11
# Optimize shard allocation
12
curl -k -u admin:SecretPassword -X PUT "https://wazuh-indexer.wazuh:9200/_template/wazuh" -H 'Content-Type: application/json' -d'
13
{
14
  "index_patterns": ["wazuh-*"],
15
  "settings": {
16
    "number_of_shards": 1,
17
    "number_of_replicas": 0,
18
    "index.refresh_interval": "30s"
19
  }
20
}'

2. Optimize Wazuh Manager#

Edit /var/ossec/etc/ossec.conf on the manager:

1
<ossec_config>
2
  <!-- Increase worker threads for better performance -->
3
  <global>
4
    <logall>no</logall>
5
    <logall_json>no</logall_json>
6
    <email_notification>no</email_notification>
7
    <smtp_server>localhost</smtp_server>
8
    <email_from>wazuh@example.com</email_from>
9
    <email_to>admin@example.com</email_to>
10
    <email_maxperhour>12</email_maxperhour>
11
    <queue_size>131072</queue_size>
12
  </global>
13

14
  <!-- Optimize memory buffer -->
15
  <remote>
16
    <connection>secure</connection>
17
    <port>1514</port>
18
    <protocol>tcp</protocol>
19
    <queue_size>131072</queue_size>
20
  </remote>
21
</ossec_config>

Backup and Recovery#

Create EFS Backup#

1
# Create backup using AWS Backup
2
aws backup create-backup-plan \
3
  --backup-plan '{
4
    "BackupPlanName": "WazuhEFSBackup",
5
    "Rules": [{
6
      "RuleName": "DailyBackup",
7
      "TargetBackupVaultName": "Default",
8
      "ScheduleExpression": "cron(0 5 ? * * *)",
9
      "StartWindowMinutes": 60,
10
      "CompletionWindowMinutes": 120,
11
      "Lifecycle": {
12
        "DeleteAfterDays": 30
13
      }
14
    }]
15
  }' \
16
  --region us-west-2
17

18
# Assign EFS to backup plan
19
aws backup create-backup-selection \
20
  --backup-plan-id BACKUP_PLAN_ID \
21
  --backup-selection '{
22
    "SelectionName": "WazuhEFS",
23
    "IamRoleArn": "arn:aws:iam::ACCOUNT_ID:role/service-role/AWSBackupDefaultServiceRole",
24
    "Resources": ["arn:aws:elasticfilesystem:us-west-2:ACCOUNT_ID:file-system/fs-XXXXXXXXX"]
25
  }' \
26
  --region us-west-2

Disaster Recovery#

1
# Export configuration for DR
2
# On manager container
3
tar -czf /tmp/wazuh-config-backup.tar.gz \
4
  /var/ossec/etc \
5
  /var/ossec/rules \
6
  /var/ossec/decoders
7

8
# Copy to S3
9
aws s3 cp /tmp/wazuh-config-backup.tar.gz \
10
  s3://your-backup-bucket/wazuh-backups/$(date +%Y%m%d)/

Security Architecture#

1
flowchart TB
2
    subgraph "Security Layers"
3
        subgraph "Network Security"
4
            SG[Security Groups]
5
            NACL[Network ACLs]
6
            VPC[VPC Isolation]
7
        end
8

9
        subgraph "Data Security"
10
            TLS[TLS/SSL Encryption]
11
            EFS_E[EFS Encryption at Rest]
12
            SM[AWS Secrets Manager]
13
        end
14

15
        subgraph "Access Control"
16
            IAM[IAM Roles]
17
            RBAC[Wazuh RBAC]
18
            MFA[Multi-Factor Auth]
19
        end
20

21
        subgraph "Monitoring"
22
            CW[CloudWatch Logs]
23
            CT[CloudTrail]
24
            GD[GuardDuty]
25
        end
26
    end
27

28
    SG --> TLS
29
    TLS --> IAM
30
    IAM --> CW
31

32
    style SG fill:#ff9999,stroke:#333,stroke-width:2px
33
    style TLS fill:#99ccff,stroke:#333,stroke-width:2px
34
    style IAM fill:#99ff99,stroke:#333,stroke-width:2px
35
    style CW fill:#ffcc99,stroke:#333,stroke-width:2px

Security Hardening#

1. Enable AWS Secrets Manager#

1
# Create secrets
2
aws secretsmanager create-secret \
3
  --name wazuh/indexer/admin \
4
  --secret-string '{"username":"admin","password":"YourSecurePassword"}' \
5
  --region us-west-2
6

7
aws secretsmanager create-secret \
8
  --name wazuh/api/credentials \
9
  --secret-string '{"username":"wazuh-wui","password":"YourSecureAPIPassword"}' \
10
  --region us-west-2
11

12
# Update task definitions to use secrets
13
# Add to container definition:
14
"secrets": [
15
  {
16
    "name": "INDEXER_PASSWORD",
17
    "valueFrom": "arn:aws:secretsmanager:us-west-2:ACCOUNT_ID:secret:wazuh/indexer/admin:password::"
18
  }
19
]

2. Enable VPC Endpoints#

1
# Create VPC endpoints for AWS services
2
for service in s3 ecr.dkr ecr.api logs ecs ecs-agent ecs-telemetry; do
3
  aws ec2 create-vpc-endpoint \
4
    --vpc-id vpc-xxxxxxxxx \
5
    --service-name com.amazonaws.us-west-2.$service \
6
    --route-table-ids rtb-xxxxxxxxx \
7
    --region us-west-2
8
done

3. Implement Network Segmentation#

1
# Create separate security groups for each tier
2
# Frontend SG (Dashboard)
3
aws ec2 create-security-group \
4
  --group-name wazuh-frontend-sg \
5
  --description "Wazuh Dashboard security group" \
6
  --vpc-id vpc-xxxxxxxxx \
7
  --region us-west-2
8

9
# Backend SG (Manager/Indexer)
10
aws ec2 create-security-group \
11
  --group-name wazuh-backend-sg \
12
  --description "Wazuh backend security group" \
13
  --vpc-id vpc-xxxxxxxxx \
14
  --region us-west-2
15

16
# Configure rules to allow only required traffic

Monitoring and Alerting#

CloudWatch Dashboard JSON#

Create a file wazuh-dashboard.json:

1
{
2
  "widgets": [
3
    {
4
      "type": "metric",
5
      "properties": {
6
        "metrics": [
7
          [
8
            "AWS/ECS",
9
            "CPUUtilization",
10
            "ServiceName",
11
            "wazuh-indexer",
12
            "ClusterName",
13
            "wazuh-prod-cluster"
14
          ],
15
          ["...", "wazuh-manager", ".", "."],
16
          ["...", "wazuh-dashboard", ".", "."]
17
        ],
18
        "period": 300,
19
        "stat": "Average",
20
        "region": "us-west-2",
21
        "title": "ECS CPU Utilization"
22
      }
23
    },
24
    {
25
      "type": "metric",
26
      "properties": {
27
        "metrics": [
28
          [
29
            "AWS/ECS",
30
            "MemoryUtilization",
31
            "ServiceName",
32
            "wazuh-indexer",
33
            "ClusterName",
34
            "wazuh-prod-cluster"
35
          ],
36
          ["...", "wazuh-manager", ".", "."],
37
          ["...", "wazuh-dashboard", ".", "."]
38
        ],
39
        "period": 300,
40
        "stat": "Average",
41
        "region": "us-west-2",
42
        "title": "ECS Memory Utilization"
43
      }
44
    },
45
    {
46
      "type": "metric",
47
      "properties": {
48
        "metrics": [
49
          ["AWS/EFS", "BurstCreditBalance", "FileSystemId", "fs-XXXXXXXXX"]
50
        ],
51
        "period": 300,
52
        "stat": "Average",
53
        "region": "us-west-2",
54
        "title": "EFS Burst Credits"
55
      }
56
    }
57
  ]
58
}

Custom Metrics#

1
# Send custom metrics from Wazuh Manager
2
# Create a script on the manager to send metrics
3

4
cat > /var/ossec/bin/send-cloudwatch-metrics.sh << 'EOF'
5
#!/bin/bash
6
NAMESPACE="Wazuh/Custom"
7
REGION="us-west-2"
8

9
# Get connected agents count
10
AGENT_COUNT=$(/var/ossec/bin/agent_control -l | grep -c "Active")
11

12
# Send metric
13
aws cloudwatch put-metric-data \
14
  --namespace "$NAMESPACE" \
15
  --metric-name ConnectedAgents \
16
  --value $AGENT_COUNT \
17
  --region $REGION
18

19
# Get alerts per hour
20
ALERTS_COUNT=$(find /var/ossec/logs/alerts -name "*.json" -mmin -60 | wc -l)
21

22
aws cloudwatch put-metric-data \
23
  --namespace "$NAMESPACE" \
24
  --metric-name AlertsPerHour \
25
  --value $ALERTS_COUNT \
26
  --region $REGION
27
EOF
28

29
chmod +x /var/ossec/bin/send-cloudwatch-metrics.sh
30

31
# Add to crontab
32
echo "*/5 * * * * /var/ossec/bin/send-cloudwatch-metrics.sh" | crontab -

Cost Optimization#

Cost Breakdown by Component#

1
pie title Monthly Cost Distribution
2
    "ECS Fargate Compute" : 45
3
    "Application Load Balancer" : 15
4
    "Network Load Balancer" : 20
5
    "EFS Storage" : 10
6
    "Data Transfer" : 5
7
    "CloudWatch Logs" : 5

Cost Optimization Strategy#

1
flowchart LR
2
    subgraph "Compute Optimization"
3
        A[Fargate Spot<br/>Save 70%] --> B[Right-sizing<br/>Save 20%]
4
        B --> C[Auto-scaling<br/>Save 30%]
5
    end
6

7
    subgraph "Storage Optimization"
8
        D[EFS Lifecycle<br/>Save 50%] --> E[Log Retention<br/>Save 30%]
9
        E --> F[S3 Archive<br/>Save 80%]
10
    end
11

12
    subgraph "Network Optimization"
13
        G[VPC Endpoints<br/>Save 10%] --> H[CloudFront<br/>Save 20%]
14
    end
15

16
    C --> D
17
    F --> G
18

19
    style A fill:#51cf66,stroke:#333,stroke-width:2px
20
    style D fill:#51cf66,stroke:#333,stroke-width:2px
21
    style G fill:#51cf66,stroke:#333,stroke-width:2px

1. Use Fargate Spot#

1
# Update capacity provider strategy
2
aws ecs put-cluster-capacity-providers \
3
  --cluster wazuh-prod-cluster \
4
  --capacity-providers FARGATE FARGATE_SPOT \
5
  --default-capacity-provider-strategy \
6
    capacityProvider=FARGATE,weight=1,base=1 \
7
    capacityProvider=FARGATE_SPOT,weight=4,base=0 \
8
  --region us-west-2

2. Implement Lifecycle Policies#

1
# Create lifecycle policy for logs
2
aws logs put-retention-policy \
3
  --log-group-name /ecs/wazuh-prod-indexer \
4
  --retention-in-days 7 \
5
  --region us-west-2
6

7
# Create S3 lifecycle for archived data
8
aws s3api put-bucket-lifecycle-configuration \
9
  --bucket wazuh-archive-bucket \
10
  --lifecycle-configuration '{
11
    "Rules": [{
12
      "ID": "ArchiveOldAlerts",
13
      "Status": "Enabled",
14
      "Transitions": [{
15
        "Days": 30,
16
        "StorageClass": "GLACIER"
17
      }],
18
      "NoncurrentVersionTransitions": [{
19
        "NoncurrentDays": 7,
20
        "StorageClass": "GLACIER"
21
      }],
22
      "AbortIncompleteMultipartUpload": {
23
        "DaysAfterInitiation": 7
24
      }
25
    }]
26
  }'

Conclusion#

This comprehensive guide provides a production-ready deployment of Wazuh on AWS ECS Fargate. The setup includes:

High Availability: Multi-AZ deployment with load balancing
Security: SSL/TLS encryption, network isolation, and secrets management
Scalability: Auto-scaling policies and Fargate Spot integration
Monitoring: CloudWatch dashboards and custom metrics
Cost Optimization: Lifecycle policies and spot instances
Disaster Recovery: Automated backups and configuration exports

With this deployment, you have a robust, scalable, and secure SIEM platform ready for enterprise use. Remember to:

Regularly update Wazuh components
Monitor costs and optimize resources
Review security configurations periodically
Test disaster recovery procedures
Keep documentation updated

For additional support and updates, refer to the official Wazuh documentation and AWS best practices guides.