> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Install the Akamai EdgeWorker Enforcer v4

If your organization uses **Akamai**, you can use HUMAN's **Akamai EdgeWorker Enforcer** to protect against malicious behavior. The Enforcer is installed using an Akamai EdgeWorker and deployed to your content delivery network (CDN). The Enforcer dictates how traffic should be handled per your organization's standards.

You can learn how to install the Akamai EdgeWorker Enforcer with this article.

> **Note**
>
> This process uses the [Deploy Tool](/applications/general/deploy-tool), HUMAN's recommended method for installing and updating the Enforcer. If you prefer a manual method, see our [manual installation article](/applications/akamai-edgeworker/v4/manual-installation).

## Prerequisites

* An **Akamai account** with editor access to the following:
  * NetStorage services
  * EdgeWorkers
  * Property Manager

> **Warning**
>
> Sometimes, you may encounter a 500 error when the EdgeWorker initialization exceeds the CPU limit for your resource tier. For example, you may see response headers such as:
>
> ```bash
> status=InitCpuTimeoutError
> init_cpu_time=60
> res_tier=200
> ```
>
> This error comes from Akamai EdgeWorker's runtime limits and not HUMAN's service. To resolve this, we recommend moving to a higher [Akamai EdgeWorker resource tier](https://techdocs.akamai.com/edgeworkers/docs/resource-tier-limitations).

* Docker or Script, depending on your preferred method to run the deploy tool.
  * For Docker, see how to install Docker Desktop with their [documentation](https://docs.docker.com/get-started/get-docker/).
  * For Script, install the following:
    * [Node.js 18.x or later and npm 10.x or later](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm)
    * [Git CLI](https://git-scm.com/downloads)
    * [GNU Wget](https://www.gnu.org/software/wget/)
* An Enforcer configuration file, `enforcerConfig.json`, which you can download from the **Platform Settings > Enforcers**, clicking on the appropriate Enforcer, and clicking **Download configuration file** . This file has the basic information for Enforcer functionality, such as your **Application ID** and remote authorization token, already filled in. Be sure to save it in a directory you’ll remember, like `/deploy`.

## Akamai setup

The Akamai setup consists of three parts. Be sure to complete each part in order.

1. [Create an API client](#create-an-api-client)
2. If you do not have one already, [create a NetStorage storage group](#create-a-netstorage-storage-group)
3. If you do not have one already, [create a NetStorage upload account](#create-a-netstorage-upload-account)

> **Note**
>
> We recommend letting HUMAN set up your Akamai EdgeWorker, Property Manager, and NetStorage due to the manual nature of the process. This requires creating an API token so that the HUMAN CDN Enforcer Deploy Tool can access your Akamai environment.

### Create an API client

The deploy tool must send API requests to Akamai to configure the EdgeWorker and the Property Manager. To send these requests, you must create a personal API client.

1. Log in to the **Akamai Control Center.**
2. From the main menu, select **Account Admin > Identity and Access.**
3. Under **Users and API Clients**, click **Create API client**.
4. Click **Advanced**.
5. Update the following fields as specified below. Otherwise, you can complete fields as appropriate for your organization or leave them as their defaults.
   1. For the **APIs** selection, click **Select APIs**.
   2. Grant READ-WRITE access to the following:
      1. Property Manager (PAPI)
      2. EdgeWorkers
      3. NetStorage
   3. Click **Submit**
   4. For the **Group** selection, choose **Same group as \<user account name>**.
6. Click **Create API Client.**
7. Save the generated API client credentials, including the host, client token, client secret, and access token, in a secure location. The deploy tool uses these credentials later on.

> **Warning**
>
> This will be the **only** time you’ll see your credentials, so be sure to save them before closing the page.

### Create a NetStorage storage group

> **Note**
>
> These steps are **optional** and only necessary if you **do not** already have a storage group. If you do, you can move on to Upload accounts.

1. From your Akamai account’s main menu, navigate to **Origin Services > NetStorage > Storage Groups.**
2. Select the **+** to **Create a new storage group.**
3. Update the following fields as specified below. If not specified, you can complete fields as appropriate for your organization or leave them as their defaults.
   1. In **Step 1, Basic Information:**
      1. Set the **storage group name** as **human-storage-group**
      2. Set the **domain name prefix** as **human-storage-group**
   2. In **Step 4, Upload Directories**:
      1. Click **Create a new upload directory**
      2. Keep the default values and click **Add**. Then, click **Next**.
   3. In **Step 6, Summary,** review your settings and click **Create**.

The storage group will start to propagate, which may take up to two hours. Meanwhile, you can move on to [creating an upload account.](#create-a-netstorage-upload-account)

### Create a NetStorage upload account

> **Note**
>
> These steps are **optional** and only necessary if you **have not** uploaded accounts yet. If you have, you can move on to Deploy the Enforcer.

1. Navigate to **Origin Services > NetStorage > Upload Accounts.**
2. Select the **+** to **create a new upload account.**
3. Update the following fields as specified below. Otherwise, you can complete fields as appropriate for your organization or leave them as their defaults.
   1. In **Step 1, Basic Information:**
      1. Enter **human-upload-account** as the **Upload Account ID**.
      2. Provide a name and contact information for your account.
   2. In **Step 2, Access Methods:**
      1. Click the **NetStorage HTTP CMS API**, then click on the link to create a new HTTP API key.
      2. Click the **File Manager** tab, then enable **File Manager access**.
   3. In **Step 3, Upload Directory Association,** select the group you made in Create a storage group, **human-storage-group**.
   4. In **Step 5, Summary**, review your settings and click **Create**.
4. Navigate to **NetStorage > Storage Groups.** Select the group you created, **human-storage-group.** Then, select **File Manager.**
5. In **File Manager Access**, locate your user account. Then, locate the **human-upload-account** upload account and click the checkbox to select it.
6. Click **Save** to apply changes.

The upload account will start to propagate, which may take up to two hours. Afterwards, you can move on to [running the Deploy Tool.](#run-the-deploy-tool)

## Run the Deploy Tool

First, download and run the Deploy Tool. You can do this by either pulling a Docker image or running a script.

#### Docker method

> **Additional setup for Windows users**
>
> If you're using Windows, you also need to complete additional steps to set up Docker:
>
> 1. In your Windows search bar, search for and open **Turn Windows features on or off**.
> 2. Find the **Windows Hypervisor Platform** feature and click its checkbox to enable it.
> 3. Click **OK** to save your changes.
> 4. Open **Windows PowerShell** as an Administrator.
> 5. Copy and paste in `C:\Windows\System32\wsl.exe --update --web-download`, then hit Enter.

1. Pull the Docker image by running:

```bash
docker pull us-docker.pkg.dev/hmn-registry/docker-public/cdn-enforcer-deploy-tool
```

2. Navigate to the directory where you saved `enforcerConfig.json`.
3. Run the Deploy Tool with the following:

```bash
docker run --rm -v $PWD:/app/local -it us-docker.pkg.dev/hmn-registry/docker-public/cdn-enforcer-deploy-tool
```

#### Script method

1. Navigate to the directory where you created `enforcerConfig.json`.
2. Pull the HUMAN Deploy Tool zip from Google Artifact Registry using:

**`Windows`**

```shell title="Windows"
wget 'https://artifactregistry.googleapis.com/v1/projects/hmn-registry/locations/us/repositories/enforcers-public/files/cdn-enforcer-deploy-tool_win:1.7.1:cdn-enforcer-deploy-tool_win.zip:download?alt=media' -O cdn-enforcer-deploy-tool.zip
```

**`Mac and Linux`**

```shell title="Mac and Linux"
wget 'https://artifactregistry.googleapis.com/v1/projects/hmn-registry/locations/us/repositories/enforcers-public/files/cdn-enforcer-deploy-tool_unix:1.7.1:cdn-enforcer-deploy-tool_unix.zip:download?alt=media' -O cdn-enforcer-deploy-tool.zip
```

3. Unzip `cdn-enforcer-deploy-tool.zip` to the same directory you saved `enforcerConfig.json` in.
4. Navigate to the folder you unzipped and double click the script file to run the Deploy Tool. Depending on your operating system, the folder and script file are named differently:
   * **Windows**: Open the `cdn-enforcer-deploy-tool_win` folder and double click `run.bat`.
   * **Mac or Linux**: Open the `cdn-enforcer-deploy-tool_unix` folder and double click `run.command`.

## Deploy the Enforcer

After you run the Deploy Tool, you'll be prompted with steps to deploy the Enforcer.

1. When prompted, select **Akamai EdgeWorker** and hit **Enter.**

```bash
🚀 HUMAN CDN Enforcer Deploy Tool 🚀
? Which platform do you want to deploy to? (Use arrow keys)
  ...
❯ Akamai EdgeWorker
  ...
```

2. Follow the prompts that appear to complete the setup process.
3. After you complete the setup, confirm that the displayed details are correct, then enter `y` to deploy the Enforcer.