> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Install the AWS Lambda@Edge Enforcer

If your organization uses **AWS CloudFront services,** you can use **HUMAN’s CloudFront Lambda\@Edge Enforcer** to protect against malicious behavior. This Enforcer uses AWS Lambda functions to deploy the Enforcer on your content delivery network (CDN) and determine how traffic to your organization’s server should be handled.

You can learn how to install the Enforcer with this article.

> **Note**
>
> This process uses the [Deploy Tool](/applications/general/deploy-tool), HUMAN's recommended method for installing and updating the Enforcer. If you prefer a manual method, see our [manual installation article](/applications/aws-lambdaedge/v4/manual-installation).

## Prerequisites

* An **AWS CloudFront account** with the following permissions:
  * Create **AWS IAM policies**
  * Create or edit **AWS IAM user** permissions
  * Create **AWS Access Keys**
* Docker or Script, depending on your preferred method to run the deploy tool.
  * For Docker, see how to install Docker Desktop with their [documentation](https://docs.docker.com/get-started/get-docker/).
  * For Script, install the following:
    * [Node.js 18.x or later and npm 10.x or later](https://docs.npmjs.com/downloading-and-installing-node-js-and-npm)
    * [Git CLI](https://git-scm.com/downloads)
    * [GNU Wget](https://www.gnu.org/software/wget/)
* An Enforcer configuration file, `enforcerConfig.json`, which you can download from the **Platform Settings > Enforcers**, clicking on the appropriate Enforcer, and clicking **Download configuration file** . This file has the basic information for Enforcer functionality, such as your **Application ID** and remote authorization token, already filled in. Be sure to save it in a directory you’ll remember, like `/deploy`.

## AWS IAM Setup

The AWS Lambda\@Edge installation consists of three parts. Be sure to complete each part in order.

1. [Create an IAM Policy to use with an AWS IAM account](#create-an-aws-iam-policy)
2. [Assign an AWS IAM account with required permissions](#assign-aws-iam-account-permissions)
3. [Create an AWS Access Key](#create-an-aws-access-key)

### Create an AWS IAM Policy

You need to create a new IAM Policy with the necessary permissions to deploy the AWS Lambda\@Edge Enforcer.

1. Navigate to the **AWS Console > IAM Dashboard > Policies** and click **Create Policy.**
2. In **Step 1, Specify permissions > Policy editor,** click **JSON.**
3. Replace the JSON that appears with the JSON below.

```json
{
	"Version": "2012-10-17",
	"Statement": [
		{
			"Effect": "Allow",
			"Action": [
				"lambda:CreateFunction",
				"lambda:UpdateFunctionCode",
				"lambda:UpdateFunctionConfiguration",
				"lambda:PublishVersion",
				"lambda:GetFunction",
				"lambda:ListFunctions",
				"lambda:InvokeFunction",
				"lambda:EnableReplication",
				"cloudfront:CreateDistribution",
				"cloudfront:UpdateDistribution",
				"cloudfront:GetDistribution",
				"cloudfront:ListDistributions",
				"cloudfront:ListCachePolicies",
				"cloudfront:CreateCachePolicy",
				"cloudfront:GetDistributionConfig",
				"iam:CreateRole",
				"iam:AttachRolePolicy",
				"iam:PutRolePolicy",
				"iam:PassRole",
				"iam:GetRole",
				"iam:ListRoles",
				"iam:GetUser"
			],
			"Resource": "*"
		}
	]
}
```

4. Click **Next** and provide a **Policy name.**
5. Click **Create Policy.**

Next, move on to [Assign AWS IAM account permissions.](#assign-aws-iam-account-permissions)

### Assign AWS IAM account permissions

Your goal is to have at least one AWS IAM user with permission to send request to different AWS APIs. You can do this by either [**creating a new AWS IAM account**](#option-1:-create-a-new-aws-iam-account) or [**editing permissions for an existing account**](#option-2:-edit-an-existing-aws-iam-account).

> **Note**
>
> Unless specified, you can leave fields as their defaults or skip them.

#### Option 1: Create a new AWS IAM account

1. Navigate to the [**AWS Console**](https://console.aws.amazon.com/) **> [IAM Dashboard](https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1) > Users** and click **Create user.**
2. In **Step 1, Specify User Details,** provide a **user name** and click **Next.**
3. In **Step 2, Set permissions:**
   1. In the **Permissions options**, choose **Attach policies directly**.
   2. In the **Permissions policies** area that appears, click the checkbox next to the Policy you created in [Create an AWS IAM Policy](#create-an-aws-iam-policy).
4. Click **Next.** Then, in **Step 3, Review and create,** click **Create user.**

Next, move on to [Create an AWS Access Key.](#create-an-aws-access-key)

#### Option 2: Edit an existing AWS IAM account

1. Navigate to the [**AWS Console**](https://console.aws.amazon.com/) **> [IAM Dashboard](https://us-east-1.console.aws.amazon.com/iam/home?region=us-east-1) > Users**.
2. Click the user you want to add permissions to.
3. Under **Permissions > Permissions policies,** click **Add permissions > Add permissions.**
4. From **Step 1, Add permissions:**
   1. In **Permissions options**, choose **Attack policies directly**.
   2. In the **Permissions policies** area that appears, click the checkbox next to the Policy you created in [Create an AWS IAM Policy](#create-an-aws-iam-policy).
5. Click **Next.** Then, in **Step 2, Review,** click **Add permissions.**

Next, move on to [Create an AWS Access Key.](#create-an-aws-access-key)

### Create an AWS Access key

1. Navigate to the AWS Console > IAM Dashboard > Users and select the user you just created or edited from [Assign AWS IAM account permissions.](#assign-aws-iam-account-permissions)
2. Click the **Security credentials** tab.
3. Navigate to the **Access keys** area and click **Create access key.**
4. In **Step 1, Access key best practices & alternatives,** select **Other** as the **Use case.** Then, click **Next.**
5. If you’d like, add a **description.** Otherwise, click **Create access key.**
6. Copy the **Access key** and **Secret access key** that appear.

> **Warning**
>
> This will be the **only** time you’ll see the access key and secret access key, so be sure to save it before closing the page!

## Run the Deploy Tool

First, download and run the Deploy Tool. You can do this by either pulling a Docker image or running a script.

#### Docker method

> **Additional setup for Windows users**
>
> If you're using Windows, you also need to complete additional steps to set up Docker:
>
> 1. In your Windows search bar, search for and open **Turn Windows features on or off**.
> 2. Find the **Windows Hypervisor Platform** feature and click its checkbox to enable it.
> 3. Click **OK** to save your changes.
> 4. Open **Windows PowerShell** as an Administrator.
> 5. Copy and paste in `C:\Windows\System32\wsl.exe --update --web-download`, then hit Enter.

1. Pull the Docker image by running:

```bash
docker pull us-docker.pkg.dev/hmn-registry/docker-public/cdn-enforcer-deploy-tool
```

2. Navigate to the directory where you saved `enforcerConfig.json`.
3. Run the Deploy Tool with the following:

```bash
docker run --rm -v $PWD:/app/local -it us-docker.pkg.dev/hmn-registry/docker-public/cdn-enforcer-deploy-tool
```

#### Script method

1. Navigate to the directory where you created `enforcerConfig.json`.
2. Pull the HUMAN Deploy Tool zip from Google Artifact Registry using:

**`Windows`**

```shell title="Windows"
wget 'https://artifactregistry.googleapis.com/v1/projects/hmn-registry/locations/us/repositories/enforcers-public/files/cdn-enforcer-deploy-tool_win:1.7.1:cdn-enforcer-deploy-tool_win.zip:download?alt=media' -O cdn-enforcer-deploy-tool.zip
```

**`Mac and Linux`**

```shell title="Mac and Linux"
wget 'https://artifactregistry.googleapis.com/v1/projects/hmn-registry/locations/us/repositories/enforcers-public/files/cdn-enforcer-deploy-tool_unix:1.7.1:cdn-enforcer-deploy-tool_unix.zip:download?alt=media' -O cdn-enforcer-deploy-tool.zip
```

3. Unzip `cdn-enforcer-deploy-tool.zip` to the same directory you saved `enforcerConfig.json` in.
4. Navigate to the folder you unzipped and double click the script file to run the Deploy Tool. Depending on your operating system, the folder and script file are named differently:
   * **Windows**: Open the `cdn-enforcer-deploy-tool_win` folder and double click `run.bat`.
   * **Mac or Linux**: Open the `cdn-enforcer-deploy-tool_unix` folder and double click `run.command`.

## Deploy the Enforcer

After you run the Deploy Tool, you'll be prompted with steps to deploy the Enforcer.

1. When prompted, select **AWS Lambda\@Edge** and hit **Enter.**

```bash
🚀 HUMAN CDN Enforcer Deploy Tool 🚀
? Which platform do you want to deploy to? (Use arrow keys)
  ...
❯ AWS Lambda@Edge
  ...
```

2. Follow the prompts that appear to complete the setup process.
3. After you complete the setup, confirm that the displayed details are correct, then enter `y` to deploy the Enforcer.

## Enable CloudWatch logs (recommended)

We recommend creating an IAM role for each Lambda you upload. This lets the function create log groups and log streams in CloudWatch. When you deploy a Lambda\@Edge function, it distributes across all edge cache locations, and all logs from the Lambda related to those regions will appear in the CloudWatch logs of their respective edge cache areas. For example, if a user accesses the `us-east-1` region, the corresponding logs will be found in `us-east-1`.

```typescript
{  
"Version": "2012-10-17",  
"Statement": \[  
    {  
        "Effect": "Allow",  
        "Action": "logs:CreateLogGroup",  
        "Resource": "arn:aws:logs:_:_:_"  
    },  
    {  
        "Effect": "Allow",  
        "Action": [  
            "logs:CreateLogStream",  
            "logs:PutLogEvents"  
        ],  
        "Resource": \[  
            "arn:aws:logs:_:_:log-group:_:\*"  
        ]  
    }  
  ]  
}
```