I'm now connected to a shell on a Linux server,
and the first thing we need to do is download and extract Terraform,
which we're going to need to create our sadcloud environment.
Again if you already have an AWS environment, skip this section.
Do not run sadcloud against a real environment.
So we're going to download Terraform from the website.
This is the URL to the latest version here,
and it's in a ZIP, so I'm going to unzip it with the unzip command.
We can now see that we have a Terraform executable.
I'm going to make a data directory for it.
And under data, I'm going to create a ssh_keys directory.
Now,
the first thing we need to do for Terraform to work is create
an SSH key that's going to be used for it.
We're going to use ssh‑keygen to create an RSA key with a 4096 bit size,
and we're going to save that to the data/ssh_keys directory we just created,
and we're going to call it terraform_rsa.
Because this is just for a recording, I'm not going to enter a passphrase for it.
And there you go.
Our SSH key has been created.
Now we're going to download sadcloud itself,
so we're going to do that by using Git.
So first, we're going to check if Git is installed, and it is.
If it's not, make sure you install that.
So I'm going to use a git clone command and provide
the URL to sadcloud. There it is.
It has been downloaded.
If I go to the sadcloud directory,
I see there is a sadcloud subfolder, so I'm just going to go in there. So now
what we need to do is edit the Terraform's tfvars file.
We need to do that because sadcloud is able to create
vulnerable configurations for a lot of different Amazon
services, and we don't need all of them.
Keep in mind if you're doing this on an environment,
you'll have to pay for those services that are created,
so don't create too many of them.
I'm going to enable the cloudtrail_findings.
So all simply said that here to true.
I'll do the same with ec2, iam, and s3. I'll save and quit vi, and there we go.
Now we can try to run Terraform.
So, to do that, we need to run terraform plan.
Terraform is located in our home directory, so I'll
run it with .../../terraform plan.
And as you can see, we're missing a bunch of modules,
so we need to do terraform init first. I'm running terraform init,
so it's fetching everything that it needs.
Then I'll try my terraform plan again, and now it doesn't find a region.
In fact,
we haven't configured any credential to our Amazon
environment, so how can it know where to connect?
So what we need to do is configure the AWS access key,
secret key, and default region.
We can set those as environment variables.
So I'm going to export AWS_ACCESS_KEY_ID to my access key. Then all
export AWS_SECRET_ACCESS_KEY to the secret that goes with that key.
Now, for sadcloud to be deployed properly,
I really need a high level of privileges.
So this is using simply the root account on this Amazon account, which
is a really bad idea in a production environment.
But keep in mind we're creating the most vulnerable AWS environment we can here.
And once we've done that,
then we'll simply export the default region, and
I'm going to set it to us‑east‑1.
Now that the keys have been set, as well as the default region,
I'm simply going to clear my terminal so I don't need to keep blurring those
secret keys, and I'm going to run terraform plan again.
Now, terraform plan is looking at its configuration, and it's telling us how
many things will be created in our Amazon environment.
Here.
it's saying that 45 things will be created,
0 will be changed, and 0 will be destroyed.
Now if we run terraform apply,
it will create those 45 items, and we will start paying for them.
Keep that in mind.
This could take up to a few minutes as it connects
to Amazon and creates everything.
There will be a few questions in there.
For example,
it's asking us to confirm that we want to create 45 items,
keeping in mind we have to pay for them.
You can scroll up and look at all the different items it wants to
create and then enter yes once you want them to be created.
Forty‑five resources have been added,
and now we have a lot of vulnerable configurations in our Amazon environment.
So in the next clip,
we're going to see how we can run Scout Suite to identify those.