Automate AWS Traffic Mirroring with CloudFormation

You can automate traffic mirroring for ExtraHop sensors in AWS with a CloudFormation template that is publically available on the ExtraHop code-examples GitHub repo. The CloudFormation template creates an EventBridge rule and Lambda function that work together to automatically mirror traffic. Here is how the system works:

The EventBridge rule runs when one of the following CloudTrail events occurs:

• CreateTags
• DeleteTags
• RunInstances
• DeleteTrafficMirrorSession

The EventBridge rule then starts the Lambda function. The Lambda function creates or deletes a traffic mirror session that mirrors traffic from an EC2 instance to a traffic mirror target that is associated with an ExtraHop sensor. The Lambda function determines how to create the mirror session based on AWS tags applied to EC2 instances, traffic mirror filters, and traffic mirror targets.

If the event is CreateTags, and a specific tag was added to an EC2 instance, the Lambda function creates a traffic mirror session for the EC2 instance. If the event is RunInstances, and the EC2 instance has a specific tag, the Lambda function creates a traffic mirror session for the EC2 instance. If the event is DeleteTrafficMirrorSession, and an associated EC2 instance has a specific tag, the Lambda function recreates the session to prevent traffic mirror sessions from being deleted accidentally or maliciously.

If the event is DeleteTags, and a specific tag was removed from an EC2 instance, the Lambda function deletes a traffic mirror session.