# Deploy in AWS

Learn how to deploy your first TrapEye instance in Amazon Web Services (AWS). This guide focuses on the manual deployment through the AWS Management Console, but the same workflow applies when using IaC tools such as **Terraform** or the [AWS CLI](https://aws.amazon.com/cli/).

:::note
AWS deployment is based on a **Bring Your Own License (BYOL)** model. You can deploy instances for free, but you need a valid account in the TrapEye console to retrieve events and manage your devices.

If you don't have an account yet, you can [request a free trial](https://anantis.io/request-free-trial).
:::

---

## Create a New Instance

1. Navigate to the **EC2 Dashboard** in the AWS Console.

2. Click on **Launch an instance** to begin the creation process.

3. Under the **Application and OS Images (Amazon Machine Image)** section, click on **Browse more AMIs**.

   ![Browse AMI Button](~/assets/images/docs/installation/aws/browse_ami_button.webp)

4. Select **AWS Marketplace AMIs** and search for **"TrapEye"**. Select the official TrapEye image from the list.

   ![Search AMI](~/assets/images/docs/installation/aws/search_ami.webp)

5. Click **Subscribe now** (or "Continue" if already subscribed). 
   
   *Note: The subscription process via AWS is free; licensing is handled via the TrapEye platform.*

    ![Subscribe](~/assets/images/docs/installation/aws/subscribe.webp)

6. Choose an **Instance Type** using the recommended values below:

   | Resource | Minimum Value | Recommended Value |
    |-----------|-------------------| -------------------|
    | **CPU** | 1 vCPUs           | 1 vCPUs           |
    | **Memory**| 1024 MiB (1 GB)   | 2048 MiB (2 GB)   |

7. In the **Key pair (login)** section, choose **Proceed without a key pair**.

   ![Key Pair](~/assets/images/docs/installation/aws/keypair.webp)

8. In **Network settings**, click **Edit** (if necessary) and select the **VPC** and **Subnet** where you want to deploy the trap.

   :::note
    TrapEye agents are specifically designed to support only **one** network interface per instance. This design ensures attackers cannot use a trap to pivot or move laterally within your environment.
      
    When multiple network interfaces are present, TrapEye automatically detects and prioritizes binding to the private network interface over any public interface.
    :::

    ![VPC Settings](~/assets/images/docs/installation/aws/vpc.webp)

9. You may select the default Security Group. Since TrapEye is intended to interact with your internal network, there is no strict requirement to expose specific ingress ports unless you are configuring specific deception services.

10. From the TrapEye Platform, go to **Management → Installation** and copy the values for `entity_uuid`, `auth_token` and `url`.

11. Expand the **Advanced details** section. Scroll down to the **User data** field. 
   
   **Replace** the placeholder values in the template below with your TrapEye configuration parameters, then paste the final result into the text box.

    ```yaml
    #cloud-config
    write_files:
      - path: /etc/trapeye/auth-config.toml
        permissions: '0600'
        content: |
          entity_uuid = "ENTITY-UUID-HERE"
          auth_token = "ENTITY-TOKEN-HERE"
          url = "INGESTION-URL-HERE"
    ```

    **Example:**

    ![User Data](~/assets/images/docs/installation/aws/user_data.webp)

13. Click **Launch instance** to provision the virtual machine.

## Setup complete

Your TrapEye virtual machine has been successfully deployed in **AWS**. 

It will now appear in the **Devices** section of the TrapEye Deception Platform, and you will begin receiving real-time alerts as soon as any activity is detected.