Amazon Web Services: GUI (EC2 Console)¶

Deploy the RTA entirely from the AWS EC2 console. Your engagement lead shares a UEFI-boot AMI with your AWS account; you locate it in the console and launch an EC2 instance from it with a few clicks.

Before you start

Review the Amazon Web Services overview. You'll need the shared AMI ID and the AWS region from your engagement lead, an existing VPC subnet with outbound internet access (a private subnet behind a NAT gateway is preferred), a key pair, and a security group that allows only outbound traffic.

Quick deploy¶

Experienced operators can launch straight from these steps; the detailed walkthrough with screenshots follows below.

EC2 console → Images → AMIs → Private images, select the shared AMI ID, then Launch instance from AMI.
Instance type: a Nitro type (the image is UEFI-only), t3a.large recommended. A Xen family (t2, m4, c3, c4, r3) boots to a blank console.
Network: a subnet with outbound internet (private subnet behind a NAT gateway preferred, public IP disabled). Security group: outbound allowed, no inbound rules.
Storage: leave the root volume at 40 GB.
Launch instance, then read the activation code with Actions → Monitor and troubleshoot → Get instance screenshot and send it to your engagement lead.

1. Open the AMIs view¶

Open the EC2 console and confirm the region (top-right corner) matches the region your engagement lead specified.
In the left navigation pane, under Images, choose AMIs.
In the first filter dropdown, choose Private images.

2. Select the shared AMI¶

In the search bar, paste the AMI ID provided by your engagement lead (e.g. <SHARED_AMI_ID>).
Select the AMI in the results list.
Choose Launch instance from AMI (top-right of the page). The Launch an instance wizard opens with the AMI pre-selected.

Can't see the AMI?

If the AMI doesn't appear, double-check you're in the correct region and that the Private images filter is active. See the overview troubleshooting for more detail.

3. Configure the instance¶

Name¶

Enter a descriptive name (e.g. Sophos-RTA).

Instance type¶

Choose a Nitro-based instance type: the RTA image uses UEFI boot mode and will not launch on older Xen-based families. We recommend t3a.large (2 vCPU / 8 GB) as the default.

Sizing	Instance type
Minimum (2 vCPU / 4 GB)	`t3a.medium`
Recommended (2 vCPU / 8 GB)	`t3a.large`
Preferred (4 vCPU / 16 GB)	`t3a.xlarge` or `m5a.xlarge`

Both the t3a/m5a (AMD) and t3/m5 (Intel) families are Nitro-based and boot the image fine; the a variants are typically a bit cheaper.

Avoid Xen-based types

Do not select t2, m4, c3, c4, r3, or other pre-Nitro families. The instance will fail to start or boot to a blank screen because they do not support UEFI.

Key pair¶

Select an existing key pair, or create one. You'll use it to SSH to the appliance from inside your network if break-glass access is ever needed.

Network settings¶

Click Edit to expand the networking options.

VPC: select the VPC where the appliance will run.
Subnet: select a subnet with outbound internet access (this also sets the Availability Zone). A private subnet behind a NAT gateway is preferred. Do not place the appliance in a subnet with no egress: the appliance must reach the Sophos headend on first boot.
Auto-assign public IP: Disable for a NAT-gateway subnet (preferred). Only if you must use a public subnet (one that routes via an internet gateway), set Enable: an internet-gateway subnet with no public IP has no outbound path, so the appliance can never register.
Firewall (security groups): select an existing security group that has:
- No inbound rules (or only the rules needed for your internal SSH access from within the VPC).
- Outbound: all traffic allowed (the appliance establishes the tunnel outbound).

If you need to create a new security group, name it rta-outbound-only and add only the outbound rule. Do not add inbound rules from the internet.

Configure storage¶

The root volume defaults to the AMI's size. Confirm it is set to 40 GB (gp3). Do not reduce it.

Advanced details (optional)¶

The wizard's Advanced details section (tags, IMDSv2, instance metadata, etc.) can be left at its defaults; none of it is required for the appliance to deploy and register. Apply your own tagging or IMDSv2 policy here if your organization mandates it.

4. Launch¶

Review the summary panel on the right and choose Launch instance.

The instance moves through Pending → Running in 30 to 60 seconds, then boots into activation mode (see How delivery works on AWS). Read the activation code as described below.

Verify¶

In the EC2 console, navigate to Instances and select the new instance.
Confirm:
- Instance state: Running
- Public IPv4 address: none
- Private IPv4 address: populated with your VPC address

Send us the activation code¶

The appliance has no inbound access and you do not log in to it, so read the activation code from the EC2 console screenshot:

Select the instance, then choose Actions → Monitor and troubleshoot → Get instance screenshot.
Allow about a minute after launch for first boot, then refresh the screenshot.

The console shows the Appliance Registration screen: a one-time activation code (for example 4 5 D C V Y) under the prompt "Provide this code to your Sophos staging team." You do not log in to the appliance to read it.

Send that activation code to your Sophos engagement lead so they can activate the appliance on the Sophos side. Once activated, the console switches from the registration screen to the appliance's live status dashboard, and no further action is needed on your end.

Registration needs outbound 443 to get.remotetesting.secureworks.com

Registration and activation use outbound TCP/443 (HTTPS) to get.remotetesting.secureworks.com, in addition to the OpenVPN tunnel to connect.remotetesting.secureworks.com covered under Network access below. Its IP addresses are not guaranteed to stay constant, so allowlist get.* by FQDN (not by IP). If that egress is blocked, the console shows a registration error ("ensure outbound HTTPS to get.remotetesting.secureworks.com") instead of an activation code.

For break-glass SSH once the appliance is up (your engagement lead provides the login account):

ssh <username>@<private-ip>

Run this from a host inside the same VPC (bastion, VPN endpoint, or direct connect peer).

Network access¶

The appliance makes one connection to do its job: an outbound tunnel to the Sophos headend. Nothing inbound is ever required: you never open or forward any ports to the appliance.

Allow this outbound destination


Destination	`connect.remotetesting.secureworks.com`
IP addresses	`3.33.194.251` and `15.197.255.2` (static; these do not change)
Port / protocol	TCP 443, carrying OpenVPN (not HTTPS)
Direction	Outbound only

Allow egress on TCP/443 to that destination from the appliance's network. On a next-generation firewall or NAC-controlled network, an L3 "allow 443" rule is often not enough: Layer-7 application control, TLS/SSL decryption, or NAC can still drop the tunnel even when the port is open. See Connectivity troubleshooting for the exact firewall and NAC exceptions to request.

Troubleshooting¶

Deployed but something isn't right?

See this platform's troubleshooting guide for the most common issues here and how to fix them.