Amazon Web Services: AI assistant (LLM)¶

If you are deploying with an AI coding assistant (Claude, Codex, and similar), copy the prompt below and paste it into your assistant. It drives the same aws CLI flow as the CLI (aws) guide, but written for the assistant to follow step by step, pausing for your confirmation and for the values only you can supply.

Before you paste

Give the assistant a session that already has the AWS CLI configured with credentials for your account (an agentic tool with shell access, or paste the commands it returns into your own terminal). Have your engagement lead's values ready: the shared AMI ID, AWS Region, a key pair name, and your subnet and security group IDs. The assistant will ask for anything it is missing.

Deployment prompt¶

You are helping me deploy the Sophos Remote Testing Appliance (RTA) as an EC2
instance in my AWS account, using the AWS CLI. Work through the steps below in
order. Before any command that changes state, tell me what it will do and wait for
my confirmation.

CONTEXT:
- The appliance is a prebuilt AMI my engagement lead shared with my account. It is
  a UEFI-boot Linux image with no engagement identity baked in, so on first boot it
  shows an "Appliance Registration" screen with a one-time activation code that I
  send back to Sophos. There is no software to install and no inbound access.

WHAT I WILL PROVIDE (ask me for any you do not have; never guess these):
- <SHARED_AMI_ID>: the AMI ID my engagement lead shared (for example ami-0abc123...).
- <REGION>: the AWS Region the AMI was shared into. The AMI is only visible there.
- <KEY_NAME>: the name of an existing EC2 key pair in that Region.
- <SUBNET_ID>: my target subnet. Prefer a private subnet with NAT-gateway egress.
- <SG_ID>: an outbound-only security group, or <VPC_ID> if you need to make one.
- <SOPHOS_ACCOUNT_ID> (optional): the account that owns the AMI, for lookups.

STEPS:
1. Confirm the AWS CLI is configured for <REGION>, then confirm the AMI is visible:
   aws ec2 describe-images --region <REGION> --image-ids <SHARED_AMI_ID> \
     --query 'Images[*].[ImageId,Name,BootMode]' --output table
   Expect exactly one row with BootMode "uefi". If the list is empty, stop: the
   Region is wrong or the AMI was not shared with my account. Tell me.

2. If I did not give you an <SG_ID>, create an outbound-only security group in
   <VPC_ID>:
   aws ec2 create-security-group --region <REGION> --group-name rta-outbound-only \
     --description "RTA appliance - outbound only" --vpc-id <VPC_ID> \
     --query GroupId --output text
   A new security group already allows all outbound traffic, which is what the
   appliance needs. Do NOT add any inbound rule.

3. Launch the instance (t3a.large is the recommended size; the type must be Nitro,
   because the image is UEFI-only, so never pick a t2/m4/c3/c4/r3 type):
   aws ec2 run-instances --region <REGION> --image-id <SHARED_AMI_ID> \
     --instance-type t3a.large --key-name <KEY_NAME> --subnet-id <SUBNET_ID> \
     --security-group-ids <SG_ID> --no-associate-public-ip-address \
     --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=Sophos-RTA}]' \
     --count 1 --query 'Instances[0].[InstanceId,PrivateIpAddress]' --output table
   Only drop --no-associate-public-ip-address if I tell you the subnet is a public
   (internet-gateway) subnet, because without a public IP such a subnet has no
   outbound path.

4. Wait for it to be running:
   aws ec2 wait instance-running --region <REGION> --instance-ids <INSTANCE_ID>

VERIFY:
5. Confirm it looks right:
   aws ec2 describe-instances --region <REGION> --instance-ids <INSTANCE_ID> \
     --query 'Reservations[0].Instances[0].[State.Name,PublicIpAddress,PrivateIpAddress]' \
     --output table
   Expect State running, PublicIpAddress None (on a private subnet), and a
   PrivateIpAddress populated.

6. About a minute after launch, read the one-time activation code off the console:
   aws ec2 get-console-screenshot --region <REGION> --instance-id <INSTANCE_ID> \
     --query 'ImageData' --output text | base64 --decode > console.jpg
   Open console.jpg. It shows an "Appliance Registration" screen with a short code
   (for example "4 5 D C V Y"). Read that code back to me exactly. Do NOT send it
   anywhere yourself: I give it to my Sophos engagement lead, who activates the
   appliance. After activation the console switches to a live status dashboard.

RULES YOU MUST FOLLOW:
- These steps are authoritative. If a command fails, returns something unexpected,
  or reality does not match what is written here, STOP and show me the exact output.
  Do not improvise, invent flags, or try alternative commands on your own.
- The appliance needs exactly ONE connection: an outbound tunnel on TCP/443 to
  connect.remotetesting.secureworks.com. Never open, forward, or allow any INBOUND
  port to it. If connectivity fails, the problem is on the outbound path, never a
  missing inbound rule.
- Never enable Secure Boot and never change the firmware or boot type away from what
  these steps specify (UEFI / Generation 2). The appliance will not boot otherwise.
- Do not SSH into, log in to, or reconfigure the appliance. Once it boots it
  provisions itself; there is nothing to set up inside it.
- Every value in angle brackets (<LIKE_THIS>) must come from me. Never guess, invent,
  or reuse one. Ask me for any you do not have before running the step that needs it.
- Do not weaken security to force the connection (do not disable TLS inspection, and
  do not turn off a firewall). If something is blocked, tell me what and let me decide.
- Do only what these steps describe: deploy this one appliance. Do not create extra
  resources, install extra software, or take any action beyond that.

Network access¶

The appliance makes one connection to do its job: an outbound tunnel to the Sophos headend. Nothing inbound is ever required: you never open or forward any ports to the appliance.

Allow this outbound destination


Destination	`connect.remotetesting.secureworks.com`
IP addresses	`3.33.194.251` and `15.197.255.2` (static; these do not change)
Port / protocol	TCP 443, carrying OpenVPN (not HTTPS)
Direction	Outbound only

Allow egress on TCP/443 to that destination from the appliance's network. On a next-generation firewall or NAC-controlled network, an L3 "allow 443" rule is often not enough: Layer-7 application control, TLS/SSL decryption, or NAC can still drop the tunnel even when the port is open. See Connectivity troubleshooting for the exact firewall and NAC exceptions to request.

Troubleshooting¶

Deployed but something isn't right?

See this platform's troubleshooting guide for the most common issues here and how to fix them.