fortianalyzer-aws-standalone-cloudformation

CloudCSE Version: v25.4.d
Revision:
Last updated: Thu, Oct 30, 2025 21:06:12 UTC
Copyright© 2025 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet’s internal lab tests. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.

Subsections of fortianalyzer-aws-standalone-cloudformation

Introduction

Welcome

The purpose of this site is to provide a quick start guide for using Infrastructure as Code (IaC) templates located in the repo fortianalyzer-aws-standalone-cloudformation.

Reference the prerequisites and deployment sections on this site to get started.

For other documentation needs such as FortiOS administration and additional use cases, please reference docs.fortinet.com.

Prerequisites

Before attempting to create a stack with the template, a few prerequisites should be checked to ensure a successful deployment:

  1. An AMI subscription must be active for the FortiAnalyzer license type being used in the template.

  2. The solution requires 1 EIP to be created so ensure the AWS region being used has available capacity. Reference AWS Documentation for more information on EC2 resource limits and how to request increases.

  3. If BYOL licensing is to be used, ensure these licenses have been registered on the support site.

  4. Create a new S3 bucket in the same region where the template will be deployed. If the bucket is in a different region than the template deployment, bootstrapping will fail.

  5. If BYOL licensing is to be used, upload these licenses to the root directory of the same S3 bucket from the step above.

  6. If the FAZ will be publicly available, ensure that the PublicSubnet’s AWS route table has a default route to an AWS Internet Gateway, otherwise bootstrapping will fail. Reference AWS Documentation for further information.

  7. If the FAZ will not be publicly available, ensure that a S3 gateway endpoint is deployed and assigned to the subnet’s AWS route table the FAZ will be deployed into. Otherwise, provide the relevant route table ID and the template will deploy a S3 gateway endpoint for you. Reference AWS Documentation for further information.

Warning

PAYG licensed instances require direct internet access to register with FortiCare successfully. BYOL and Flex can use proxies instead of direct internet access, however that requires modification to the userdata to bootstrap the proxy configuration correctly.

Deployment

Once the prerequisites have been satisfied proceed with the deployment steps below.

  1. To download the template, you can either clone the repo with the git command below, or download the repo as a ZIP archive. The template is in the /cloudformation folder
git clone https://github.com/FortinetCloudCSE/fortianalyzer-aws-standalone-cloudformation.git

  1. Login to your AWS account. In the AWS services page under All Services > Management Tools, select CloudFormation.

  2. Select Create Stack then select with new resources.

  3. On the Select Template page, under the Choose a Template section select Upload a template to Amazon S3 and browse to your local copy of the chosen deployment template.

  4. On the Specify Details page, you will be prompted for a stack name and parameters for the deployment. We are using the ‘FortiAnalyzer_Standalone_ExistingVPC.template.json’ template which deploys a FAZ into an existing VPC’s public & private subnets and gives options for configuring the instance settings.

Warning

If the FAZ is deployed into a public subnet, this hould have a default route to an Internet Gateway or bootstrapping the config and license of the FAZ will fail. If the FAZ is deployed into a private subnet, this subnet should have a S3 Gateway endpoint associated to the subnet's route table. Otherwise, provide the relevant route table ID and the template will deploy a S3 gateway endpoint for you. Reference [AWS Documentation](https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html) for further information.

  1. In the FortiAnalyzer Instance Configuration parameters section, we have selected an Instance Type and Key Pair to use, chose to encrypt both OS and Log disks, as well as Flex licensing. Notice we are prompted for the licensing type which we are going with tokens. In our case we do not need to fill out the InitS3Bucket parameter.

  2. In the Interface IP Configuration for the FortiAnalyzer parameters section, we are going with the defaults in this example as the subnet addressing matches. This IP will be the primary IP assigned to the FortiAnalyzer ENI.

  3. On the Options page, you can scroll to the bottom and select Next.

  4. On the Review page, scroll down to the capabilities section. As the template will create IAM resources, you need to acknowledge this by checking the box next to ‘I acknowledge that AWS CloudFormation might create IAM resources’ and then click Submit.

  5. On the main AWS CloudFormation console, you will now see your stack being created. You can monitor the progress by selecting your stack and then select the Events tab.

  1. Once the stack creation has completed successfully, select the Outputs tab to get the login information for the FortiAnalyzer instance.

  1. This concludes the template deployment example.