This is where the FortiGate-VM and protected VMs are situated and users control the network. The public-facing interface is routed to the Internet gateway, which is created within the VPC.

FortiGate-VM for AWS is an EC2 VM instance. Every instance has a unique instance ID.

You must appropriately configure FortiGate-VM with subnets and route tables to handle traffic.

The AWS gateway as a VPC component that allows communication between instances in your VPC and the Internet.

At least one public IP address must be allocated to the FortiGate-VM to access and manage it over the Internet.

AWS public-facing protection. Allow only necessary ports and protocols.

A special type of deployable image used on AWS. You can launch FortiGate-VM (BYOL) directly from the publicly available FortiGate AMI instead of using the marketplace. See Deploying from BYOL AMI.

The on-demand AMI is launchable but does not allow you to properly boot up as it is not intended to be deployed from AMI.

Auto scaling can automatically scale out by instantiating additional FortiGate-VM instances at times of high workloads. See Deploying auto scaling on AWS.

To run auto scaling, you must enable/subscribe to coexisting AWS services:

• Route 53
• API gateway
• Load Balancer
• CloudWatch
• Lambda
• SNS
• DynamoDB
• Simple Storage Services (S3) (BYOL only)

These services are not always required for AWS auto scaling in general, but are predefined in Fortinet-provided Lambda scripts.

AWS Lambda lets you run certain scripts and codes without provisioning servers. Fortinet provides Lambda scripts for:

• Running auto scaling
• GuardDuty integration

To use the scripts, you must subscribe to Lambda. Fortinet-provided Lambda scripts are not supported within the regular Fortinet technical support scope. Contact awssales@fortinet.com with questions.

It acts as a front door by providing a callback URL for the FortiGate-VM to send its API calls and process FortiGate-VM config-sync tasks to synchronize OS configuration across multiple FortiGate-VM instances at the time of auto scaling scale-out. It is required if the config-sync feature needs to be incorporated into auto scaling.

A handy flexible database. Fortinet-provided scripts use DynamoDB to store information about varying states of auto scaling conditions.

Managed message service used to communicate between AWS components. Fortinet-provided scripts use SNS to deliver subscription notifications from CFTs to Lambda for auto scaling.

Managed threat detection service that monitors unwanted behaviors/activities related to AWS resources. Fortinet can leverage externally available lists of malicious IP addresses stored at certain locations. GuardDuty can be used to populate such a list. See Populating threat feeds with GuardDuty. To use this feature, you must subscribe to GuardDuty.