Upgrading InsightCloudSec - AWS Terraform

This document explains how to upgrade your InsightCloudSec deployment on AWS if you are currently using Terraform modules. The process is straightforward and can be done in a few minutes.

Prerequisites

These instructions assume that you have the following:

  • A functioning InsightCloudSec platform installation
  • Appropriate admin permissions to upgrade your environment
  • Are upgrading a self-hosted deployment (as opposed to a hosted customer)

Refer to our release documentation for new or revised permissions required by the new version of the application and for any configuration changes necessary. If you have any plugins or overrides, reach out to us through any option listed on the Getting Support Page

The content/steps provided on this page apply to self-hosted customers. For hosted customers, we recommend that you contact your CSM or through the Customer Support Portal with any questions or concerns.

Redis 7.1 required

Beginning with release 24.9.3, InsightCloudSec requires Redis 7.1. Before proceeding with the upgrade, ensure your AWS Terraform version is 4.67 or higher. If your primary variables.tf file contains redis_custom_version and redis_custom_pg, set the following values in your .tfvars file:

text
1
redis_custom_version = "7.1"
2
redis_custom_pg = "default.redis7"

The Redis engine upgrade process takes approximately 20 minutes. Scaling down InsightCloudSec tasks during the upgrade is not required, but you may see sporadic connectivity issues during the process.

If you do not see redis_custom_version and redis_custom_pg defined in your primary variables.tf file, contact support for assistance before upgrading to InsightCloudSec version 24.9.3 or later.

Steps to Upgrade

InsightCloudSec recommends running the upgrade procedure in a non-production environment for testing before upgrading your production environment.

Product name to be replaced

You may observe that some components, screen captures, or examples use our former product name, DivvyCloud. This doesn't affect the configuration or the product's functionality, and we will notify you as we replace these component names.

Create RDS Snapshot

  1. From the RDS Console, take a snapshot of your RDS instance.
  2. Confirm the snapshot has a green Available status.

(Optional) Fetch latest Terraform modules

  1. In your Terraform folder, run the following command:
shell
1
terraform init -upgrade

Check for Environment Consistency

  1. Run a plan to check if there are any environment inconsistencies and if there are any changes proposed from the latest InsightCloudSec Terraform modules, ensuring you replace VAR-FILE in the example below with the name of your tfvars file.
shell
1
terraform plan -var-file=VAR-FILE.tfvars
  1. Review the output from this plan for any changes.
    • Watch for changes made outside of Terraform that Terraform is trying to revert.
    • If you do not understand what the changes are being made at this step reach out to us through the Customer Support Portal.
  2. If there are pending changes to bring the environment consistent, apply them, ensuring again that you replace VAR-FILE in the example below with the name of your tfvars file.
shell
1
terraform apply -var-file=VAR-FILE.tfvars

Set new InsightCloudSec version

  1. Modify your tfvars file to update the InsightCloudSec version
VAR-FILE.tfvars
1
// InsightCloudSec container/version to deploy
2
divvycloud_version = "divvycloud/divvycloud:v21.5.2"
  1. Run a Terraform plan and confirm that Terraform is only asking to change 4 (or optionally 5 if using Access Explorer resources.
shell
1
terraform apply -var-file=VAR-FILE.tfvars
  1. Answer with yes to apply the version change.

Validation

Open up CloudWatch and browse to the log group for your environment. It will most likely be the name DivvyCloud-Logs without /aws/ in the name. Verify the scheduler shows as Completed DB upgrade.