Getting started

This guide is for the administrator or platform team who sets up BucketDeck. You subscribe on AWS Marketplace, launch one CloudFormation stack in your own AWS account, sign in, connect a bucket and invite your users. The installation guide has every detail; this page is the short path.

#What you need

• The AWS account that will run BucketDeck. Subscribe from this account: AWS Marketplace delivers the licence to it through AWS License Manager.
• A supported Region: any Region with AWS Lambda, Step Functions (Distributed Map), Amplify Hosting, Amazon Cognito, AWS License Manager and Amazon ECS on Fargate. The Region of the stack doesn't limit which Regions' buckets you can browse.
• Permission to create the stack's resources, including IAM roles with custom names.
• A VPC with at least one subnet that has outbound HTTPS access, for example through a NAT gateway. Only a one-off installer task runs there, for about a minute at install and at each upgrade.
• The email address of your first administrator.

#1. Subscribe on AWS Marketplace

BucketDeck is sold as two AWS Marketplace products, both with monthly or 12-month contracts:

On the BucketDeck listing, Team is the base plan and Business and Enterprise are add-ons: for Business choose Team and the Business add-on; for Enterprise choose all three. An add-on bought on its own grants nothing. See the FAQ for prices and what each plan includes.

1. Sign in to the AWS console with the account that will run BucketDeck, as an identity that may subscribe to AWS Marketplace products.
2. Open BucketDeck on AWS Marketplace (opens in a new tab), choose the product, then Continue to Subscribe. Choose the plan and the contract length, and accept the offer.
3. Choose Continue to Configuration, select the fulfilment option and the Region, and continue to the Launch page. Its usage instructions have a link that opens CloudFormation with the release's template already selected.

#2. Launch the stack

Open the launch link from the usage instructions. Check the Region in the console's top bar, then set these parameters (everything else can keep its default):

Acknowledge that AWS CloudFormation might create IAM resources with custom names and create the stack. Creation takes about 10 minutes. If you prefer the AWS CLI, the template URL has the form

https://cloudcertainty-bucketdeck-us-east-1.s3.us-east-1.amazonaws.com/<edition>/<version>/main.yaml

where <edition> is starter for BucketDeck Starter and pro for BucketDeck. The same URL works in every Region. The installation guide has the command.

#3. Sign in

• CognitoOnly: the bootstrap administrator receives an email with a temporary password. Every user must register an authenticator app (TOTP MFA is required).
• IAMIdentityCenter or SAML: create a SAML application in your identity provider with the SamlAcsUrl and SamlAudienceUri stack outputs, assign yourself to it, then update the stack and set SamlMetadataUrl to the application's metadata URL. Until then nobody can sign in.
• OIDC: set the OIDC parameters when you create the stack; there is no second step.

Open the PortalUrl stack output and sign in as the bootstrap administrator. That account is always an administrator. Grant the Admin role to a second person or group under Administration → Roles so you are never locked out.

#4. Connect a bucket

Buckets in the stack's own account are already there, through the built-in local connection. The stack parameters LocalBucketAccess and LocalAccessLevel decide which buckets it reaches and what it may do.

To reach another AWS account:

1. In Administration → Connections, choose Add connection → IAM role and enter a name, the account ID and its default Region.
2. Open Set up role. Deploy the spoke role in the other account with the quick-create link shown there; it creates one IAM role that only your BucketDeck stack can assume, with an external ID.
3. Paste the spoke stack's RoleArn output into the connection and choose Test.

For an AWS Organization, deploy the spoke role to every account at once with a StackSet. See Deploy the spoke role in other accounts.

Uploads from the browser need a CORS rule on the bucket: open the bucket's details and choose Enable browser uploads.

#5. Invite your users

1. Give people a way to sign in. With an identity provider, assign users or groups to the BucketDeck application there. With CognitoOnly, create users in the Cognito user pool and mark their email as verified.
2. Grant access. A new user sees nothing until a grant applies to them. In Administration → Grants, give a user (user:[email protected]), a group or everyone * permissions (read, write, delete, manage, share) on a connection and its buckets.
3. Send them the PortalUrl and the user guide.

Users can also browse with their own AWS permissions, as in the AWS console, if you turn on personal AWS access.

#Next steps

• Admin guide: roles, connections, grants, settings and the audit log.
• Security overview: for your security review.
• Upgrading: new releases, and moving from Starter to BucketDeck.