Getting started

This guide is for the administrator or platform team who sets up FunctionPilot. You subscribe on AWS Marketplace, launch one CloudFormation stack in your own AWS account, sign in, see your Lambda functions, connect your other accounts and give your team access. The installation guide has every detail; this page is the short path.

#What you need

• The AWS account that will run FunctionPilot (the hub). Subscribe from this account: AWS Marketplace delivers the licence to it through AWS License Manager.
• A supported Region: any Region with AWS Lambda, Amazon API Gateway, Amazon DynamoDB, Amplify Hosting, Amazon Cognito, AWS License Manager and Amazon ECS on Fargate. The Region of the stack doesn't limit which Regions' functions you can see.
• Permission to create the stack's resources, including IAM roles with custom names.
• A VPC with at least one subnet that has outbound HTTPS access, for example through a NAT gateway. Only a one-off installer task runs there, for about a minute at install and at each upgrade.
• The email address of your first administrator.

#1. Subscribe on AWS Marketplace

FunctionPilot is sold on AWS Marketplace with contract pricing, monthly or for 12 months. There are four plans: Starter, Team, Business and Enterprise. On the FunctionPilot listing, Team is the base plan and Business and Enterprise are add-ons: for Business choose Team and the Business add-on; for Enterprise choose all three. An add-on bought on its own grants nothing. See the FAQ for what each plan includes.

1. Sign in to the AWS console with the account that will run FunctionPilot, as an identity that may subscribe to AWS Marketplace products.
2. Open FunctionPilot on AWS Marketplace (opens in a new tab), choose Continue to Subscribe, choose the plan and the contract length, and accept the offer.
3. Choose Continue to Configuration, select the fulfilment option and the Region, and continue to the Launch page. Its usage instructions have a link that opens CloudFormation with the release's template already selected.

#2. Launch the stack

Open the launch link from the usage instructions, or this quick-create link with the release version filled in:

https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://cloudcertainty-functionpilot-us-east-1.s3.us-east-1.amazonaws.com/pro/<version>/main.yaml&stackName=functionpilot

Check the Region in the console's top bar, then set these parameters (everything else can keep its default):

Acknowledge that AWS CloudFormation might create IAM resources with custom names and create the stack. Creation takes about 10 minutes. The template URL is always in the vendor's public bucket in us-east-1, and the same URL works in every Region:

https://cloudcertainty-functionpilot-us-east-1.s3.us-east-1.amazonaws.com/pro/<version>/main.yaml

The installation guide has the AWS CLI command.

#3. Sign in

• CognitoOnly: the bootstrap administrator receives an email with a temporary password. Every user must register an authenticator app (TOTP MFA is required).
• IAMIdentityCenter or SAML: create a SAML application in your identity provider with the SamlAcsUrl and SamlAudienceUri stack outputs, assign yourself to it, then update the stack and set SamlMetadataUrl to the application's metadata URL. Until then nobody can sign in.
• OIDC: set the OIDC parameters when you create the stack; there is no second step.

Open the PortalUrl stack output and sign in as the bootstrap administrator. That account is always an administrator. Grant the Administrator role to a second person or group under Administration › Roles so you are never locked out.

#4. See your functions

The Functions page lists every function in the hub account's LocalRegions, through the built-in local connection, with invocations, errors, duration and more for the last 24 hours. Pick another timeframe at the top, sort by any column, and open a function to see its charts, configuration, tests and logs. The user guide explains every page.

Screenshot

#5. Add another AWS account

Each other account gets a small role that only your FunctionPilot stack can assume, with an external ID you choose.

1. In the other account, deploy the spoke role template. Its URL is the hub's SpokeTemplateUrl output. Set TrustedPrincipal to the hub's SpokeTrustedPrincipal output, choose an ExternalId of at least 16 characters, and an AccessLevel (ReadOnly by default).
2. In FunctionPilot, open Administration › Connections › Add connection. Enter an id, a name, the account ID, the same access level, the spoke stack's RoleArn output, the same external ID and the Regions to show.
3. Choose Test. FunctionPilot assumes the role and lists the functions in each Region.

For an AWS Organization, deploy the role to every account at once with a StackSet. See Deploy the spoke role in other accounts.

#6. Give your team access

1. Give people a way to sign in. With an identity provider, assign users or groups to the FunctionPilot application there. With CognitoOnly, create users in the Cognito user pool and mark their email as verified.
2. Grant access. A new user sees no functions until a grant applies to them. In Administration › Grants, give a user or a group permissions (view, logs, invoke, edit, manage) on function name patterns such as orders-*, on one connection or all, in some Regions or all. See Grants.
3. Send them the PortalUrl and the user guide.

On the Team plan and above, people can instead work with their own AWS permissions, through IAM Identity Center or their IAM user keys. See Personal AWS access.

#Next steps

• Admin guide: roles, connections, grants, settings, the audit log and your plan.
• Security overview: for your security review.
• Upgrading: installing new releases.