Every product, from one place in your account.
Cloud Certainty Hub is one place in your AWS account to see every Cloud Certainty product, subscribe to it on AWS Marketplace, and install it by filling in a form instead of uploading templates. Update it when a new release is out, or export the same install as Terraform or CloudFormation for your own pipeline.
It also sets up IAM Identity Center for you and can sign your users in to every product it installs. The Hub is free, and it runs entirely in your account.
FREE · ONE CLOUDFORMATION STACK · YOUR ACCOUNT · CLOUDFORMATION OR TERRAFORM · LATEST 0.1.0-rc.12
[ A ] WHAT THE HUB DOES
See every product
Every Cloud Certainty product, whether your account is subscribed on AWS Marketplace, the latest release, and the stacks already installed in this Region, including those installed without the Hub.
Subscribe
A Subscribe button opens the product on AWS Marketplace. The Hub reads your account’s AWS Marketplace agreements and shows which products you are subscribed to.
Install with a form
The Hub reads the product’s latest template and shows its parameters as a form, with VPC and subnet pickers and your shared defaults filled in. No template to download or upload.
Review, then run
Every install or update is a CloudFormation change set. You see each resource that will change before you choose Execute.
Update
When a product has a newer release, the Hub says so and updates the stack, keeping your current parameter values.
Export instead
The same install as a Terraform resource or as a CloudFormation parameters file, AWS CLI command and console link, for teams that deploy through their own pipeline.
IAM Identity Center
The Hub finds IAM Identity Center in any Region or creates it, adds a CloudCertaintyHubAdmins group, and lets you add users and groups. It never deletes them.
Sign in through the Hub
Install a product with sign-in through the Hub, and your users get single sign-on across every product installed that way. The other sign-in options keep working.
The Hub updates itself too: its About page shows the latest release; review the change set, choose Update the Hub, and the page reloads on the new version. See updating the Hub.
[ B ] INSTALL IT YOUR WAY
One CloudFormation stack, the same template whichever way you choose. You need an AWS account where you can create IAM roles, and the email address of the first administrator.
CloudFormation console
Open the quick-create page with the template of the latest release filled in, enter the first administrator's email and create the stack.
Launch stack →(opens the AWS CloudFormation console in a new tab) Step by step →AWS CLI
aws cloudformation create-stack \
--stack-name cloudcertainty-hub \
--template-url https://cloudcertainty-hub-us-east-1.s3.us-east-1.amazonaws.com/0.1.0-rc.12/main.yaml \
--capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM \
--parameters ParameterKey=BootstrapAdminEmail,ParameterValue=admin@example.comTerraform
The Hub's Terraform module wraps the same template and checks your inputs at plan time. Set hub_version and bootstrap_admin_email, and apply. The Hub then leaves
its own updates to Terraform, so your state never drifts.
[ C ] FREE, AND IT RUNS IN YOUR ACCOUNT
What it costs
The Hub is free. You pay AWS only for the small serverless services it runs in your account:
- AWS Lambda for the API and a few small helper functions
- Amazon API Gateway (an HTTP API)
- Amazon DynamoDB, on demand, for settings and the audit log
- AWS Amplify Hosting for the web app
- Amazon Cognito for sign-in
- Amazon S3 for the Hub’s own code, and CloudWatch Logs
- Amazon SNS and an EventBridge schedule, when update reminders are on
The products you install are billed separately, as each product's page explains.
What stays in your account
Everything. The Hub reads only Cloud Certainty's public product catalogue, each product's public release manifest and templates, and AWS APIs in your own account. Its settings and audit log are in a DynamoDB table in your account, and nothing is sent to Cloud Certainty.
It lists and manages the product stacks of the Region it runs in. Sign-in works with IAM Identity Center, SAML, OIDC or Amazon Cognito users, the same options as every product.
Only its own stacks
The Hub changes only product stacks whose names start with its prefix (cc- by default) and that it manages. IAM enforces the prefix too.
Templates from Cloud Certainty only
It installs each product’s latest release from Cloud Certainty’s public release buckets, and updates itself only with a template from the Hub’s release bucket.
Never deletes itself
The Hub may update its own stack through a role limited to its own resources. Deleting the Hub is always your decision.
Export only, if you prefer
In export only mode the Hub has no deployer role and cannot install, update or delete products: it writes Terraform or CloudFormation, and you run it.
The security model lists every role the Hub creates and what each may do.
[ D ] WHAT YOU CAN INSTALL WITH IT
The Hub reads Cloud Certainty's product catalogue, so new products and releases appear without updating the Hub. Self-hosted products install as a stack in your account; desktop apps link to their download.
- Secure Browser Self-hosted Zero-trust browser isolation in your AWS account.
- BucketDeck Self-hosted A web portal for Amazon S3 in your AWS account.
- FunctionPilot Self-hosted A better AWS Lambda console in your AWS account.
- SQLark Self-hosted A better Amazon Athena console, with dashboards, in your AWS account.
- TraceHound Self-hosted A better Amazon CloudWatch Logs console in your AWS account.
- Watchtower Self-hosted A better AWS Security Hub console in your AWS account.
- StateCraft Self-hosted A better AWS Step Functions console, with a voice designer, in your AWS account.
- Memora Self-hosted The console for Amazon ElastiCache, with a key browser, in your AWS account.
- Config Explorer Desktop app See your AWS resources and how they connect (Windows desktop app).
- CostLike Desktop app Desktop app for your whole cloud bill. (opens in a new tab)
Amazon Web Services, AWS, AWS Marketplace and AWS IAM Identity Center are trademarks of Amazon.com, Inc. or its affiliates. Cloud Certainty Hub is a product of Cloud Certainty OÜ and is not affiliated with or endorsed by Amazon.