Configuration reference

Every parameter of the Hub's template, grouped as the CloudFormation console shows them, with its default, what it does, and the matching input of the Terraform module. Most installs set only BootstrapAdminEmail and IdentityProvider and keep every other default.

Parameters keep their meaning in every release, and new ones always come with a safe default, so an update can keep all your current values.

Change a parameter later

Update the stack with the new value and keep every other parameter. In the CloudFormation console, select the Hub's stack, choose Update, keep the current template and change the value. With the AWS CLI, list the parameter you change with its new value and every other one with UsePreviousValue=true; this changes LogRetentionDays and keeps the rest:

bash

KEEP=$(aws cloudformation describe-stacks \
  --region eu-west-2 --stack-name cloudcertainty-hub \
  --query "Stacks[0].Parameters[?ParameterKey!='LogRetentionDays'].ParameterKey" --output text \
  | tr '\t' '\n' | sed 's/.*/ParameterKey=&,UsePreviousValue=true/')

aws cloudformation update-stack \
  --region eu-west-2 --stack-name cloudcertainty-hub \
  --use-previous-template \
  --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM \
  --parameters ParameterKey=LogRetentionDays,ParameterValue=365 $KEEP

With Terraform, change the module input and apply. Don't change a Terraform-managed Hub with the console or the AWS CLI: your state would drift.

General

Parameter	Terraform	Default	What it does
`NamePrefix` (Name prefix)	`name_prefix`	`cc-hub`	Prefix of every resource the Hub creates for itself (`cc-hub-api`, `cc-hub-table` and so on). 2 to 20 lowercase letters, digits and hyphens, starting with a letter. Must be unique per account and Region, and must not contain `aws`, `amazon` or `cognito`, because it is part of the Cognito domain.
`TagOwner` (Owner tag)	`tags["Owner"]`	`platform-team`	Value of the `Owner` tag on every taggable resource.
`TagCostCenter` (Cost center tag)	`tags["CostCenter"]`	`none`	Value of the `CostCenter` tag on every taggable resource.
`TagEnvironment` (Environment tag)	`tags["Environment"]`	`prod`	Value of the `Environment` tag on every taggable resource.

With Terraform, tags is applied to the stack and so to its resources; its Owner, CostCenter and Environment keys also fill the three tag parameters.

Identity

Parameter	Terraform	Default	What it does
`IdentityProvider` (Identity provider)	`identity_provider`	`IAMIdentityCenter`	How people sign in to the Hub: `IAMIdentityCenter`, `SAML`, `OIDC` or `CognitoOnly`. `IAMIdentityCenter` and `SAML` need two steps: create the stack, create the SAML application with the stack outputs, then update the stack with the metadata URL. `CognitoOnly` uses Cognito users, with multi-factor authentication required. See first sign-in.
`SamlMetadataUrl` (SAML metadata URL)	`saml_metadata_url`	empty	The SAML metadata URL from IAM Identity Center or your SAML identity provider. Leave it empty on the first deployment. Only used with `IAMIdentityCenter` and `SAML`; the stack refuses it with the others.
`OidcIssuer` (OIDC issuer URL)	`oidc_issuer`	empty	The OIDC issuer URL. Required with `OIDC`.
`OidcClientId` (OIDC client ID)	`oidc_client_id`	empty	The OIDC client ID. Required with `OIDC`.
`OidcClientSecretArn` (OIDC client secret)	`oidc_client_secret_arn`	empty	The ARN of a Secrets Manager secret whose value is the OIDC client secret. CloudFormation reads it when it deploys. Required with `OIDC`, because Amazon Cognito needs a confidential client.
`OidcEmailVerifiedClaim` (OIDC email-verified claim)	`oidc_email_verified_claim`	`email_verified`	The OIDC claim that says whether your identity provider verified the user's email. Users whose email is not verified are refused. Use `xms_edov` for Microsoft Entra ID.
`BootstrapAdminEmail` (First administrator email)	`bootstrap_admin_email`	none: required	The first Hub administrator. This email is always an administrator; add others in the Hub's Settings. With `CognitoOnly` the stack creates the user, who receives a temporary password by email.

IAM Identity Center

Parameter	Terraform	Default	What it does
`IdentityCenterSetup` (Set up IAM Identity Center)	`identity_center_setup`	`CreateIfMissing`	`CreateIfMissing`: use this account's IAM Identity Center, or create one (an account instance) when there is none. `UseExisting`: use it, and fail when there is none. When the account owns it, the stack also creates the group `CloudCertaintyHubAdmins` (its members are Hub administrators) with a user for `BootstrapAdminEmail`. `Disabled`: leave IAM Identity Center alone. The stack never deletes IAM Identity Center, its users or its groups.
`IdentityCenterRegion` (Region for a new IAM Identity Center)	`identity_center_region`	empty	The Region to create IAM Identity Center in when there is none. Empty uses the stack's Region. An existing IAM Identity Center is found in any Region.

IAM Identity Center explains each case, including AWS Organizations.

Installing products

Parameter	Terraform	Default	What it does
`DeployMode` (How products are installed)	`deploy_mode`	`Full`	`Full`: the Hub creates, updates and deletes product stacks itself, with a CloudFormation service role (the deployer role) whose permissions cover what the products create. Hub administrators can then change those resources, so treat them as AWS administrators. `ExportOnly`: no deployer role is created, and the Hub only exports Terraform and CloudFormation for you to run with your own credentials.
`StackNamePrefix` (Product stack name prefix)	`stack_name_prefix`	`cc-`	The Hub only creates, updates and deletes stacks whose names start with this prefix, and IAM enforces it too. 1 to 20 letters, digits and hyphens, starting with a letter. The Hub never changes its own stack this way, so don't start the Hub's stack name with it.
`CatalogueUrl` (Product catalogue URL)	`catalogue_url`	`https://cloudcertainty-hub-us-east-1.s3.us-east-1.amazonaws.com/catalog.json`	The public Cloud Certainty product catalogue. Leave the default. In Terraform, leave it `null` for the default.

Hub updates

Parameter	Terraform	Default	What it does
`UpdateReminders` (Update reminders)	`update_reminders`	`Enabled`	`Enabled`: when a newer Hub release exists, the Hub emails the reminder address, then reminds it 1, 3, 7 and 30 days later and every 30 days after that until the Hub is updated. The messages go through the SNS topic in the `UpdateTopicArn` output. `Disabled`: no emails, and no topic or schedule is created; the Hub's About page still shows the update.
`UpdateNotificationEmail` (Update reminder email)	`update_notification_email`	empty	The address for update reminders. Empty uses `BootstrapAdminEmail`. AWS sends a confirmation email that must be accepted first.

See update reminders. These two parameters, their Terraform inputs and the UpdateTopicArn output exist from Hub 0.1.0-rc.11.

Logging and encryption

Parameter	Terraform	Default	What it does
`LogRetentionDays` (Log retention)	`log_retention_days`	`90`	Retention in days of the Hub's own CloudWatch log groups, including the audit log. One of the values CloudWatch Logs allows, from 1 to 3653.
`KmsKeyArn` (KMS key ARN)	`kms_key_arn`	empty	An optional customer managed KMS key for DynamoDB, CloudWatch Logs and the Hub's private artifacts bucket (and the update reminder topic). The key policy must allow `logs.<region>.amazonaws.com` to use it, and IAM policies to grant its use. A key ARN, not an alias. Empty uses AWS owned keys and SSE-S3.

Advanced (support use only)

Parameter	Terraform	Default	What it does
`ArtifactVersionOverride` (Artifact version override)	`artifact_version_override`	empty	Leave it empty. Set it only when Cloud Certainty support asks you to.

Terraform module inputs

These inputs of the Terraform module are not template parameters:

Input	Default	What it does
`hub_version`	the module's own release (`0.1.0-rc.12` for module `0.1.0-rc.12`)	The Hub release to deploy. Set it to the same release as the module's `version`; changing both and applying is how a Terraform install is updated.
`template_url`	`null`	Overrides the template URL built from `hub_version`. Leave it `null`.
`stack_name`	`cloudcertainty-hub`	The name of the Hub's stack. It must not start with `stack_name_prefix`.
`tags`	`{}`	Tags for the stack and its resources (see General). The module adds `cloudcertainty:managed-by = terraform`, which stops the Hub updating itself.
`cloudformation_role_arn`	`null`	An optional CloudFormation service role to deploy the Hub's stack with.
`timeout`	`60m`	The create, update and delete timeout of the stack.

The module checks at plan time what the template checks at deploy time: OIDC needs the three OIDC inputs, and saml_metadata_url is only for IAMIdentityCenter and SAML.

Stack outputs

Output	Terraform output	What it is
`PortalUrl`	`portal_url`	The address of the Hub.
`ProductVersion`		The Hub release the stack runs.
`UpdateTopicArn`	`update_topic_arn`	The SNS topic of the update reminders. Only with `UpdateReminders` set to `Enabled`, from 0.1.0-rc.11.
`SamlAcsUrl`	`saml_acs_url`	The Assertion Consumer Service (ACS) URL for your IAM Identity Center or SAML application.
`SamlAudienceUri`	`saml_audience_uri`	The SAML audience (entity ID) for that application.
`CognitoDomain`	`cognito_domain`	The Cognito managed login domain. With OIDC, the redirect URI is this domain followed by `/oauth2/idpresponse`.
`ApiUrl`		The base URL of the Hub's HTTP API.
`UserPoolId`		The ID of the Hub's Cognito user pool.
`UserPoolClientId`		The ID of the Cognito app client the Hub's web app uses.
`DeployerRoleArn`	`deployer_role_arn`	The CloudFormation service role the Hub runs product stacks with. Only in `Full` mode.
`IdentityCenterStatus`		What the IAM Identity Center setup did, or why it could not. Not with `IdentityCenterSetup` set to `Disabled`, like the four below.
`IdentityCenterInstanceArn`	`identity_center_instance_arn`	The IAM Identity Center instance the Hub uses.
`IdentityCenterRegion`	`identity_center_region`	The Region of IAM Identity Center: create the Hub's SAML application there.
`IdentityCenterPortalUrl`	`identity_center_portal_url`	The AWS access portal URL of IAM Identity Center.
`IdentityCenterAdminGroupId`	`identity_center_admin_group_id`	The ID of the `CloudCertaintyHubAdmins` group. Empty when IAM Identity Center belongs to your organisation.
`TableName`		The Hub's DynamoDB table, which is kept when the stack is deleted.

The module also has a stack_id output, the ID of the Hub's stack.

#Change a parameter later

#General

#Identity

#IAM Identity Center

#Installing products

#Hub updates

#Logging and encryption

#Advanced (support use only)

#Terraform module inputs

#Stack outputs

Tell us what you have. We'll make it better and cheaper.