Install with the AWS CLI or Terraform

The same template and parameters as the console guides, for scripts and pipelines. Choose the sign-in method first (install the Hub compares them): for IAM Identity Center and SAML you still create the SAML application by hand between the two runs.

With the AWS CLI

Create the stack

Every install needs the template URL, the two IAM capabilities and at least the first administrator's email. This installs the Hub in eu-west-2 with Cognito users; change the Region and the values to yours:

bash

aws cloudformation create-stack \
  --region eu-west-2 \
  --stack-name cloudcertainty-hub \
  --template-url https://cloudcertainty-hub-us-east-1.s3.us-east-1.amazonaws.com/0.1.0-rc.14/main.yaml \
  --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM \
  --parameters \
    ParameterKey=IdentityProvider,ParameterValue=CognitoOnly \
    ParameterKey=BootstrapAdminEmail,ParameterValue=admin@example.com

For other sign-in methods, change the parameters:

Sign-in	Parameters on the first run
Cognito users	`IdentityProvider=CognitoOnly`, `BootstrapAdminEmail`
IAM Identity Center	`IdentityProvider=IAMIdentityCenter`, `BootstrapAdminEmail`, optionally `IdentityCenterSetup` and `IdentityCenterRegion`
SAML	`IdentityProvider=SAML`, `BootstrapAdminEmail`
OIDC	`IdentityProvider=OIDC`, `BootstrapAdminEmail`, `OidcIssuer`, `OidcClientId`, `OidcClientSecretArn`, optionally `OidcEmailVerifiedClaim`

With more parameters, a file is easier to keep. Every parameter you leave out takes its default:

json

[
  { "ParameterKey": "BootstrapAdminEmail", "ParameterValue": "admin@example.com" },
  { "ParameterKey": "IdentityProvider", "ParameterValue": "IAMIdentityCenter" },
  { "ParameterKey": "IdentityCenterSetup", "ParameterValue": "CreateIfMissing" },
  { "ParameterKey": "DeployMode", "ParameterValue": "Full" },
  { "ParameterKey": "TagOwner", "ParameterValue": "platform-team" }
]

bash

aws cloudformation create-stack \
  --region eu-west-2 \
  --stack-name cloudcertainty-hub \
  --template-url https://cloudcertainty-hub-us-east-1.s3.us-east-1.amazonaws.com/0.1.0-rc.14/main.yaml \
  --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM \
  --parameters file://hub-parameters.json

The configuration reference lists every parameter.

Wait and read the outputs

bash

aws cloudformation wait stack-create-complete \
  --region eu-west-2 --stack-name cloudcertainty-hub

aws cloudformation describe-stacks \
  --region eu-west-2 --stack-name cloudcertainty-hub \
  --query "Stacks[0].Outputs[].[OutputKey,OutputValue]" --output table

PortalUrl is the Hub's address. If the wait ends with an error, the stack's events say why:

bash

aws cloudformation describe-stack-events \
  --region eu-west-2 --stack-name cloudcertainty-hub \
  --query "StackEvents[?ResourceStatus=='CREATE_FAILED'].[LogicalResourceId,ResourceStatusReason]" \
  --output table

Second run, for IAM Identity Center and SAML

Create the SAML application with the SamlAcsUrl and SamlAudienceUri outputs, as in IAM Identity Center or SAML, then set its metadata URL and keep every other parameter:

bash

KEEP=$(aws cloudformation describe-stacks \
  --region eu-west-2 --stack-name cloudcertainty-hub \
  --query "Stacks[0].Parameters[?ParameterKey!='SamlMetadataUrl'].ParameterKey" --output text \
  | tr '\t' '\n' | sed 's/.*/ParameterKey=&,UsePreviousValue=true/')

aws cloudformation update-stack \
  --region eu-west-2 --stack-name cloudcertainty-hub \
  --use-previous-template \
  --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM \
  --parameters ParameterKey=SamlMetadataUrl,ParameterValue=<metadata URL> $KEEP

aws cloudformation wait stack-update-complete \
  --region eu-west-2 --stack-name cloudcertainty-hub

With Terraform

The Hub's Terraform module deploys the same template as an aws_cloudformation_stack resource and checks your inputs at plan time. It needs Terraform 1.5 or later and the AWS provider 6.x, and it installs the Hub in the provider's Region:

hcl

provider "aws" {
  region = "eu-west-2"
}

module "hub" {
  source  = "cloudcertainty/cloudcertainty-hub/aws"
  version = "0.1.0-rc.14"

  hub_version           = "0.1.0-rc.14"
  identity_provider     = "CognitoOnly"
  bootstrap_admin_email = "admin@example.com"

  tags = {
    Owner       = "platform-team"
    Environment = "prod"
  }
}

output "hub_url" {
  value = module.hub.portal_url
}

Then terraform init and terraform apply. The hub_url output is the Hub's address.

Versions. The module is on the Terraform Registry (opens in a new tab), and its version tracks the Hub release it deploys. Terraform only selects a pre-release such as 0.1.0-rc.14 when version names it exactly. Keep version and hub_version on the same release.
Inputs. Each input is a template parameter in snake case (identity_provider is IdentityProvider); the configuration reference lists them all. The Owner, CostCenter and Environment keys of tags also fill the template's tag parameters.
IAM Identity Center and SAML: apply twice. First without saml_metadata_url; then create the SAML application with the module's saml_acs_url and saml_audience_uri outputs, set saml_metadata_url to its metadata URL, and apply again.
OIDC: set oidc_issuer, oidc_client_id and oidc_client_secret_arn (and oidc_email_verified_claim for Microsoft Entra ID) on the first apply. See install with OIDC for the client and the secret.
Updates. The module tags the stack cloudcertainty:managed-by = terraform. The Hub reads that tag and never updates itself, so your state does not drift: update by changing version and hub_version and applying.
Stack name. cloudcertainty-hub unless you set stack_name, which must not start with stack_name_prefix (cc- by default).

Without the module, the same stack is one resource. Keep the tag, so the Hub leaves its updates to Terraform:

hcl

resource "aws_cloudformation_stack" "hub" {
  name         = "cloudcertainty-hub"
  template_url = "https://cloudcertainty-hub-us-east-1.s3.us-east-1.amazonaws.com/0.1.0-rc.14/main.yaml"
  capabilities = ["CAPABILITY_IAM", "CAPABILITY_NAMED_IAM"]

  parameters = {
    BootstrapAdminEmail = "admin@example.com"
    IdentityProvider    = "CognitoOnly"
  }

  tags = {
    "cloudcertainty:managed-by" = "terraform"
  }
}

Open PortalUrl and follow the sign-in step of your method's guide: Cognito users, IAM Identity Center, SAML or OIDC.

#With the AWS CLI

#Create the stack

#Wait and read the outputs

#Second run, for IAM Identity Center and SAML

#With Terraform

#Then sign in

Tell us what you have. We'll make it better and cheaper.

With the AWS CLI

Create the stack

Wait and read the outputs

Second run, for IAM Identity Center and SAML

With Terraform

Then sign in