Install with Cognito users

The quickest install: one step. People sign in to the Hub with users in the Hub's own Amazon Cognito user pool, with a password and an authenticator app. The stack creates the first administrator for you and emails a temporary password.

Watch it first (1:14, with captions), then follow the steps below.

#Step 1: Open the quick-create page

Sign in to the AWS Management Console as an administrator of the account you install the Hub in, then choose Launch stack:

Launch stack (opens the AWS CloudFormation console in a new tab)

It opens CloudFormation's Quick create stack page with the template of 0.1.0-rc.14, the stack name cloudcertainty-hub and Identity provider CognitoOnly filled in.

Check the Region in the console's top bar, and change it to the Region you chose before you go on.

#Step 2: Fill in the parameters

1. Stack name: keep cloudcertainty-hub. Whatever you choose, it must not start with cc-, the prefix of the product stacks the Hub manages.
2. Under Identity:
   • Identity provider: CognitoOnly (already selected).
   • First administrator email: your email address. The stack creates your user with it.
   • Leave SAML metadata URL and the four OIDC fields empty.
3. Under IAM Identity Center, keep Set up IAM Identity Center at CreateIfMissing if you want the Hub to manage IAM Identity Center users and groups later, or choose Disabled to leave IAM Identity Center alone. Your Hub sign-in does not depend on it.
4. Keep the defaults for everything else. The configuration reference explains each one. Leave Advanced (support use only) empty.

#Step 3: Create the stack

1. At the bottom of the page, select I acknowledge that AWS CloudFormation might create IAM resources with custom names.
2. Choose Create stack.
3. Wait for the status to change from CREATE_IN_PROGRESS to CREATE_COMPLETE. It takes a few minutes. If it ends in ROLLBACK_COMPLETE instead, the Events tab says why.
4. Open the Outputs tab. PortalUrl is the address of your Hub, on amplifyapp.com. Bookmark it.

#Step 4: Sign in for the first time

1. Find the email with the subject Your Cloud Certainty Hub account, from no-reply@verificationemail.com. It has your user name (your email address) and a temporary password, valid for 3 days. If it is not in your inbox, look in your spam folder.
2. Open the PortalUrl address and sign in with your email address and the temporary password.
3. Set a new password: at least 14 characters, with upper and lower case letters, a number and a symbol.
4. Set up multi-factor authentication: scan the QR code with an authenticator app, such as Google Authenticator, Microsoft Authenticator or 1Password, and enter the code it shows. It is required for every Cognito user of the Hub.

The Hub opens on its Products page. You are the first Hub administrator.

If the temporary password has expired, delete your user in the Cognito console and create it again as in step 5.

#Step 5: Add more people

The Hub's users are in the Cognito user pool cc-hub-users (<NamePrefix>-users). Nobody can sign up on their own:

1. In the Amazon Cognito console, in the Hub's Region, open User pools, then cc-hub-users.
2. Choose Users, then Create user. Choose Send an email invitation, enter the person's email address, and choose Generate a password. They receive the same email as you did.
3. In the Hub, open Settings and add their email under Administrator emails. Only administrators can use the Hub.

#Prefer the command line?

The same install with the AWS CLI. Change the Region and the email to yours:

aws cloudformation create-stack \
  --region eu-west-2 \
  --stack-name cloudcertainty-hub \
  --template-url https://cloudcertainty-hub-us-east-1.s3.us-east-1.amazonaws.com/0.1.0-rc.14/main.yaml \
  --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM \
  --parameters \
    ParameterKey=IdentityProvider,ParameterValue=CognitoOnly \
    ParameterKey=BootstrapAdminEmail,ParameterValue=admin@example.com

With Terraform, set identity_provider = "CognitoOnly" in the module. See install with the AWS CLI or Terraform.

#Next

• Install a product.
• To move to IAM Identity Center or SAML later, update the stack with the new Identity provider and the SAML metadata URL empty, then follow that guide from step 4.