Install the Hub

Cloud Certainty Hub is one CloudFormation stack in your own AWS account. You install it once per Region, sign in, and from then on subscribe to, install and update Cloud Certainty products from it. This page tells you what you need and which guide to follow; each guide then takes you from nothing to signed in, one step at a time.

The Hub is free. AWS bills you for the small serverless services it runs in your account: AWS Lambda, Amazon API Gateway, Amazon DynamoDB (on demand), AWS Amplify Hosting, Amazon Cognito, and a little Amazon S3 and CloudWatch Logs.

#Before you begin

You need:

• An AWS account, signed in as an administrator. The stack creates IAM roles with fixed names, Lambda functions, an S3 bucket, a DynamoDB table, a Cognito user pool, an API Gateway HTTP API, an Amplify Hosting app and CloudWatch log groups. An administrator of the account has every permission this needs.
• The email address of the first Hub administrator. It is the one value the stack always asks for, and that person always stays an administrator.
• A decision on how people sign in, below. It decides which guide you follow.

You don't need a VPC (the Hub is serverless), and you don't need any IAM Identity Center permissions: when the stack sets up IAM Identity Center, it does so with a role of its own.

#Choose how people sign in

Not sure? Start with Cognito users: it is one step, and you can change the sign-in method later with a stack update.

Each guide uses the CloudFormation console. To install from a pipeline instead, see install with the AWS CLI or Terraform: the same template, the same parameters.

#Choose a Region

Install the Hub in the Region where you want to run Cloud Certainty products. The Hub lists and installs the product stacks of its own Region only, and its VPC and subnet pickers show that Region's networks. To manage products in a second Region, install a second Hub there.

The template is the same for every Region: CloudFormation reads it from Cloud Certainty's release bucket in us-east-1, wherever you create the stack. IAM Identity Center can be in any Region; the Hub finds it wherever it is.

#Which release the guides install

The guides install 0.1.0-rc.14, the latest release, from its template:

https://cloudcertainty-hub-us-east-1.s3.us-east-1.amazonaws.com/0.1.0-rc.14/main.yaml

Every release is an immutable template at https://cloudcertainty-hub-us-east-1.s3.us-east-1.amazonaws.com/<version>/main.yaml, and the newest is announced in latest.json:

curl -s https://cloudcertainty-hub-us-east-1.s3.us-east-1.amazonaws.com/latest.json

What changed in each release is on the release notes page. Once installed, the Hub tells you about new releases and can update itself.

#After you install

• Add administrators. Only administrators can use the Hub. Add them in the Hub's Settings, by email or by group, or (with IAM Identity Center) add them to the CloudCertaintyHubAdmins group.
• Set shared defaults in Settings: values such as your VPC, subnets and tags, which fill every product's install form.
• Confirm update reminders. AWS sends a confirmation email to the reminder address; accept it to hear about new Hub releases. See update reminders.
• Install a product. See installing and updating products.