Installing and updating products

The Hub installs each Cloud Certainty product as its own CloudFormation stack in the Hub's Region, from the product's latest release. You fill in a form; the Hub turns it into a change set, and you review it before anything changes. If your team deploys through its own pipeline, the Hub writes the same install as Terraform or CloudFormation instead.

Only Hub administrators can use these pages.

#The Products page

The Products page lists every product in Cloud Certainty's catalogue, which the Hub reads when it needs it, so new products and releases appear without updating the Hub. For each product it shows:

• The AWS Marketplace subscription: whether this account has an active agreement for the product, no subscription, or the product is not listed on AWS Marketplace yet. The Hub reads your account's agreements; a change can take up to ten minutes to show.
• The latest release and its date, marked when it is a security release.
• Installations: every stack of the product in this Region, with its status, its version and who manages it. A product with an update shows Update to and the new version.

Desktop apps, such as Config Explorer and CostLike, have a download link instead.

#Subscribe on AWS Marketplace

For a product you are not subscribed to, Subscribe opens its listing on AWS Marketplace in a new tab. Subscribe there with an identity that may subscribe in this account, then come back to the Hub. A product that is not listed on AWS Marketplace yet can still be installed; whether it runs without a subscription is up to the product.

#Shared defaults

Values you set once in the Hub's Settings under Shared defaults fill in every product's install form wherever a parameter has the same name: for example your VPC, subnets, tags or identity provider settings. The products' NamePrefix always keeps its own default. Defaults never change a stack that is already installed.

#Install a product

1. On the Products page, choose Install for the product.
2. Enter the Stack name. It must start with the Hub's product stack prefix (cc- by default), because the Hub only manages stacks whose names start with it.
3. Fill in the form. It is built from the product's template: the same groups and labels as in the CloudFormation console, VPC and subnet pickers for this Region (subnets filtered by the VPC you chose), lists of allowed values, and password fields for secret parameters. Values come from the template defaults and your shared defaults.
4. Choose Review changes. The Hub creates a CloudFormation change set and shows every resource it will add, with the capabilities the template needs. Nothing has changed yet.
5. Choose Execute to run it, or Discard. The stack's page then refreshes every few seconds until CloudFormation finishes.

The Hub tags the stack cloudcertainty:managed-by=hub, cloudcertainty:product=<product> and cloudcertainty:hub=<Hub stack name>, and runs it with its deployer role.

#Products that are already installed

The Hub finds a product's stacks by their description, so it also lists stacks installed before the Hub, or without it. Each installation shows who manages it:

When a product is already installed, its card leads with Manage. Install another opens the form with a warning: a new install creates a second, separate copy with its own users and data.

#Update a product

When a newer release exists, the product's stack page offers Update to and the new version. Update / change settings opens the same form for a change without a new release.

The form starts from the stack's current values. Secret values are never shown: they are kept as they are unless you choose to set a new one. Parameters that are new in the release take their defaults. Review changes creates an update change set; check which resources change, and whether any is replaced, before you choose Execute.

The Hub updates only stacks it manages. For a Terraform-managed stack, set the new release in your Terraform configuration and apply; the Hub can export a fresh Terraform resource with the new template URL and parameters.

#Export as Terraform or CloudFormation

Every install and update form has two export buttons next to Review changes:

• Terraform writes an aws_cloudformation_stack resource with the template URL, the capabilities, the parameters that differ from the template defaults, and the tag cloudcertainty:managed-by = "terraform". Add it to your configuration and run terraform apply. The Hub then shows the stack as managed by Terraform.
• CloudFormation writes a parameters file, the aws cloudformation create-stack command that uses it, and an Open in AWS console link to the quick-create page. The command tags the stack cloudcertainty:managed-by=cloudformation, so the Hub shows it as external.

Secret values are never written into an export: the Terraform file declares a sensitive variable for each, the parameters file has a placeholder, and the console link leaves them empty.

#Export only mode

With the Hub's DeployMode parameter set to ExportOnly, the Hub has no deployer role. It cannot create, update or delete stacks: the forms only export, and you run the result with your own credentials. Everything else works as in Full mode: the catalogue, subscriptions, installations, update badges and IAM Identity Center.

To switch modes, update the Hub's stack with the other DeployMode.

#Delete a product stack

On the stack page of a stack the Hub manages, Delete asks you to type the stack name, then deletes the stack with the deployer role. Stacks managed by Terraform or installed another way are never deleted by the Hub.