Getting started

This guide is for the administrator or platform team who sets up Cloud Certainty Memora, a console for Amazon ElastiCache (Valkey, Redis OSS and Memcached) that runs in your own AWS account. You subscribe on AWS Marketplace, launch one CloudFormation stack, sign in, look at your fleet, set up data access on a first cache and give your team access. The installation guide has every detail; this page is the short path, about 15 minutes plus the stack's creation time.

#What you need

• The AWS account that will run Memora (the hub). Subscribe from this account: AWS Marketplace delivers the licence to it through AWS License Manager.
• A supported Region: any Region with Amazon ElastiCache, AWS Lambda, Amazon API Gateway, Amazon DynamoDB, AWS Step Functions, Amplify Hosting, Amazon Cognito, AWS License Manager and Amazon ECS on Fargate. The Region of the stack doesn't limit which Regions you can work in.
• Permission to create the stack's resources, including IAM roles with custom names.
• A VPC with at least one subnet that has outbound HTTPS access, for example through a NAT gateway, for a one-off installer task that runs for about a minute at install and at each upgrade. If your caches are in the same VPC, the stack can also put Memora's connector there: two small Lambda functions that are the only part of Memora that talks to your caches.
• The email address of your first administrator.
• A decision on how much Memora may do with your caches in this account: only look and read data (Read), also change data and operate caches (Operate, the default), or also create, delete and reconfigure them (Full).

#1. Subscribe on AWS Marketplace

Memora is sold on AWS Marketplace with contract pricing, monthly or for 12 months. There are four plans: Starter, Team, Business and Enterprise. On the Memora listing, Team is the base plan and Business and Enterprise are add-ons: for Business choose Team and the Business add-on; for Enterprise choose all three. An add-on bought on its own grants nothing. Starter is a separate listing, Memora Starter. See the FAQ for what each plan includes.

1. Sign in to the AWS console with the account that will run Memora, as an identity that may subscribe to AWS Marketplace products.
2. Open Memora on AWS Marketplace (opens in a new tab), choose Continue to Subscribe, choose the plan and the contract length, and accept the offer.
3. Choose Continue to Configuration, select the fulfilment option and the Region, and continue to the Launch page. Its usage instructions have a link that opens CloudFormation with the release's template already selected.

#2. Launch the stack

Open the launch link from the usage instructions, or this quick-create link with the release version filled in:

https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://cloudcertainty-memora-us-east-1.s3.us-east-1.amazonaws.com/pro/<version>/main.yaml&stackName=memora

Check the Region in the console's top bar, then set these parameters (everything else can keep its default):

Acknowledge that AWS CloudFormation might create IAM resources with custom names and create the stack. Creation takes about 10 minutes. The template URL is always in the vendor's public bucket in us-east-1, and the same URL works in every Region:

https://cloudcertainty-memora-us-east-1.s3.us-east-1.amazonaws.com/pro/<version>/main.yaml

The installation guide has the AWS CLI command and every other parameter, including ConnectorAccountIds for connectors in other accounts and KmsKeyArn for your own encryption key.

#3. Sign in

• CognitoOnly: the bootstrap administrator receives an email with a temporary password. Every user must register an authenticator app (TOTP MFA is required).
• IAMIdentityCenter or SAML: create a SAML application in your identity provider with the SamlAcsUrl and SamlAudienceUri stack outputs, assign yourself to it, then update the stack and set SamlMetadataUrl to the application's metadata URL. Until then nobody can sign in.
• OIDC: set the OIDC parameters when you create the stack; there is no second step.

Open the PortalUrl stack output and sign in as the bootstrap administrator. That account is always an administrator. Grant the Administrator role to a second person or group under Administration › Roles so you are never locked out.

Screenshot

#4. Look at your fleet

The Fleet page opens with every cache of the local connection (the hub account) in the Regions you chose: replication groups, serverless caches and clusters, with their engine and version, size, memory, CPU, hit rate, operations per second, estimated monthly cost and findings. The tiles at the top add up the caches, nodes, estimated monthly cost, potential savings and high findings; select Potential savings to see every finding, for example Redis OSS caches paying for Extended Support or the saving of moving to Valkey.

Open a cache to see its Overview (the last 24 hours, findings, cost, data access, security and topology) and its other tabs. The user guide explains every page.

#5. Set up data access on a cache

The key browser, workbench, analysis and monitor reach your data through the connector. Each cache needs to know how Memora signs in to it:

• A cache without authentication (no AUTH token and no user group) works at once: open its Browser tab.
• A cache with a user group, Valkey 7.2 or later or Redis OSS 7.0 or later, and encryption in transit: open its Data access tab and choose Set up IAM data access. Memora creates the ElastiCache users memora-read and memora-write with IAM authentication and adds them to the cache's user group. There are no passwords at all. This needs LocalAccessLevel set to Full.
• Any other cache (an AUTH token, or users with passwords): store the credentials in two Secrets Manager secrets tagged memora:access = read and write, and enter their ARNs under Change data access on the same tab. The connector's subnets then need a route to Secrets Manager.

Choose Test connection on the Data access tab: it shows the engine, the user Memora signed in as and the nodes it reached. If the test can't connect, check that the cache's security group allows inbound TCP 6379 and 6380 from the ConnectorSecurityGroupId output. See Data access in the admin guide.

#6. Add other accounts and VPCs

• Another AWS account: deploy the spoke role template in that account (its URL is the hub's SpokeTemplateUrl output), with TrustedPrincipal set to the hub's SpokeTrustedPrincipal output (copy the whole value), an ExternalId of at least 16 characters and an AccessLevel. Then open Administration › Connections › Add connection, enter the account, the same access level, the spoke stack's RoleArn output, the same external ID and the Regions, and choose Test.
• Caches in another VPC, account or Region: open Administration › Connectors, expand Deploy a connector, choose the connection and Region and Get the quick-create link. Deploy the connector stack in the caches' VPC, then Register connector with its outputs.

See Spoke accounts and Connectors in the installation guide. For an AWS Organization, deploy the spoke role to every account at once with a StackSet.

#7. Give your team access

1. Give people a way to sign in. With an identity provider, assign users or groups to the Memora application there. With CognitoOnly, create users in the Cognito user pool and mark their email as verified.
2. Grant access. A new user sees no caches until a grant applies to them. In Administration › Grants, give a user or a group permissions (view, read, write, operate, manage) on cache id patterns, for example "the orders group may read and write orders-*", on one connection or all, in some Regions or all. On the Business plan, key patterns such as cart:* limit reads and writes to part of a cache. See the admin guide.
3. Send them the PortalUrl and the user guide.

#Next steps

• User guide: the fleet, the cache pages, the key browser, the workbench, scripts, history and bulk jobs.
• Admin guide: roles, connections, connectors, grants, data access, cache users, settings, usage, the audit log and your plan.
• Security overview: for your security review.
• Upgrading: installing new releases.