Getting started

This guide is for the administrator or platform team who sets up Cloud Certainty SQLark. You subscribe on AWS Marketplace, launch one CloudFormation stack in your own AWS account, sign in, run your first query, connect your other accounts and give your team access. The installation guide has every detail; this page is the short path.

#What you need

• The AWS account that will run SQLark (the hub). Subscribe from this account: AWS Marketplace delivers the licence to it through AWS License Manager.
• A supported Region: any Region with Amazon Athena, AWS Glue, AWS Lambda, Amazon API Gateway, Amazon DynamoDB, Amplify Hosting, Amazon Cognito, AWS License Manager and Amazon ECS on Fargate. The Region of the stack doesn't limit which Regions you can query.
• Permission to create the stack's resources, including IAM roles with custom names.
• A VPC with at least one subnet that has outbound HTTPS access, for example through a NAT gateway. Only a one-off installer task runs there, for about a minute at install and at each upgrade.
• The email address of your first administrator.
• Tables in the AWS Glue Data Catalog that Athena can query, and the names of the S3 buckets they read (optional: by default SQLark may read every bucket your policies allow).

#1. Subscribe on AWS Marketplace

SQLark is sold on AWS Marketplace with contract pricing, monthly or for 12 months. There are four plans: Starter, Team, Business and Enterprise. On the SQLark listing, Team is the base plan and Business and Enterprise are add-ons: for Business choose Team and the Business add-on; for Enterprise choose all three. An add-on bought on its own grants nothing. Starter is a separate listing, SQLark Starter. See the FAQ for what each plan includes.

1. Sign in to the AWS console with the account that will run SQLark, as an identity that may subscribe to AWS Marketplace products.
2. Open SQLark on AWS Marketplace (opens in a new tab), choose Continue to Subscribe, choose the plan and the contract length, and accept the offer.
3. Choose Continue to Configuration, select the fulfilment option and the Region, and continue to the Launch page. Its usage instructions have a link that opens CloudFormation with the release's template already selected.

#2. Launch the stack

Open the launch link from the usage instructions, or this quick-create link with the release version filled in:

https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://cloudcertainty-sqlark-us-east-1.s3.us-east-1.amazonaws.com/pro/<version>/main.yaml&stackName=sqlark

Check the Region in the console's top bar, then set these parameters (everything else can keep its default):

Acknowledge that AWS CloudFormation might create IAM resources with custom names and create the stack. Creation takes about 10 minutes. The template URL is always in the vendor's public bucket in us-east-1, and the same URL works in every Region:

https://cloudcertainty-sqlark-us-east-1.s3.us-east-1.amazonaws.com/pro/<version>/main.yaml

The installation guide has the AWS CLI command.

#3. Sign in

• CognitoOnly: the bootstrap administrator receives an email with a temporary password. Every user must register an authenticator app (TOTP MFA is required).
• IAMIdentityCenter or SAML: create a SAML application in your identity provider with the SamlAcsUrl and SamlAudienceUri stack outputs, assign yourself to it, then update the stack and set SamlMetadataUrl to the application's metadata URL. Until then nobody can sign in.
• OIDC: set the OIDC parameters when you create the stack; there is no second step.

Open the PortalUrl stack output and sign in as the bootstrap administrator. That account is always an administrator. Grant the Administrator role to a second person or group under Administration › Roles so you are never locked out.

#4. Run your first query

The workspace opens with a query tab. Pick the local connection (the hub account), a Region, the sqlark workgroup and a database; the schema browser on the left shows its tables and columns, and the editor completes them as you type. Press Ctrl+Enter (Cmd+Enter on a Mac) to run. SQLark shows the status, the data scanned, the time taken and the estimated cost, then the rows. From there you can chart the result, save the query or add it to a dashboard. The user guide explains every page.

#5. Add another AWS account

Each other account gets a small role that only your SQLark stack can assume, with an external ID you choose, and optionally a SQLark workgroup.

1. In the other account, deploy the spoke role template. Its URL is the hub's SpokeTemplateUrl output. Set TrustedPrincipal to the hub's SpokeTrustedPrincipal output, choose an ExternalId of at least 16 characters, an AccessLevel (Query by default) and, if you like, narrow DataBucketNames.
2. In SQLark, open Administration › Connections › Add connection. Enter an id, a name, the account ID, the same access level, the spoke stack's RoleArn output, the same external ID and the Regions.
3. Choose Test. SQLark assumes the role and lists the workgroups and databases in each Region.

For an AWS Organization, deploy the role to every account at once with a StackSet. See Deploy the spoke role in other accounts.

#6. Give your team access

1. Give people a way to sign in. With an identity provider, assign users or groups to the SQLark application there. With CognitoOnly, create users in the Cognito user pool and mark their email as verified.
2. Grant access. A new user sees no workgroups or databases until a grant applies to them. In Administration › Grants, give a user or a group permissions (browse, query, download, ddl) on workgroup and database patterns, for example "the analysts group may query sales_* in the workgroup analysts", on one connection or all, in some Regions or all. See the admin guide.
3. Send them the PortalUrl and the user guide.

#Next steps

• Admin guide: roles, connections, grants, settings, usage, the audit log and your plan.
• Security overview: for your security review.
• Upgrading: installing new releases.