Getting started

This guide is for the administrator or platform team who sets up Cloud Certainty TraceHound. You subscribe on AWS Marketplace, launch one CloudFormation stack in your own AWS account, sign in, see what your log groups store and cost, connect your other accounts and give your team access. The installation guide has every detail; this page is the short path.

#What you need

• The AWS account that will run TraceHound (the hub). Subscribe from this account: AWS Marketplace delivers the licence to it through AWS License Manager.
• A supported Region: any Region with Amazon CloudWatch Logs, AWS Lambda (with function URLs and response streaming), Amazon API Gateway, Amazon DynamoDB, Amplify Hosting, Amazon Cognito, AWS License Manager, Amazon EventBridge and Amazon ECS on Fargate. The Region of the stack doesn't limit which Regions you can read: you list them.
• Permission to create the stack's resources, including IAM roles with custom names and a Lambda function URL.
• A VPC with at least one subnet that has outbound HTTPS access, for example through a NAT gateway. Only a one-off installer task runs there, for about a minute at install and at each upgrade.
• The email address of your first administrator.

#1. Subscribe on AWS Marketplace

TraceHound is sold on AWS Marketplace with contract pricing, monthly or for 12 months. There are four plans: Starter, Team, Business and Enterprise. On the TraceHound listing, Team is the base plan and Business and Enterprise are add-ons: for Business choose Team and the Business add-on; for Enterprise choose all three. An add-on bought on its own grants nothing. Starter is a separate listing, TraceHound Starter. See the FAQ for what each plan includes.

1. Sign in to the AWS console with the account that will run TraceHound, as an identity that may subscribe to AWS Marketplace products.
2. Open TraceHound on AWS Marketplace (opens in a new tab), choose Continue to Subscribe, choose the plan and the contract length, and accept the offer.
3. Choose Continue to Configuration, select the fulfilment option and the Region, and continue to the Launch page. Its usage instructions have a link that opens CloudFormation with the release's template already selected.

#2. Launch the stack

Open the launch link from the usage instructions, or this quick-create link with the release version filled in:

https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://cloudcertainty-tracehound-us-east-1.s3.us-east-1.amazonaws.com/pro/<version>/main.yaml&stackName=tracehound

Check the Region in the console's top bar, then set these parameters (everything else can keep its default):

Acknowledge that AWS CloudFormation might create IAM resources with custom names and create the stack. Creation takes about 10 minutes. The template URL is always in the vendor's public bucket in us-east-1, and the same URL works in every Region:

https://cloudcertainty-tracehound-us-east-1.s3.us-east-1.amazonaws.com/pro/<version>/main.yaml

The installation guide has the AWS CLI command.

#3. Sign in

• CognitoOnly: the bootstrap administrator receives an email with a temporary password. Every user must register an authenticator app (TOTP MFA is required).
• IAMIdentityCenter or SAML: create a SAML application in your identity provider with the SamlAcsUrl and SamlAudienceUri stack outputs, assign yourself to it, then update the stack and set SamlMetadataUrl to the application's metadata URL. Until then nobody can sign in.
• OIDC: set the OIDC parameters when you create the stack; there is no second step.

Open the PortalUrl stack output and sign in as the bootstrap administrator. That account is always an administrator. Grant the Administrator role to a second person or group under Administration › Roles so you are never locked out.

#4. See your log estate

The Overview opens with every log group TraceHound can see in the hub account: how many there are, what they store, what they ingested in the last 30 days and what that costs a month, with the log groups that never expire and the orphaned Lambda log groups whose function is gone.

Screenshot

Sizes come straight from CloudWatch at once. Growth, ingestion and full cost estimates appear after TraceHound's collector has run: it runs every hour, and its first run in each Region reads 90 days of ingestion from CloudWatch metrics. To start it now, choose Collect now on the Overview. Stored bytes history can't be read from AWS, so it starts the day you install TraceHound.

Then open Explore, pick a few log groups, type level:error or "timed out" and press Enter. TraceHound runs a Logs Insights query and shows the events with a histogram, facets and the bytes scanned and estimated cost of the run. The user guide explains every page.

#5. Add another AWS account

Each other account gets a small role that only your TraceHound stack can assume, with an external ID you choose. One role covers every Region of the account.

1. In the other account, deploy the spoke role template. Its URL is the hub's SpokeTemplateUrl output. Set TrustedPrincipal to the hub's SpokeTrustedPrincipal output, choose an ExternalId of 16 to 128 characters and an AccessLevel (Read by default) and, if you like, set LogGroupPrefixes.
2. In TraceHound, open Administration › Connections › Add connection. Enter an id, a name, the account ID, the same access level, the spoke stack's RoleArn output, the same external ID and the Regions.
3. Choose Test. TraceHound assumes the role and lists the log groups in each Region.

For an AWS Organization, deploy the role to every account at once with a StackSet. See Deploy the spoke role in other accounts.

#6. Give your team access

1. Give people a way to sign in. With an identity provider, assign users or groups to the TraceHound application there. With CognitoOnly, create users in the Cognito user pool and mark their email as verified.
2. Grant access. A new user sees no log groups until a grant applies to them. In Administration › Grants, give a user or a group permissions (browse, read, export, manage) on log group name patterns, for example "the payments group may read and export /aws/lambda/payments-*", on one connection or all, in some Regions or all. See the admin guide.
3. Send them the PortalUrl and the user guide.

#Next steps

• Admin guide: connections, grants, roles, settings and prices, usage, the collector, the audit log and your plan.
• Security overview: for your security review.
• Upgrading: installing new releases.