Deploying on AWS
This page describes how to deploy onto AWS.
Last updated
This page describes how to deploy onto AWS.
Last updated
We highly recommend using AWS Organizations to create a sub-account whose resources are isolated but is still owned by the original billing account.
Instructions on how to create a sub-account in your AWS Organization can be found .
The new IAM user that we will create is used to install and manage all of the infrastructure needed to run the vendor service. Before creating the user, it is important to create its IAM policy.
Create a new policy from the following JSON content and give it a name you will remember, like "MetamanagementInstallation". (See as a reference.)
Once the IAM policy is created, create a new IAM user and attach that policy to it. Make sure that "Programmatic access" is enabled for the new user.
We then need to create a Metamanagement-specific AWS credentials file that is in the following format:
You should have received an invitation in your email from your vendor indicating that they have invited you to install their service. Click the email and follow the instructions, filling out all of the required fields and following any secondary instructions the vendor may have given you.
After all of the information is submitted, it will take up to 30 minutes to spin up your new project. You will receive an email when this is done.
The Metamanagement console will give you the IP address at which the cluster is being made available. You should add DNS A records mapping from the domain name you provided to that IP address. Instructions for a few common providers are linked below:
Note that after setting up DNS, it may take another ~5 minutes for the relevant SSL certs to be generated and for your app to become fully available.
If you created your service in a completely new project and it must be accessible by other services running in your infrastructure, you must somehow make the new VPC accessible from other VPCs.
The first way to do this is with VPC peering. This is useful if you want unrestricted two-way access between the newly installed service and your main infrastructure. More information on VPC peering can be found .
The second way to do this is with AWS PrivateLink. Rather than joining the VPCs, AWS PrivateLink gives you a way to allow explicit connections only to a particular service. More information on how to set this up can be found .