# Getting Started with AWS Cloud **Last Updated: March 23, 2023** {{ :aws-gettingstarted:asset_logo_amazon-web-service.png?nolink&240 |nobox}} ## Why AWS (Amazon Web Services)? AWS customers are using Nasuni Access Anywhere to take advantage of the high durability, scalability and low cost of AWS Cloud Services. ## Overview This Getting Started with AWS guide provides step-by-step instructions for deploying your own Access Anywhere Server on the AWS Cloud. Applies to: Version 2301.0 ### Features The server indexes and allows interacting with your storage as a single global file system. You can add multiple Nasuni Filers. The content of your data is not copied. Features include: * Search across storage by name, metadata, and keyword (content search) * Remote and at-home users can access from the desktop apps or the web * Data access/stored in native format - no vendor lock-in * Add security to object storage with SSO, ACLs, and 2FA. * Comprehensive audit trail ### Costs You are responsible for the cost of the AWS services used by deploying this solution. This includes the compute instances and other AWS services to which the platform is deployed and any ingress, egress, and storage fees for metadata and data accessed through the platform. This is an AWS pricing model based on a single node deployment with 1 TB of storage. ^ Service ^ Monthly^ First Year^ Configuration summary ^ | Amazon EC2 | ~$245.00| ~2940.00| Operating system (Linux), Quantity (1), Pricing strategy (EC2 Instance Savings Plans 1 Year No Upfront), Disk (150 GB), Instance type (c6i.2xlarge) | | S3 Standard | 24.09| 289.08| S3 Standard storage (1 TB per month) | | Data Transfer | 8.91| 106.92 | DT Inbound: Not selected (100 GB per month), DT Outbound: Internet (100 GB per month) | | Amazon Elastic IP| 0.00| 0.00| Number of EC2 instances (1), Number of EIPs per instance (1), Number of EIP remaps (0) | ^ TOTAL ^ 121.33 ^ 1455.96 ^ USD ^ ## Architecture ### Single VM Deployment For most AWS Cloud installations the solution is deployed as a single virtual machine or instance. The virtual machine includes all application and database services needed and can be launched directly from the AWS Marketplace. {{ :aws-gettingstarted:awscloud-filefabric-ec2.png?600 |}} ### Multiple VM Deployment {{ :aws-gettingstarted:awscloud-filefabric-ha.png?600 |}} The solution may also be deployed in a multi-AZ environment with multiple virtual machines and external databases. Please contact support for more information on setting up multi-node deployments on the AWS Cloud. For production deployments see also [[sizingguide]]. ### AWS Components The platform uses the following AWS services: * [[https://docs.aws.amazon.com/ec2|Amazon EC2]] – The Amazon Elastic Compute Cloud (Amazon EC2) service enables virtual machine instances to be launched with a variety of operating systems. The server is available as a virtual machine image. * [[https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/elastic-ip-addresses-eip.html|Elastic IP Address]] - An Elastic IP address is a public IPv4 address, reservable through AWS. It can be mapped dynamically to an instance, allowing instances to be changed without affecting their public address. They also allow mapping to a DNS record for your domain. * [[https://docs.aws.amazon.com/ses/|Amazon Simple Email Service (Amazon SES)]] - Amazon SES is an email service that may be used by the solution for sharing links with other users and receiving notifications. The solution may also use the following AWS storage services: * [[https://aws.amazon.com/s3|Amazon S3]] - Amazon Simple Storage Service (Amazon S3) is an object storage service that offers industry-leading scalability, data availability, security, and performance. ## Deployment This guide walks through deploying the Access Anywhere Server to your environment as a single-instance software appliance. An instance will be launched directly from the AWS Marketplace. You'll have the ability to choose the target region and size the instance for your requirements. After the appliance is started you'll set up the network, and then with the creation of an Organization, you will add storage and users. ### Skills Required This guide is for IT infrastructure architects and DevOps professionals who are deploying the solution on AWS. To follow this guide a user should have some familiarity with the AWS Console and with a Linux shell. They may require support from a network administrator to create a DNS record, and from an IT administrator if a corporate SSL certificate is required. ### Time Required Following this guide, the Access Anywhere Server platform can be deployed in under an hour. ### Prerequisites You will need the following information before you can complete the setup: * An AWS Account. If you don’t already have an AWS account, create one at https://aws.amazon.com/getting-started/ by following the on-screen instructions. * A domain name (recommended). * A Nasuni Account with access to a Nasuni Access Anywhere Serial Number. * Outbound mail relay information (recommended). * Default storage system connectivity details - for example, Amazon S3 (required) * An Active Directory service account if you are connecting to AD (optional). ## Security As with all systems you deploy to the AWS Cloud security responsibilities are shared between you and AWS. AWS is responsible for the host operating system and virtualization layer down to the physical security of the facilities in which the services operate. You assume responsibility for the security of the appliance through configuration and management of specific AWS Cloud services and of the appliance itself. Through the appliance, you can delegate specific application and data security responsibilities to designated users and roles. For more information about security on AWS, visit the [[http://aws.amazon.com/security/|AWS Security Center]]. For more information about security see [[security]]. ### AWS Identity and Access Management Following the security principle of least privilege, we recommend that you use two "IAM user" accounts, one with access to EC2 services, and a second with access to Amazon S3 services. They should not be [[https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html|root users]]. You may also create these users in separate AWS Accounts. You should assign permissions through groups and assign them to users as needed. For example: * SME-Admin - The ability to create Amazon EC2 services through the AWS Console. * SME-Storage - The ability to access Amazon S3 storage (optional) #### SME-Admin For deploying to EC2 we recommend the following policies: * AmazonEC2FullAccess * SupportUser #### SME-Storage The doc page on adding Amazon S3 provides instructions for obtaining access credentials and using a custom policy to limit access to what is needed. Public access is not required. See [[:cloudproviders/amazons3]] ### Operating System Security The application does not use root or other administrative uses to run internal components. An end-user cannot log in as root – they can use sudo from the user smeconfiguser. A user can log into the smeconfiguser account only by using the SSH key specified during the deployment process. AWS doesn't store these SSH keys, so if you lose your SSH key, you can lose access to these instances. The appliance can be updated with respect to security patches outside of our regular release cycle with the following command: yum install yum-plugin-security # If automating you can add the "-y" option We will announce high-severity security patches when they are available through a security alert (email). This includes security patches to third-party components we may be using and other remediations. ### Customer Sensitive Data The platform provides a number of preventative and detective mechanisms to protect customer data. For more information see [[security]]. ### Data Encryption The solution encrypts data in motion and provides a number of options for encrypting data at rest in addition to that provided by the storage service. * Amazon S3 server-side encryption can be enabled * Folder encryption, where data is sent encrypted to the storage * Personal encryption where data is encrypted by the client before sending to the platform. For more information see [[security]]. ### Security Groups A security group acts as a firewall that controls the traffic for one or more instances. When you launch an instance, you associate a security group with the instance. You add rules to the security group that allow traffic to or from the appliance. You can modify the rules for a security group at any time. ## Launch ### Launch from AWS Marketplace From the [[https://aws.amazon.com/marketplace/pp/prodview-ke4huirvq5pfc|AWS Marketplace page]] select "Continue to Subscribe". {{ :aws-gettingstarted:continue-to-subscribe.png?nolink&200 |}} Review terms and select "Continue to Configuration". {{ :aws-gettingstarted:continue-to-configuration.png?nolink&200 |}} Select your preferred **Region** and then select "Continue to Launch" {{ :aws-gettingstarted:configure-this-software.png?nolink&600 |}} This page allows you to launch the instance directly from this webpage, or through the EC2 launch instance wizard. #### Launch this software {{ :aws-gettingstarted:review-config-details.png?nolink&600 |}} #### Choose Action Leave the setting as **Launch from Website** (Recommended). Instructions for launching from EC2 instead are provided in the section [[#launch_through_ec2|Launch Through EC2]]. {{ :aws-gettingstarted:choose-action-launch-from-website.png?nolink&600 |}} #### EC2 Instance Type Review settings. Default is **c6i.2xlarge**: * **Memory**: 16 GiB * **CPU**: 8 virtual cores * **Storage**: EBS Only * **Network Performance**: 12.5Gbps #### VPC Settings Select a VPC. #### Subnet Settings Choose a public subnet. #### Security Group Settings Select "Create New Based on Seller Settings". #### Create new based on seller settings {{ :aws-gettingstarted:security-group.png?nolink&600 |}} #### Create New Security Group Add a name and description such as "Access Anywhere". Do NOT change the Source (IP or Group) to "My IP" as this setting incorrectly assigns an internal AWS IP address. Select "Save". {{ :aws-gettingstarted:new-security-group-settings.png?nolink&600 |}} #### Key Pair Amazon EC2 uses SSH-2 RSA keys for SSH which is required to complete the configuration. A public/private key pair can be assigned or created. Choose an existing Key Pair or create a new one. {{ :aws-gettingstarted:key-pair.png?nolink&600 |}} #### Launch Select the "Launch" button to deploy. {{ :aws-gettingstarted:website-launch-congratulations.png?nolink&600 |}} Select EC2 Console to see the instance running in the region you selected. Add a Name by clicking in the empty Name box and entering "Nasuni Access Anywhere". Jump to the next step [[#configure_public_endpoint|Configure Public Endpoint]]. ### Launch through EC2 If you did not "Launch from the website", follow these steps to launch the instance. #### Step 1. Choose an Amazon Machine Image (AMI) 1. From the AWS Marketplace click [[https://aws.amazon.com/marketplace/pp/prodview-ke4huirvq5pfc|Nasuni Access Anywhere Server]]. 2. Then click **Launch**. #### Step 2: Choose an Instance Type Minimum recommended settings are: * 8 vCPUs * 16 GiB memory * 200 GB Storage For example, ^ Type ^ vCPUs ^ Memory (GiB) ^ Instance Storage (GB) ^ Network ^ Notes ^ | c6i.2xlarge | 8 | 16 | EBS Only | Up to 12.5 Gigabit Ethernet | Recommended | #### Step 3: Configure Instance Details Check the following setting: * **Auto-assign Public IP** - set to **Enable** #### Step 4: Add Storage Accept the defaults, for example: ^ Volume Type ^ Device ^ Snapshot ^ Size (GbB) ^ Volume Type ^ Delete on Termination ^ | Root | /dev/sda1 | snap-xxx | 200 | [General Purpose SSD (gp2] | Yes | You might wish to change "Delete on Termination" to False to prevent your instance from being accidentally terminated through Amazon EC2. You can also encrypt the root volume here. #### Step 5: Add Tags No changes, select Next: Configure Security Group #### Step 6: Configure Security Group Create a new security group for "Access Anywhere" with four settings: ^ Type ^ Protocol ^ Port Range ^ Source ^ Description ^ | SSH | TCP | 22 | My IP | SSH for initial configuration | | Custom TCP Rule | TCP | 8080 | My IP | Installation website (temporary) | | HTTPS | TCP | 443 | Anywhere | Main website | | HTTP | TCP | 80 | Anywhere | Redirects to the main website | If you will be accessing the server using FTP/FTPS or SFTP you'll need to add [[server/cloudftp-configuration|additional ports]]. #### Step 7: Review Instance Launch Select [Launch] to bring up the dialog to choose or create a public/private key pair that will allow you to SSH into the instance. {{ ::aws-gettingstarted:aws-keypair.png?nolink&600 |}} Select **Launch Instances**. #### View Instances Select **EC2 Console** or **View Instances** and wait a few minutes until the **Status Checks** are complete. #### Add Name Add a name for your instance such as **Nasuni Access Anywhere**. ## Configuration ### Configure Public Endpoint Applications access the server through a public endpoint, a fully qualified domain name that resolves to a public IP address. For single node deployments on AWS Cloud we recommend requesting an AWS Elastic IP Address and associating that with the appliance. You'll also generate a trusted SSL/TLS certificate for that address from the appliance itself. ### Associate Elastic IP address To add a public IP address with the instance from within the [[https://console.aws.amazon.com/|AWS Console]] navigate to [[https://console.aws.amazon.com/ec2/v2/home#Addresses:|Elastic IPs]]. You should be in the same region as the instance you deployed. Select **Allocate Elastic IP address** and **Allocate** to reserve the IP Address. Then choose **Actions > Associate Elastic IP address** to hook it to the instance you just created. Choose **Associate** to complete. ### SSH Access The instance can now be accessed at this IP address using a standalone SSH client and the Key Pair you assigned. The username is **smeconfiguser**. For example: ssh -i "AccessAnywhere.pem" smeconfiguser@34.194.216.200 (If the command freezes check your Security Group allows SSH access (port 22) for your IP address.) Check that you can become root. sudo su - This will be required to complete the configuration. More information on connecting via SSH can be found in the AWS Console. Select the instance in the Instances view and click **Connect**. ### SSL Configuration (Recommended) The appliance is configured, by default, with DHCP and a self-generated untrusted SSL certificate. In order to use the client tools (desktop and mobile applications) over SSL you will need a trusted SSL certificate and a fully qualified domain name (FQDN). #### Disabling SSL (Not Recommended) If you do NOT wish to use SSL for the trial you can disable it. 1. Log in as the Appliance Administrator as per the instructions below. 2. Navigate to Settings > Site Functionality 3. Set Always use HTTPS to No. 4. Set Generate secure server-side links to No. 5. Select *Update options* at the bottom of the page. ### Create DNS entries Choose three fully qualified domain names (FQDNs). For example: * **files**.example.com - Domain name (service endpoint and website) * **files-webdav**.example.com - used for WebDAV service Add DNS type A records that point these domain names to the appliance IP Address. For example, ^ Type ^ Name ^ Value^ | A | files | 35.188.82.62| | A | files-webdav | 35.188.82.62| Verify that Public DNS records are set up correctly: curl -L -k http://files.example.com | head curl -L -k http://files-webdav.example.com | head These commands should resolve the domain name, connect to port 80, get redirected to port 443 and return (part of) the web login page: