1-Click CloudFormation Deploy

Deploy the Cloud Spectra Gateway

Pick a tier, configure every stack parameter on this one clean page -- with a live architecture diagram that updates as you go -- then launch straight into the AWS CloudFormation console in the region you choose, settings pre-filled.

Subscribe to the AMI

Subscribe to your Cloud Spectra tier on the AWS Marketplace (one-time, per account).

Configure below

Click a quick-start profile for instant sensible defaults, or pick a tier and tune the grouped form. A live architecture diagram tracks your choices.

Launch to AWS

Click Launch in CloudFormation. You land on the AWS quick-create page, pre-filled.

Create stack

Review on AWS, check the IAM box, click Create stack. Live in ~10 minutes -- dashboard on HTTPS :9443.

Fastest path: pick a quick-start profile below, then click Launch. Everything else is optional -- safe defaults are pre-filled, and you can change any feature later from the dashboard.

Stack configuration

Configure your deployment

Parameters are grouped by function. Green groups are the essentials; purple are optional features (off by default). Hover any ?Help tooltips like this explain each parameter, including its underlying CloudFormation parameter name. for details. You always finish and submit on the AWS console.

Quick-start profilesone click sets the tier, sizing and features -- tweak anything after

No profile applied -- configure manually below, or pick a starting point above.

Essentialstier, target, network, placement, compute

Tier ?Cloud Spectra product tier. ONE Marketplace product per architecture ships the same superset AMI for every tier, so the tier is SELECTED here (sent to the instance as the cloudspectraProductTier stack parameter) rather than chosen by subscribing to a different product -- it decides which features unlock and the hourly rate. Platform = compute / Kubernetes workers / elastic single-instance apps; Network adds NAT, load balancing, sticky ENI and EIP failover; Security adds IDS/IPS, TLS inspection, governed web proxy and the AI LLM Gateway. Proxy is an EXCLUSIVE relay mode -- an instance runs Proxy or a gateway tier, never both; run a second instance for the other.

Version ?Cloud Spectra release version. Selects BOTH the CloudFormation template and the Marketplace AMI for that release, so a single page can launch any published version. The matching AMI ID for your tier, version and region resolves automatically below. Defaults to the latest published version.

Selects the release CloudFormation template and its Marketplace AMI. "latest" pins the newest published template and floats the AMI to the newest image at launch.

per vCPU / month$8

On-demand~$16/mo

Annual (-25%)~$12/mo

Cloud Spectra software fee per single running instance (est., c6in.large) -- billed hourly per vCPU through AWS Marketplace, on top of your EC2/EBS cost, and excludes data transfer. No minimum and no per-GB data-processing fee; vCPU counts above 128 are not billed. A multi-AZ fleet bills per instance across zones. See full pricing ->

AWS Region * ?The region the stack is created in. Sets the AWS console host and the stack region. AMIs are region-specific -- pick where your Marketplace subscription and workloads live.

The matching AMI for your tier and version is selected automatically per region.

Stack name * ?A name for the CloudFormation stack. Must start with a letter and contain only letters, numbers and hyphens (max 128 chars).

Becomes part of every resource name. Use a different name per stack in the same account/region.

VPC mode ?Create a brand-new VPC, or wire Cloud Spectra into an existing one. With "Existing", Cloud Spectra adds its own subnets, route tables and ENIs to the VPC you select. newOrExistingVpc

Create new VPC Use existing VPC

New VPC CIDR block ?CIDR for the new VPC (used only in create-new mode). Example 10.0.0.0/16. Per-AZ subnets are auto-allocated from this block. network0000cidrBlock

A /16 gives plenty of room for per-AZ subnets. Must not overlap VPCs you intend to peer with.

Client access CIDR * ?CIDR allowed inbound on SSH (port 22) and the dashboard HTTPS port. Use 0.0.0.0/0 to allow all, or restrict to your office/VPN range for tighter security. access0000clientCidrBlock

For production, restrict this to your admin network rather than 0.0.0.0/0.

Transit CIDRs (allow-all) ?Comma-separated CIDRs allowed all-protocol inbound for gateway transit traffic. Default is all RFC-1918 private space. Up to 3 CIDRs; leave trailing slots empty to use fewer. access0000allowAllCidrs

Restrict to specific spoke VPC CIDRs to tighten the transit security group.

Dashboard HTTPS port ?HTTPS port for the Cloud Spectra dashboard/API. Drives the security-group ingress and the gateway config. Defaults to 443; set 9443 (or similar) when you need an ALB/NLB on 443. dashboard0000port

1-65535. Keep the default unless you front the gateway with a load balancer on 443.

💡

The first AZ letter is the master AZ created by the template; any additional letters are non-primary AZs the gateway reconciles at runtime. Each enabled AZ gets its own subnet, ENI, route table and Auto Scaling Group -- an independent gateway -- so the fleet scales out across AZs for HA. This is a first-boot seed only; the dashboard / API / Terraform are the source of truth thereafter.

Availability Zones * ?Comma-delimited FULL AZ names for the deploy region (e.g. "us-east-1a" or "us-east-1a,us-east-1b"). The FIRST is the master AZ; the rest are non-primary AZs reconciled at runtime. Full AZ names are required by AWS Marketplace (the CloudFormation template exposes a validated AZ picker). placement0000availabilityZones

Full AZ names for your region. First = master AZ. e.g. us-east-1a,us-east-1b

AMI (auto-resolved) ?Read-only. Cloud Spectra resolves the AMI for your selected Tier + Version from the AWS Marketplace SSM parameter, and CloudFormation picks the correct Region-specific image at launch. Change the Tier or Version above to change this. instance0000imageAmiId

Auto-resolved from the selected Tier + Version (an SSM parameter CloudFormation resolves per Region). No AMI ID to enter.

Instance family ?EC2 instance family. Network-optimized families (c6in, c7gn, c8gn, c8in and similar) give the enhanced-networking throughput the data plane needs. The family sets the AMI architecture automatically (x86_64 or Graviton/arm64).

Instance size ?Size within the chosen family. Larger sizes add vCPU and network bandwidth and drive the price estimate above. You can resize up or down later from the dashboard without redeploying -- the gateway scales vertically (resize the instance type) as well as horizontally (add or remove instances across AZs), so you pay for the capacity you actually use and can scale down off-peak. instance0000type

Start small; resize later from the dashboard.

Min / Desired / Max per AZ ?Auto Scaling Group sizing per AZ. The stack supports 0 or 1 instance per AZ at deploy time; multi-instance-per-AZ is configured afterward from the Cloud Spectra dashboard or API. asg0000minSize / asg0000desiredCapacity / asg0000maxSize

Min / Desired / Max (each 0-1). For multiple instances per AZ, scale from the dashboard after deploy.

Warm pool ?Pre-initialized standby instances per ASG for fast scale-out (~25s vs ~90s cold launch). Disabled by default. When enabled, choose how many standby instances and whether they are Stopped (cheapest) or Running (fastest). Warm pools make horizontal scale-out fast -- the only way past a single box's throughput ceiling -- and pairing elastic right-sizing with spot is what makes running the data plane yourself cheaper than both an always-on fixed appliance and the managed cloud meter. asg0000warmPoolDisabled / asg0000warmPoolMinSize / asg0000warmPoolState

Disabled / Enabled · min standby (0-10) · Stopped or Running.

Features (optional)off by default -- expand to enable

💡

When a port-forwarding rule is submitted with externalPort=0, the gateway auto-allocates a free port from this range and opens it in the security group -- ideal for WireGuard tunnels dialed in from on-prem sites behind NAT.

Dial-in base port ?Base UDP port (inclusive) of the dial-in DNAT range the gateway auto-allocates from. Range 1024-65535. natGateway0000portForwardingDialInBasePort

Dial-in last port ?Last UDP port (inclusive) of the dial-in DNAT range. Must be >= the base port. natGateway0000portForwardingDialInLastPort

Dial-in source CIDRs ?Comma-separated source CIDRs allowed to reach the dial-in range -- set to your on-prem sites' public IPs (e.g. 203.0.113.10/32). Up to 3; empty keeps the range closed. Use 0.0.0.0/0 only to expose the authenticated port to the internet. natGateway0000portForwardingDialInSourceCidrs

Leave empty to keep the dial-in range closed until you add sources later.

Enable GWLB ?Enable AWS Gateway Load Balancer for transparent traffic steering across all ASG instances via GENEVE. Creates the GWLB, target group, endpoint service, per-AZ endpoints, and swings route-table defaults to the endpoints. gateway0000enableGwlb

Create VPC endpoints ?Create per-AZ VPC endpoints and swing route tables to them. Requires GWLB enabled. Set false to create the GWLB and endpoint service without route-swinging. gateway0000enableVpcEndpoints

Firewall policies ?Comma-separated AWS Network Firewall policy names to sync Suricata IDS/IPS rules from. Only FirewallPolicy and RuleGroup resources are needed -- no firewall endpoints ($0/month). Empty disables sync at deploy. firewallGateway0000firewallPolicies

Leave empty to skip firewall sync at deploy time.

Operations & Advancedupgrades, admin, developer

Auto-upgrade version ?Target version for auto-upgrade on boot. Empty = disabled, "latest" = always newest, or pin a version like 1.2.3. Operators can override later via SSM without redeploying. cloudspectraSoftware0000version

Leave empty to pin to the AMI's built-in version.

Software download URL ?HTTPS base URL of the public Cloud Spectra software releases bucket, used for auto-upgrade downloads. Override only if self-hosting release artifacts. cloudspectraSoftware0000downloadUrl

Keep the default unless you self-host the release bucket.

Resource name prefix ?Short lowercase prefix applied to all resource names and tags. Change only when deploying multiple stacks in one account/region. 1-32 chars, [a-z0-9-]. cloudspectraSoftware0000resourceNamePrefix

Gateway log level ?Log level for the gateway services. DEBUG is verbose for troubleshooting; INFO is the production default. service0000logLevel

🔑

For your security, the admin password is never placed in a launch URL. Leave it blank to auto-generate a strong initial password (retrievable via SSH), or type it in the masked access0000passwordBcrypt field on the AWS console page -- either a plaintext password (min 8 chars: upper/lower/digit/special) or a pre-computed bcrypt hash. A plaintext value is bcrypt-hashed at deploy time, so only the hash is ever written to SSM.

EBS KMS key ARN ?Optional customer-managed KMS key ARN for gateway EBS root-volume encryption. Leave empty to use the AWS-managed key (aws/ebs); volumes are encrypted at rest either way. instance0000ebsKmsKeyId

Blank = AWS-managed aws/ebs key.

Provision CloudTrail ?When true, provision a management-event CloudTrail (S3 bucket + trail) so console/API actions on the stack are audited. Default false to avoid a duplicate trail when the account already has organization-wide CloudTrail. service0000enableCloudTrail

Admin password ?Initial dashboard admin password: either a plaintext password (min 8 chars: upper/lower/digit/special) or a pre-computed bcrypt hash ($2a$/$2b$/$2y$). A plaintext value is bcrypt-hashed at deploy time (only the hash reaches SSM). Empty auto-generates. Usually left blank here and set later from the dashboard. access0000passwordBcrypt

Leave blank to auto-generate a strong password.

OS recovery password (optional) ?Optional boot-time OS-user password directive "user:password" (e.g. "admin:..."); the part after the first colon may be plaintext or a pre-computed crypt hash ($6$/$y$/$2b$). Sets a Linux account password for EC2 Serial Console / local login recovery, applied at first boot via chpasswd. UNRELATED to the dashboard admin password above. If you enter a value here it is included in the generated launch URL; to avoid that, leave it blank and set it in the masked CloudSpectraPassword field on the AWS console page. CloudSpectraPassword

Blank = no OS password (the secure default). Format user:password.

ElasticApps data volume (GiB) ?ElasticApps (Platform tier) ONLY: size of the SECOND EBS the control plane mounts at the app data dir (/opt/cloudspectra-thirdparty). 0 (the default) = no extra volume, so a Proxy / Network / Security instance is unaffected. Set >0 (e.g. 20) for the platform tier. ElasticDataVolumeGiB

Feature configurationoptional -- every shipping feature, filtered by tier

🔧

Everything below is optional and set to safe defaults. Whatever you change is bundled into a single first-boot configuration overlay (nothing here needs a dedicated CloudFormation field), so this page configures every feature your tier ships -- no dashboard round-trip needed. You can still change any of it later from the dashboard, API or Terraform.

💡

One AMI serves ALL bundled apps. Choose a single App, OR a Bundle (metrics = Prometheus+Grafana, logs = OpenSearch+Dashboards+Fluent Bit), OR list an explicit Desired Apps set. Precedence: Desired Apps > Bundle > App. The tier runs one multi-AZ single-instance ASG that scales vertically and rides Spot.

App (single-app mode) ?Single-app mode (back-compat): which bundled stateful app this instance runs (matches the baked cartridge manifest). SOLO-selectable set only (needsBundle apps -- opensearch-dashboards, fluent-bit -- are reachable only via bundleId). Optional now that bundleId/desiredApps exist; when the tier is enabled at least one of appId/bundleId/desiredApps must be set (enforced by the control plane, not the schema). elasticApps.appId

Schema default: grafana. Blank keeps it.

Bundle (multi-app mode) ?Multi-app mode: activate a pre-wired bundle of co-resident apps on this instance (e.g. metrics = Prometheus + Grafana; logs = OpenSearch + Dashboards + Fluent Bit). Empty = no bundle. Members are auto-wired, per-app cgroup-bounded, and path-routed behind one HTTPS front door. elasticApps.bundleId

Desired Apps (explicit set) ?Multi-app mode: the explicit desired set of app OR bundle ids to run on this instance. The control plane reconciles the running set to this (starts added, stops+disables removed while PRESERVING their data). Empty = fall back to bundleId, then appId. elasticApps.desiredApps

Vertical size ladder ?Ascending vertical size ladder the instance may be resized between (one family, e.g. r7i.large..r7i.4xlarge). elasticApps.ladder

Min ladder rung ?Lowest ladder rung allowed. elasticApps.policy.minIndex

Schema default: 0. Blank keeps it.

Max ladder rung ?Highest ladder rung allowed. 0 -> top of ladder. elasticApps.policy.maxIndex

Schema default: 0. Blank keeps it.

Scale-up utilization ?Sustained utilization above this scales up one rung. elasticApps.policy.scaleUpUtil

Schema default: 0.75. Blank keeps it.

Scale-down utilization ?Sustained utilization below this scales down one rung. elasticApps.policy.scaleDownUtil

Schema default: 0.3. Blank keeps it.

AZ affinity (Spot reclaim) ?Spot-reclaim cross-AZ policy. strict = wait for same-AZ capacity (zero data loss, the default); relaxed = after a sustained crunch, restore the latest snapshot in another AZ (RPO = snapshot interval). elasticApps.azAffinity

Schema default: strict. Blank keeps it.

DR snapshot interval (min) ?Cross-AZ DR snapshot cadence (feeds the relaxed-affinity RPO). 0 = disabled. elasticApps.snapshotIntervalMinutes

Schema default: 60. Blank keeps it.

Endpoint DNS name ?Managed private DNS name (cert CN + Route 53 A record). Survives AZ moves; certs are minted on this name, never the IP. elasticApps.endpointDns

Public DNS (cert SAN) ?EIP public DNS name added as a cert SAN. Optional. elasticApps.publicDns

EIP allocation id ?Elastic IP allocation id to associate with the endpoint. Empty = no EIP endpoint. elasticApps.eipAllocationId

Route 53 hosted zone id ?Route 53 private hosted zone id for the endpointDns record. Empty = no managed DNS. elasticApps.hostedZoneId

Enable in-VPC VIP ?Optional VIP. OFF by default -- the EIP already spans AZs; a VIP is AZ-local and only needed for in-VPC clients that must not re-resolve DNS. elasticApps.vipEnabled

SSM parameter prefix ?SSM Parameter Store prefix holding first-boot secrets + the scale config JSON. Bounds the instance-role ssm:GetParameter grant. elasticApps.ssmParamPrefix

Schema default: cloudspectra/elastic. Blank keeps it.

Enable ?Enable the AI LLM Gateway (governed OpenAI/Anthropic/Bedrock proxy with exact response cache and semantic cache) on the configured port. Requires 4+ vCPUs and the AI tier. aiGateway.enable

Listen port ?Listen port for the AI Gateway aiGateway.port

Schema default: 8090. Blank keeps it.

Default provider ?Default upstream provider (openai, anthropic, bedrock) aiGateway.defaultProvider

Schema default: openai. Blank keeps it.

OpenAI base URL ?OpenAI API base URL aiGateway.openaiBaseUrl

Schema default: https://api.openai.com. Blank keeps it.

Anthropic base URL ?Anthropic API base URL aiGateway.anthropicBaseUrl

Schema default: https://api.anthropic.com. Blank keeps it.

Bedrock region ?AWS region for Bedrock API calls aiGateway.bedrockRegion

Schema default: us-east-1. Blank keeps it.

Exact response cache ?Enable response caching (exact-match, temperature=0 only) aiGateway.cacheEnabled

Cache TTL (seconds) ?Cache TTL in seconds (0 = cache indefinitely for deterministic requests) aiGateway.cacheTtlSeconds

Schema default: 3600. Blank keeps it.

Prompt audit logging ?Enable prompt audit logging to /var/log/cloudspectra/ai_gateway_audit.json aiGateway.auditLogEnabled

Allowed models ?Allowlist of model names/prefixes. Empty = all models allowed. aiGateway.allowedModels

Semantic cache ?Enable semantic cache (AI Gateway tier). Uses OpenAI embeddings to find semantically similar prompts and return cached responses. Significantly improves cache hit rate (50-70% vs 20-30% exact-only). Requires a valid OpenAI API key for embedding computation. aiGateway.semanticCacheEnabled

Semantic cache threshold ?Similarity threshold for semantic cache hits (0.80-0.99). Higher values = stricter matching, fewer false positives. 0.90 is recommended for production use. aiGateway.semanticCacheThreshold

Schema default: 0.9. Blank keeps it.

Semantic cache max entries ?Max entries in the semantic cache. Each entry stores a 1536-dim embedding vector (~6KB) PLUS the cached response body (bounded by maxResponseBodyBytes, default 10MB). Memory is capped by BOTH this count and an internal total-bytes budget, whichever binds first. aiGateway.semanticCacheMaxEntries

Schema default: 5000. Blank keeps it.

Enable ?Enable Firewall Gateway firewallGateway.enable

Rule poll interval (s) ?How often (in seconds) to poll for rule changes firewallGateway.pollIntervalSeconds

Schema default: 60. Blank keeps it.

Enable ET Open detection ?Enable ET Open community threat detection rules. Downloads and auto-updates Emerging Threats Open ruleset (30,000+ IDS/IPS signatures covering malware, exploits, trojans, phishing, and known-bad IPs). Disabled by default. firewallGateway.threatDetectionEnabled

ET Open categories ?List of ET Open rule categories to enable. If empty, a curated default set is used (malware, exploit, trojan, worm, dos, phishing, attack_response, compromised, drop, botcc, current_events). Use full category names like "emerging-malware", "emerging-exploit", etc. firewallGateway.threatDetectionCategories

ET Open update interval (h) ?How often (in hours) to check for ET Open rule updates. Rules are downloaded from rules.emergingthreats.net. Set to 0 to disable auto-updates after initial download. firewallGateway.threatDetectionUpdateIntervalHours

Schema default: 24. Blank keeps it.

Enable ?Enable multi-source community threat feeds (abuse.ch, CINS Army, Spamhaus DROP). Independent of threatDetectionEnabled (ET Open). Disabled by default. firewallGateway.threatFeeds.enable

Feed sources ?Subset of default free feeds to enable by name (abuse-feodo, abuse-sslbl, abuse-threatfox, abuse-urlhaus, cins-army, spamhaus-drop). Empty enables all of them. firewallGateway.threatFeeds.sources

Feed update interval (h) ?How often (in hours) to refresh the community feeds. 0 uses the default (24h). firewallGateway.threatFeeds.updateIntervalHours

Schema default: 24. Blank keeps it.

Commercial feed provider ?Commercial feed provider: none, etpro (Proofpoint ET Pro), or talos (Cisco Talos Subscriber). BYO. firewallGateway.threatFeeds.commercialFeed.provider

Schema default: none. Blank keeps it.

Oinkcode secret ARN ?Secrets Manager ARN of the customer-owned secret holding the oinkcode. Templated into the ruleset URL at fetch time; never persisted in plaintext. firewallGateway.threatFeeds.commercialFeed.oinkcodeSecretArn

Enable ?Enable TLS inspection (ssl-bump). v1: EC2 client-trust is auto-distributed via SSM; K8s / on-prem clients must trust the CA out-of-band (documented). Off by default. firewallGateway.tlsInspection.enable

CA signing mode ?CA signing mode: self-managed (a $0 local CA, DEFAULT) or acm-pca (HSM-backed AWS Private CA, opt-in ~$400/mo). firewallGateway.tlsInspection.caMode

Schema default: self-managed. Blank keeps it.

ACM Private CA ARN ?ACM Private CA ARN. Required only when caMode=acm-pca; ignored for self-managed. firewallGateway.tlsInspection.acmPrivateCaArn

Explicit proxy mode ?Use LEGACY explicit-forward-proxy interception (clients must point at the proxy) instead of TRANSPARENT interception. Default (false) = transparent: the data plane redirects :443 into Squid so clients need no proxy config. firewallGateway.tlsInspection.explicitProxyMode

Intercept port ?Squid transparent-intercept https_port that :443 is redirected to (transparent mode only). firewallGateway.tlsInspection.interceptPort

Schema default: 3129. Blank keeps it.

Allow QUIC (UDP/443) ?Allow UDP/443 (QUIC / HTTP-3) to pass. Default (false) DROPS QUIC so browsers fall back to interceptable TCP TLS -- QUIC otherwise bypasses interception entirely. firewallGateway.tlsInspection.allowQuic

Inspection scopes ?Which traffic to decrypt. Empty intercepts all port-443 (splice pass-through for the rest). Each scope AND's its sources / destinations / ports. firewallGateway.tlsInspection.scopes

Enable ?Enable nDPI L7 application control. Disabled by default. firewallGateway.appControl.enable

Blocked applications ?nDPI protocol names to BLOCK (e.g. tor, bittorrent, i2p, psiphon, ultrasurf, wireguard, openvpn). Unknown names are skipped, not fatal. firewallGateway.appControl.blockApps

Flagged risks ?nDPI flow-risk names to ALERT on (e.g. suspicious_dga_domain, dns_suspicious_traffic, tls_self_signed_cert, malicious_ja3). firewallGateway.appControl.flagRisks

Enable ?Enable SIEM event export. Disabled by default. siem.enabled

Wire format ?Wire format for exported events. siem.format

Schema default: cef. Blank keeps it.

Destination ?Where to send events: a "host:port" syslog endpoint, "file:/path" to append locally, or "stdout" (default; goes to the service log / CloudWatch). siem.destination

Schema default: stdout. Blank keeps it.

Transport ?Transport for a host:port syslog destination. siem.protocol

Schema default: tcp. Blank keeps it.

Event sources ?Event sources to export: "ids" (Suricata alerts) and/or "audit" (config/auth audit). Empty exports IDS only. siem.sources

Schema default: ids,audit. Blank keeps it.

Enable ?Enable WebProxy Gateway webProxyGateway.enable

Proxy port ?Web proxy server port number webProxyGateway.port

Schema default: 1080. Blank keeps it.

Disk cache ?Enable Squid disk cache for HTTP responses webProxyGateway.cacheEnable

Disk cache size (MB) ?Disk cache size in MB (stored in /var/spool/squid) webProxyGateway.cacheSizeMB

Schema default: 1024. Blank keeps it.

Memory cache (MB) ?In-memory cache size in MB webProxyGateway.cacheMemMB

Schema default: 256. Blank keeps it.

Max cacheable object (KB) ?Maximum cacheable object size in KB webProxyGateway.cacheMaxObjectSizeKB

Schema default: 65536. Blank keeps it.

Allowed domains ?Domain allowlist -- only these domains can be accessed through the proxy (empty = allow all) webProxyGateway.allowedDomains

Denied domains ?Domain denylist -- these domains are blocked (evaluated after allowlist) webProxyGateway.deniedDomains

Access logging ?Enable Squid access logging to /var/log/squid/access.log webProxyGateway.accessLogEnable

Max connections (0=unlimited) ?Maximum concurrent client connections (0 = unlimited) webProxyGateway.maxConnections

Schema default: 0. Blank keeps it.

Per-client bandwidth (Kbps) ?Per-client bandwidth limit in Kbps (0 = unlimited) webProxyGateway.bandwidthLimitKbps

Schema default: 0. Blank keeps it.

Custom ACL rules ?Custom ACL rules (URL patterns, source IP, time-based) webProxyGateway.aclRules

Worker processes (0=auto) ?Number of squid worker processes (0 = auto) webProxyGateway.workers

Schema default: 0. Blank keeps it.

Connection timeout (s, 0=default) ?Client connection timeout in seconds (0 = default 60) webProxyGateway.connectionTimeout

Schema default: 0. Blank keeps it.

Request timeout (s, 0=default) ?Request timeout in seconds (0 = default 300) webProxyGateway.requestTimeout

Schema default: 0. Blank keeps it.

Keep-alive connections ?Enable HTTP keep-alive connections webProxyGateway.persistentConnections

Collapse duplicate requests ?Deduplicate identical concurrent requests webProxyGateway.collapseForwarding

X-Forwarded-For mode ?X-Forwarded-For header mode (on, off, delete, truncate) webProxyGateway.forwardedFor

Schema default: on. Blank keeps it.

Via header mode ?Via header mode (on, off) webProxyGateway.viaHeader

Schema default: on. Blank keeps it.

Enable ?Enable URL-category filtering on the web proxy. Disabled by default. webProxyGateway.urlCategoryFilter.enabled

Blocked categories ?Category names to block (e.g. adult, gambling, malware, phishing, anonymizer, proxy, social_networks). Unknown or absent categories are skipped, not fatal. webProxyGateway.urlCategoryFilter.blockedCategories

Category list source ?Category list source: ut1 (free Universite Toulouse lists, default) or byo (bring-your-own commercial DB in customer S3, local-SDK mode only -- cloud-lookup breaks sovereignty). webProxyGateway.urlCategoryFilter.source

Schema default: ut1. Blank keeps it.

BYO DB S3 prefix ?Customer-owned s3://bucket/prefix/ holding the BYO category DB. webProxyGateway.urlCategoryFilter.byoSource.s3Prefix

BYO DB license secret ARN ?Optional Secrets Manager ARN for a BYO DB license key. webProxyGateway.urlCategoryFilter.byoSource.secretArn

Enable ?Enable ICAP antivirus scanning of proxied downloads. Disabled by default. webProxyGateway.antivirus.enabled

ICAP endpoint (blank=local ClamAV) ?ICAP service URL. Empty uses the local ClamAV c-icap module (icap://127.0.0.1:1344/srv_clamav); set to a BYO OPSWAT/Sophos ICAP endpoint (kept local) for multi-engine. webProxyGateway.antivirus.icapEndpoint

Block on detection ?Block infected downloads. When false, detections are logged but downloads proceed (monitor mode). webProxyGateway.antivirus.blockOnDetect

Max scanned file size (MB) ?Files larger than this (MB) bypass scanning (ClamAV memory/ CPU cost). 0 uses the default (64 MB). webProxyGateway.antivirus.maxFileSizeMb

Schema default: 64. Blank keeps it.

Enable ?Enable S-NAT Gateway natGateway.enable

Top NAT flows shown ?Number of top NAT flows (by bytes) to display in the dashboard. Each instance reports its local top-N, master aggregates across all instances. natGateway.topFlowsCount

Schema default: 100. Blank keeps it.

Port-forwarding rules ?Port forwarding (DNAT+SNAT) rules natGateway.portForwarding

Load-balancer management ?Enable load balancer management gateway.enableLoadBalancerManagement

Program route tables ?routing-tables to add a route to destinations with this gateway as the nexthop gateway.routingTables

Schema default: none. Blank keeps it.

Destinations (CIDRs) ?List of IPv4 CIDR address blocks to where this gateway serves traffic gateway.destinations

Schema default: 0.0.0.0/0. Blank keeps it.

Sources (CIDRs) ?List of IPv4 CIDR address blocks from where this gateway serves traffic gateway.sources

Schema default: 0.0.0.0/0. Blank keeps it.

Enable ?Enable the per-AZ floating VIP pool (master-managed). vipPool.enable

VIPs per instance ?Baseline number of VIPs (secondary private IPs) per instance. The per-AZ pool size = vipsPerInstance x (ASG desired capacity). Larger instance types receive proportionally more VIPs under the instanceTypeWeighted policy. Bounded by the instance-type Ipv4AddressesPerInterface ceiling (validated at config time). vipPool.vipsPerInstance

Schema default: 1. Blank keeps it.

Distribution policy ?VIP placement policy. instanceTypeWeighted (v1 default) gives larger instances proportionally more VIPs. dynamicRebalance (future) drifts VIPs by live load; it may reset flows on re-assignment and is off by default. vipPool.distributionPolicy

Schema default: instanceTypeWeighted. Blank keeps it.

Sticky subnet /N ?Prefix length of the dedicated secondary sticky-interface subnet carved per AZ for lead-only sticky ENIs. Defaults to 28 (the AWS minimum); the primary subnet stays /24 (network.subnetLength) for instances + the VIP pool. vipPool.stickySubnetLength

Schema default: 28. Blank keeps it.

Health poll (ms) ?Master hello-probe interval in milliseconds. vipPool.detection.pollIntervalMs

Schema default: 1000. Blank keeps it.

Hello timeout (ms) ?Per-probe timeout in milliseconds for a single hello. vipPool.detection.helloTimeoutMs

Schema default: 500. Blank keeps it.

Unhealthy strikes ?Consecutive failed hello probes before a VIP is moved off an instance. vipPool.detection.unhealthyStrikes

Schema default: 3. Blank keeps it.

Move cooldown (s) ?Per-VIP cooldown after a move before that VIP may move again. vipPool.damping.moveCooldownSec

Schema default: 30. Blank keeps it.

Move rate cap (/min) ?Global cap on the number of VIP moves per minute across the pool. vipPool.damping.moveRateCapPerMin

Schema default: 10. Blank keeps it.

Lead hold-down (s) ?Hold-down after a lead change before the lead sticky ENI/EBS may re-home again. Longer than the VIP cooldown because EBS re-home is an expensive detach/attach/fsck. vipPool.damping.leadHoldDownSec

Schema default: 300. Blank keeps it.

Enable ?Give the lead instance of each ASG a sticky (re-homed) ENI + route table. stickyEni.enable

Sticky ENI subnet id ?Subnet ID to create the sticky ENI(s) in. Defaults to the per-AZ /28 sticky-interface subnet (or the ASG launch-template subnet if empty). stickyEni.subnetId

Create sticky route table ?Create a route table pointing at the lead sticky ENI. stickyEni.routeTable.enable

Enable ?Attach a persistent EBS data volume to the LEAD instance of each ASG, re-homed within the AZ on lead change (data preserved). OFF by default. stickyEbs.enable

Mount point ?Filesystem path where the EBS volume is mounted on the instance. stickyEbs.mountPoint

Schema default: /data. Blank keeps it.

Volume type ?EBS volume type. stickyEbs.volumeType

Schema default: gp3. Blank keeps it.

Volume size (GiB) ?EBS volume size in GiB. stickyEbs.volumeSizeGiB

Schema default: 100. Blank keeps it.

Provisioned IOPS ?Provisioned IOPS. gp3 default is 3000 (up to 16000); io2 requires explicit value. stickyEbs.iops

Schema default: 3000. Blank keeps it.

Throughput (MiB/s) ?EBS throughput in MiB/s (gp3 only; ignored for io2). stickyEbs.throughputMiBps

Schema default: 125. Blank keeps it.

Encrypt volume ?Encrypt the EBS volume with the default KMS key. stickyEbs.encrypted

Filesystem ?Filesystem type to create on first attach. stickyEbs.fileSystem

Schema default: ext4. Blank keeps it.

Enable ?Enable master-hosted fleet monitoring. Ships ON by default; the customer opts out from the API/dashboard, which stops node-exporter fleet-wide and Prometheus/Grafana on the master. monitoring.enable

Prometheus port ?Prometheus listen port on the master (loopback) monitoring.prometheusPort

Schema default: 12347. Blank keeps it.

node-exporter port ?node-exporter port scraped across the fleet monitoring.nodeExporterPort

Schema default: 9100. Blank keeps it.

Scrape interval (s) ?Prometheus scrape interval in seconds monitoring.scrapeIntervalSec

Schema default: 30. Blank keeps it.

TSDB retention (days) ?Prometheus TSDB retention in days (on the sticky-EBS volume) monitoring.tsdbRetentionDays

Schema default: 15. Blank keeps it.

TSDB volume (GiB) ?Sticky-EBS volume size (GiB) for the Prometheus TSDB monitoring.tsdbVolumeSizeGiB

Schema default: 20. Blank keeps it.

Private DNS name ?Private DNS name dns.privateName

Public DNS name ?Public DNS name dns.publicName

Additional public IPs ?Additional public IPs to add to the DNS entries dns.additionalPublicIps

DNS poll interval (s) ?Poll interval in seconds for DNS updates dns.pollIntervalSeconds

Schema default: 30. Blank keeps it.

DNS health-check port ?DNS based health check port dns.healthCheckPort

Schema default: 2001. Blank keeps it.

Read-only password (bcrypt) ?Optional read-only dashboard user password in bcrypt format. When set, logging in with this password grants a read-only session (GET allowed, all writes rejected with 403). Empty disables the read-only user. access.readOnlyPasswordBcrypt

Access TCP ports ?List of tcp ports to where instances can be accessed access.tcpPorts

Schema default: 22. Blank keeps it.

SSH port ?SSH server port to access the instance remotely access.sshPort

Schema default: 22. Blank keeps it.

Console username ?Username to access the instances via ssh or console access.username

Schema default: admin. Blank keeps it.

Theme ?Display theme dashboard.theme

Schema default: light. Blank keeps it.

Language ?Language preference dashboard.language

Schema default: english. Blank keeps it.

Session timeout (s) ?Session timeout in seconds, defaults to 1 day dashboard.sessionTimeout

Schema default: 86400. Blank keeps it.

Preview the configuration overlay (0 settings changed)

This YAML is base64-encoded (and gzip-compressed when large) and passed as the GatewayConfigurationYaml stack parameter. It is the highest-precedence overlay: only the settings you changed from their defaults are included; everything else uses the schema default. Day-2 changes via the dashboard / API / Terraform take precedence at runtime.

Ready to launch

Opens the AWS CloudFormation quick-create page with your settings pre-filled. You review and click Create stack on AWS.

Show the generated launch URL

Template: <version>/cloudspectra_gateway_cf_deploy.yaml -- one merged template whose "VPC mode" selector chooses Create-new vs Use-existing (the deploy-page variant, identical to the Marketplace template but resolving the AMI itself) -- served from the per-region releases bucket for the region you pick. You must be signed in to the AWS console for the chosen region. The final Create-stack step (including the IAM capabilities acknowledgement) always happens on AWS -- this page never touches your account.

Reference architectureNetwork

graph TD; init["Pick a tier"];

Live topologyyour config

graph TD; init["Configure the form"];

Deployment summary

TierNetwork

Regionus-east-1

StackCSpectra

VPCNew VPC

AZs1

Instancec6in.large

After it's live ~10 min

On the AWS console, review the pre-filled parameters, check the IAM-capabilities box, and click Create stack. Provisioning takes about 10 minutes.

Wait for CREATE_COMPLETE, then read the stack Outputs for the gateway's public / Elastic IP.

Open the dashboard at https://<gateway-ip>:9443 (self-signed cert on first boot -- accept the browser warning once).

Download the SSH key from SSM (aws ssm get-parameter --name /ec2/keypair/<KEY_PAIR_ID> --with-decryption, from the AccessInstancePrivateKeyCommand stack output), then ssh -i <key> admin@<gateway-ip> and read the one-time password: sudo cat /etc/cloudspectra/dashboard_init_pw. Log in as admin and change it. (Or preset a password/bcrypt hash in Admin & Security before launch to skip this.)

Tune NAT / firewall / AI / scaling and add AZs or instances from the dashboard, API, or Terraform -- the dashboard is the source of truth after first boot. Quick Start ->