Cloud Spectra Gateway -- Quick Start Guide

1Subscribe to your Cloud Spectra Gateway tier on AWS Marketplace

Visit the AWS Marketplace and subscribe to the listing for your chosen tier -- Network, Security, or Enterprise (see Choose Your Tier). Each listing offers both an amd64 (x86_64) and an arm64 (Graviton) AMI; pick the one matching your instance family. The AMI ID will be auto-injected into the CloudFormation template.

2Launch the CloudFormation Stack

Click Continue to Launch from the Marketplace listing, or deploy directly:

1. Open the CloudFormation console
2. Choose Create stack -- With new resources
3. Enter the template URL provided by Cloud Spectra
4. Fill in the parameters (see below)

3Configure Parameters

Most defaults are fine. Key parameters to review:

4Wait for Stack Creation

The stack takes 8-10 minutes. Watch for CREATE_COMPLETE status.

5Open the Dashboard

From the CloudFormation Outputs tab, click AccessElasticIp. This opens https://<EIP>:9443.

Login with:

• Username: admin
• Password: The password you set in the adminPassword parameter, or retrieve the auto-generated one:

# Option 1: Retrieve via SSH (from CloudFormation Outputs,
# copy the AccessInstancePrivateKeyCommand to download the SSH key).
# Log in as user "admin" with your EC2 key pair -- password
# authentication and root login are disabled on the appliance.
ssh -i ~/.ssh/cloudspectra-key admin@<EIP>
cat /opt/cloudspectra/conf/dashboard_init_pw

# Option 2: View directly in SSM Parameter Store
# Go to CloudFormation Outputs -- click SsmParameters to see all config

This one-time init password is only for first login. You will be prompted to set a permanent password immediately, after which the init password no longer works.

6Point Your Subnets to Cloud Spectra

For each private subnet that should use Cloud Spectra for NAT:

1. Open the VPC Route Tables console
2. Edit the route table for your private subnet
3. Add route: 0.0.0.0/0 -- Cloud Spectra ENI (from Outputs: AccessPrivateId1)

Or set UpdateMainRoutingTable=true in the CF parameters to auto-route the VPC main table.

7Test from a Private Instance

SSH into any EC2 instance in a private subnet routed through Cloud Spectra:

# Verify internet access through Cloud Spectra NAT:
curl -s https://checkip.amazonaws.com

# Should return the Cloud Spectra Gateway's EIP address

The returned IP should match the AccessElasticIp from the stack outputs.

8Enable the HTTP Proxy

Enable via the dashboard (Settings -- L7 HTTP Proxy) or the REST API:

# Authenticate and get a token
TOKEN=$(curl -sk https://<EIP>:9443/api/cloudspectra/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username":"admin","password":"YOUR_PASSWORD"}' \
  | jq -r '.token')

# Enable the HTTP proxy
curl -sk -X PUT https://<EIP>:9443/api/cloudspectra/web-proxy-gateway \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "enable": true,
    "port": 1080,
    "username": "proxyuser",
    "password": "securepassword123"
  }'

9Configure Clients

On any EC2 instance in the VPC, set the proxy environment variables:

# Use per-AZ DNS names (recommended -- avoids cross-AZ charges)
export http_proxy=http://proxyuser:securepassword123@us-east-1a.gw.example.com:1080
export https_proxy=http://proxyuser:securepassword123@us-east-1a.gw.example.com:1080
export no_proxy=169.254.169.254,10.0.0.0/8

# Test
curl -s https://checkip.amazonaws.com

DNS names are shown in the dashboard after enabling the proxy. Replace us-east-1a.gw.example.com with your actual per-AZ DNS name.

10Create a Firewall Policy in AWS

In the AWS Network Firewall console, create a firewall policy and attach rule groups. For example, create a stateful rule group that blocks a domain:

1. Go to Network Firewall -- Rule groups -- Create rule group
2. Choose Stateful, rule type Domain list
3. Add domains to block (e.g., .example.com) and set action to Deny
4. Create a firewall policy and attach this rule group

You do not need to create an actual AWS Network Firewall resource -- just the policy and rule groups.

11Point Cloud Spectra to the Policy

# Enable firewall and sync from your policy
curl -sk -X PUT https://<EIP>:9443/api/cloudspectra/firewall-gateway \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "enable": true,
    "firewallPolicies": ["my-fw-policy"]
  }'

Cloud Spectra will sync the rules within 60 seconds. Changes to the policy in the AWS console are automatically picked up -- no restart needed.

12Enable the AI Gateway

# Enable the AI Gateway (requires 4+ vCPUs -- c6in.xlarge or larger)
curl -sk -X PUT https://<EIP>:9443/api/cloudspectra/ai-gateway \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "enable": true,
    "port": 8080,
    "defaultProvider": "openai",
    "cacheEnabled": true,
    "auditLogEnabled": true
  }'

13Test with curl

Point your OpenAI SDK or any HTTP client at the gateway's per-AZ DNS name (shown in the dashboard) or the EIP:

# Send a chat completion request through the AI Gateway
curl -s http://<CLOUDSPECTRA_IP>:8080/v1/chat/completions \
  -H "Authorization: Bearer $OPENAI_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "gpt-4o",
    "messages": [{"role": "user", "content": "Hello, world"}]
  }'

# For Anthropic models, just change the model name -- routing is automatic
curl -s http://<CLOUDSPECTRA_IP>:8080/v1/chat/completions \
  -H "Authorization: Bearer $ANTHROPIC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "model": "claude-sonnet-4-20250514",
    "messages": [{"role": "user", "content": "Hello, world"}]
  }'

# In your application code, set the base URL:
# export OPENAI_BASE_URL=http://us-east-1a.gw.example.com:8080/v1

14Deploy with Terraform

terraform {
  required_providers {
    aws     = { source = "hashicorp/aws", version = ">= 5.0" }
    cloudspectra = { source = "cloudspectra/cloudspectra" }
  }
}

provider "aws" { region = "us-east-1" }

# Deploy the CloudFormation stack
resource "aws_cloudformation_stack" "cloudspectra" {
  name         = "cloudspectra-gateway"
  template_url = "TEMPLATE_URL_FROM_MARKETPLACE"
  capabilities = ["CAPABILITY_IAM", "CAPABILITY_NAMED_IAM"]

  parameters = {
    newOrExistingVpc   = "selectExisting"
    existingVpcId      = "vpc-0123456789abcdef0"
    availabilityZone1  = "a"
    instance0000type   = "c6in.large"
    clientCidrBlock    = "10.0.0.0/8"
  }
}

# Configure the gateway via the Cloud Spectra provider
provider "cloudspectra" {
  gateway_url    = aws_cloudformation_stack.cloudspectra.outputs["AccessElasticIp"]
  admin_password = var.cloudspectra_admin_password
}

# Enable NAT with port forwarding
resource "cloudspectra_nat_gateway" "main" {
  enable = true
}

# Enable firewall (Security tier)
resource "cloudspectra_firewall_gateway" "main" {
  enable            = true
  firewall_policies = ["my-fw-policy"]
}