This page lists what Cloud Spectra Gateway 1.0 does not include, and the limits that apply to it, so you can plan around them. Everything else in the User Guide ships in 1.0. Where a feature is described as switched off, the 1.0 configuration schema allows only false for its setting.
If one of these blocks you, tell us at support@cloudspectra.ai -- what customers ask for decides what we build next.
Deployment and delivery
| Item | In 1.0 |
|---|
| CloudFormation template and 1-click deploy page | Not provided. Deploy with Terraform; the AWS Marketplace listing delivers the AMI only. |
| Choosing the lane in Terraform | The AWS module has no lane input. The lane is the Marketplace listing whose product ID you set in tier_product_ids (see the Quick Start). |
| Your own AMI | The module always resolves the Marketplace AMI; image_ami_id has no effect in customer accounts. |
| Graviton instance families | Only t4g, c6gn, c7gn, c8gn and m8gn select the Graviton AMI by default; add other families to arm64_instance_families. |
| Zones 2 to 6 | Terraform builds compute for the first zone only; add further zones from the dashboard or API. Their resources are not in Terraform state. |
| Teardown | terraform destroy does not remove what the gateway created at run time; run VPC Cleanup first. |
| Changing the dashboard port after deployment | The module does not update the security group rule; choose the port at the first apply. |
Load balancing and TLS termination
| Item | In 1.0 |
|---|
| L4 load balancing (IPVS, synced from an AWS Network Load Balancer) | Switched off (nlbGateway.enable). |
| L7 load balancing (HAProxy, Kubernetes ingress) | Switched off (albGateway.enable). |
| TLS termination with an ACM certificate on port 443 | Not available: it is configured on the two load balancers above. |
| Client source-address preservation through the load balancer | Switched off. |
| Your own or an ACM certificate on the dashboard | Not supported; the dashboard uses a per-instance self-signed certificate. |
Inbound traffic to private targets is supported through port forwarding.
High availability and scaling
| Item | In 1.0 |
|---|
| Elastic IP pool with fast failover between instances | Not included. The master Elastic IP moves only when a new master takes over. |
| Runtime virtual IP and load-aware VIP rebalancing | Not included (vipPool.dynamicRebalance is switched off). |
| Spot Instances | Not available: instance.spot, asg.enableSpotToOnDemandSwitch and asg.enableMixedInstancePolicy are switched off, and ElasticApps has no Spot option. Instances run On-Demand. |
| Quick convergence (pre-allocated addresses) | Switched off (asg.quickConvergence). |
| Predictive scaling | Not part of 1.0; scaling reacts to measured load. elasticApps.predictiveScaling is switched off, and the Predictive tab in the gateway's Autoscale Config dialog is outside the 1.0 feature set. |
| Per-slot sticky ENI and EBS pools (one per Auto Scaling slot) | Switched off. The sticky ENI and the sticky EBS volume attach to each Auto Scaling group's lead instance only. |
| Sticky EBS across zones | A sticky EBS volume stays in its Availability Zone; it protects against instance loss, not zone loss. |
Transit, VPN and multi-cloud networking
| Item | In 1.0 |
|---|
| Cross-account and cross-Region VPC management, VPC peering mesh, hub-and-spoke overlay | Switched off (transitGateway.enable). The dashboard's Transit Manager group shows VPC, peering, prefix-list and route-table inventory. |
| Site-to-site and hub-and-spoke WireGuard VPN, and OIDC/SSO sign-in for it | Not included (vpnGateway.enable is switched off). |
| Multi-cloud WireGuard mesh from the gateway | Switched off (multiCloud.enable). For cross-cloud connectivity, use the relay: CloudVpc and CloudConnector. |
| Upstream proxy client, Cloud Spectra load-balancer client, discovery service, multi-tenancy | Switched off. |
| VPC Flow Logs capture | Not included. |
Kubernetes
| Item | In 1.0 |
|---|
| Kubernetes control plane on the gateway, multi-VPC worker provisioning, cross-account Karpenter | Switched off (kubernetes.enable). The image carries a Kubernetes worker stack (containerd, kubeadm and kubelet, Calico; on GPU instances the NVIDIA driver, CUDA and vLLM), but joining workers to the gateway's control plane is not available. |
| Single-node Kubernetes | Available as an ElasticApps app (k3s). |
Security features
| Item | In 1.0 |
|---|
| Bring-your-own commercial rulesets (ET Pro, Talos) | Not included. ET Open and the community feeds are the rule sources. |
| abuse.ch ThreatFox and URLhaus feeds | Skipped: their publisher withdrew the unauthenticated exports. Feodo Tracker, SSLBL, CINS Army and Spamhaus DROP are used. |
| Malware sandbox submission | Switched off (firewallGateway.sandbox.enabled). |
| Distributing the TLS inspection CA to your workloads | The gateway installs its CA only on its own instances. Install it on your workloads yourself -- with the SSM document it publishes, or by hand for containers, Kubernetes pods and on-premises clients. |
| Suricata failure behavior | Inline inspection fails open: if Suricata stops, traffic flows uninspected. |
| Antivirus engine | ClamAV is installed from the Debian repositories when you enable scanning; the gateway needs outbound access to them, and downloads pass unscanned until the install succeeds. |
| Firewall events in SIEM export | Export covers Suricata alerts and the audit log, over TCP or UDP without TLS; nftables drops are not exported. |
AI gateway
| Item | In 1.0 |
|---|
Local inference on GPUs behind the gateway (vLLM, local/<model>) | Switched off (aiGateway.localInference.enabled). |
| Prompt audit logging | Not included. auditLogEnabled records request metadata, not prompt text. |
| PII detection on prompts, anomaly detection, AI-suggested firewall rules | Not included. |
| Bedrock permissions for the AI gateway | The 1.0 module does not grant the instance role Bedrock access; add it yourself to route requests to Bedrock (see AI gateway). |
| Exact-match cache scope | Serves non-streaming requests at temperature 0 only. |
| Semantic cache embeddings | Computed with OpenAI's embedding model, using the OpenAI key on the request. |
Observability
| Item | In 1.0 |
|---|
| Grafana fleet dashboards in the gateway dashboard | Not included. The collector (node-exporter, Prometheus) runs by default; the dashboard has no Grafana view. |
| Legacy analytics stack | Switched off (analytics.enable). |
Logs and metrics go to CloudWatch in your account; see Monitoring and logs.
Lanes, instances and Regions
| Item | Limit |
|---|
| Developer lane | At most 16 vCPU running per AWS account. An instance beyond that is refused and does not carry traffic; instances already running continue. |
| Enterprise lane | At least 4 vCPU per instance; smaller instance types are not on the listing. |
| Billing per instance | Only the first 64 vCPUs of an instance count, and the second one is free -- so an instance bills at most 63 vCPUs, and 1- and 2-vCPU instances cost the same. |
| Cloud | The gateway's Marketplace listings are for AWS. The relay modes run on other clouds too; see their pages. |
| Availability Zones | One to six per deployment, in one Region. |
| Instance families | Network-optimized, compute and GPU families are on the listings. Small instances with 2 GiB of memory leave little room for ClamAV if you enable antivirus. |
Running without an IAM role
An instance launched from the listing in the EC2 console, with no IAM role, runs the dashboard and NAT on the instance itself and keeps its configuration on the instance. The firewall, TLS inspection, SIEM export and AI gateway need an IAM instance role, and features that change your VPC -- the per-zone data plane, extra zones, the Gateway Load Balancer, Elastic IPs, ElasticApps -- need the operational roles that the Terraform deployment creates.
| Item | In 1.0 |
|---|
| IMDSv2 | Instances launched by the Terraform module require IMDSv2. The AMI itself is not registered as IMDSv2-only; when you launch it from the console, choose IMDSv2 only. |
| Connection to Cloud Spectra | Instances need outbound HTTPS to the Cloud Spectra entitlement service, checked every 20 minutes. A running instance continues for 72 hours without it. |
| Dashboard users | One user, admin, with a password. There is no single sign-on. |
| SIEM transport | Plain TCP or UDP. |