Cloud Spectra Gateway -- Quick Start v1.0.0

1. Overview

Cloud Spectra Gateway is an AWS networking appliance that deploys entirely into your own AWS account. It replaces metered AWS networking and LLM-API spend with a fixed EC2 cost -- your cloud, off the meter. All traffic and configuration stay inside your account: there is no vendor control plane and no data leaves your boundary.

You subscribe on the AWS Marketplace, launch a CloudFormation stack, and within minutes you have a running gateway with a management dashboard. Outbound NAT works immediately; you turn on additional features from the dashboard as you need them.

Cloud Spectra Gateway replaces the AWS services you are currently metered on with in-appliance equivalents:

Cloud Spectra ships as three stacking tiers -- Network, Security, and AI Gateway -- where each higher tier includes everything in the one below it. For the full breakdown of every feature and how it works, see the User Guide; for how the appliance is assembled internally, see the Architecture guide.

Deployment flow at a glance

graph TD
    MP["AWS Marketplace
subscribe to a tier"] --> CF["CloudFormation stack
new-VPC or existing/BYO-VPC"]
    CF --> ASG["Per-AZ Auto Scaling Group
one ASG per Availability Zone"]
    ASG --> GWLB["Gateway Load Balancer (GENEVE)
horizontal scale"]
    GWLB --> EIP["Elastic IP
stable endpoint"]
    EIP --> DASH["HTTPS dashboard
port 443 (HAProxy + ACM)"]
    DASH --> DONE["Login & configure"]
    style MP fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a
    style CF fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a
    style DONE fill:#d1fae5,stroke:#10b981,color:#065f46

2. Prerequisites

To complete this quick start you need:

• An AWS account where you can subscribe on the Marketplace and create resources.
• A chosen AWS Region to deploy into (any commercial region works).
• Permissions to create CloudFormation stacks and the resources they create: EC2 instances, VPC networking, IAM roles, Auto Scaling groups, and an Elastic IP.
• An EC2 key pair in the launch Region (used for SSH access and to retrieve the one-time dashboard password).
• Optional: an AWS Certificate Manager (ACM) certificate if you want the dashboard and TLS termination to serve a trusted certificate instead of the default self-signed one.

3. Choose a deployment

Cloud Spectra Gateway supports three deployment methods. This quick start focuses on the Marketplace 1-click CloudFormation path; the other two are covered in detail in the User Guide.

CloudFormation: new VPC vs existing/BYO VPC

The Marketplace listing offers two CloudFormation templates. Pick the one that matches your environment:

• New-VPC template -- Cloud Spectra creates a fresh VPC, subnets, route tables, and an internet gateway for you. This is the simplest starting point and is the default.
• Existing / BYO-VPC template -- Cloud Spectra deploys into a VPC and subnets you already operate. Use this for production accounts where the network is already established.

4. Deploy via CloudFormation

Estimated time: 8-10 minutes

5. First login

# SSH in as user "admin" with your EC2 key pair
ssh -i ~/.ssh/your-key.pem admin@<ELASTIC_IP>

# Read the one-time dashboard init password
cat /opt/cloudspectra/conf/dashboard_init_pw

6. NAT works out of the box

As soon as the stack reaches CREATE_COMPLETE, source NAT is already running on the appliance -- no configuration step is required. Private instances whose route tables point default traffic at the Cloud Spectra ENI immediately reach the internet through the gateway's Elastic IP.

graph LR
    subgraph VPC["Your VPC"]
        PRIV["Private subnet instances
(no public IP)"]
        GW["Cloud Spectra Gateway
sNAT on per-AZ ENI"]
    end
    EIP["Elastic IP
(stable egress)"]
    NET["Internet"]
    PRIV -->|"0.0.0.0/0 route"| GW
    GW --> EIP
    EIP --> NET
    style GW fill:#d1fae5,stroke:#10b981,color:#065f46
    style EIP fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a

# From a private instance routed through Cloud Spectra:
curl -s https://checkip.amazonaws.com

# The returned IP should match the gateway's Elastic IP
# (the AccessElasticIp value from the stack Outputs).

7. Enable a feature

Every additional capability is turned on the same way: from the dashboard (or the config API on port 8080, or the Terraform provider). Per-feature configuration reference -- including firewall rules, the Squid proxy, TLS termination, the AI Gateway, and local vLLM inference -- lives in the User Guide. Here is the pattern using one Network-tier feature, the forward HTTP proxy.

flowchart LR
    A["Dashboard (HTTPS 443)"] --> B["Toggle a feature on"]
    B --> C["Config saved to
SSM Parameter Store"]
    C --> D["Gateway nodes reconcile
and apply the change"]
    D --> E["Feature live
on all AZs"]
    style A fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a
    style E fill:#d1fae5,stroke:#10b981,color:#065f46

# Send outbound traffic through the Cloud Spectra forward proxy
export http_proxy=http://proxyuser:secret@<GATEWAY>:<PROXY_PORT>
export https_proxy=$http_proxy
curl -s https://checkip.amazonaws.com

Key ports

8. Verify

A quick end-to-end check confirms the gateway is healthy and routing correctly.

If outbound traffic does not return the gateway's Elastic IP, confirm the private subnet's route table sends 0.0.0.0/0 to the Cloud Spectra ENI for that AZ. Common questions and troubleshooting are collected in the FAQ.

9. Next steps

You now have a running Cloud Spectra Gateway with NAT live and a feature enabled. Where to go from here: