Deploy the Stack

Via AWS Console

1. Open the CloudFormation console in your target AWS region.

2. Choose Create stack → With new resources (standard).

3. Under Specify template, choose Upload a template file and select the Yeedu CFT YAML file.

4. Choose Next.

5. Enter a Stack name. Use a short, lowercase, hyphenated name — it is used as a prefix for all resource names.

   • Example: yeedu-prod

6. Fill in all parameters. Refer to CFT Parameters for guidance on each field.

7. Choose Next through the Configure stack options screen (defaults are fine).

8. On the Review page, scroll to the bottom and check both acknowledgement boxes:

   • I acknowledge that AWS CloudFormation might create IAM resources.
   • I acknowledge that AWS CloudFormation might create IAM resources with custom names.

9. Choose Create stack.

10. Monitor progress in the Events tab. Stack creation takes 30–60 minutes on a first-time deployment with iPullYeeduSoftwares = true.

caution

The EC2 instance creation depends on YeeduSetupLambdaInvoke completing successfully (DependsOn: YeeduSetupLambdaInvoke). CloudFormation waits for the Lambda custom resource to signal completion before creating EC2. If Lambda exceeds 900 seconds, the stack rolls back. See Troubleshooting.

---

Via AWS CLI

Replace placeholder values before running:

aws cloudformation create-stack \
  --stack-name yeedu-prod \
  --template-body file://yeedu-cft.yaml \
  --capabilities CAPABILITY_IAM CAPABILITY_NAMED_IAM \
  --parameters \
    ParameterKey=aVpcId,ParameterValue=vpc-0abc1234 \
    ParameterKey=bPublicSubnet1Id,ParameterValue=subnet-pub1aaaa \
    ParameterKey=bPublicSubnet2Id,ParameterValue=subnet-pub2bbbb \
    ParameterKey=bPublicSubnet3Id,ParameterValue=subnet-pub3cccc \
    ParameterKey=cAvailabilityZone1,ParameterValue=ap-south-1a \
    ParameterKey=cAvailabilityZone2,ParameterValue=ap-south-1b \
    ParameterKey=eUseSSL,ParameterValue=true \
    ParameterKey=eACMCertificateArn,ParameterValue=arn:aws:acm:ap-south-1:123456789012:certificate/xxxx \
    ParameterKey=eCustomDnsName,ParameterValue=app.example.com \
    ParameterKey=fEnvironmentName,ParameterValue=prod \
    ParameterKey=fRDSHighAvailability,ParameterValue=true \
    ParameterKey=gCreateS3Bucket,ParameterValue=true \
    ParameterKey=hCreateEC2Machine,ParameterValue=true \
    ParameterKey=iYeeduVersion,ParameterValue=v2.9.1 \
    ParameterKey=iPullYeeduSoftwares,ParameterValue=true

Monitor stack events:

# Watch all events
aws cloudformation describe-stack-events \
  --stack-name yeedu-prod \
  --query "StackEvents[*].[Timestamp,ResourceStatus,LogicalResourceId,ResourceStatusReason]" \
  --output table

# Filter only failures
aws cloudformation describe-stack-events \
  --stack-name yeedu-prod \
  --query "StackEvents[?ResourceStatus=='CREATE_FAILED']" \
  --output table

Wait for completion:

aws cloudformation wait stack-create-complete --stack-name yeedu-prod
echo "Stack created successfully"

---

Deployment Flow

Resources are created in this sequence, controlled by DependsOn, Condition, and CreationPolicy relationships:

1. Secrets Manager secrets — all service passwords auto-generated (RabbitMQ, Redis, LDAP, Grafana, Vault, InfluxDB, Scheduler, LDAP admin, DB password, config)
2. S3 bucket — YeeduDataBucket created (if gCreateS3Bucket = true)
3. IAM roles — EC2 instance role + Lambda execution role + Yeedu IAM user
4. Networking — NAT Gateway EIP → NAT Gateway → private subnets → route table → routes → subnet associations
5. Security Groups — ALB SG, EC2 SG, YeeduInternal SG, Service SG, EFS SG
6. EFS — file system → mount targets in both private subnets → access point
7. RDS (if fCreateRDS = true) — subnet group → parameter group → DB instance
8. ALB — internet-facing load balancer → target groups (UI, REST API, Functions)
9. Lambda — YeeduSetupLambda function deployed (if iPullYeeduSoftwares = true) 10.YeeduSetupLambdaInvoke — CloudFormation blocks here and waits for Lambda custom resource to complete:
   • Validates S3 bucket access
   • Creates 17 ECR repositories (yeedu_*) with lifecycle policies
   • Creates 10 CloudWatch log groups (yeedu_*)
   • Creates yeedu/ and yeedu_libs/ S3 path prefixes
   • Copies Core-Services-Formation.tar.gz → s3://<bucket>/yeedu/
   • Copies dependency-libs.tar.gz → s3://<bucket>/yeedu_libs/
   • Signals CloudFormation SUCCESS or FAILED
10. EC2 instance (if hCreateEC2Machine = true) — only starts after Lambda SUCCESS. EC2 UserData:
    • Installs cfn-signal, Docker, AWS CLI, CloudWatch agent
    • Creates yeedu OS user
    • Mounts EFS at /mnt/efs
    • Downloads Core-Services-Formation.tar.gz from s3://<bucket>/yeedu/
    • If iPullYeeduSoftwares = true: downloads Docker .tar files from yeedu-softwares S3 → docker load → docker tag → docker push to ECR
    • Writes yeedu-system-config.properties and yeedu-connection.properties
    • Runs ./yeedu-core-services.sh start
    • Signals CloudFormation SUCCESS (CreationPolicy timeout: 60 min)
11. ALB target group registration — EC2 instance (or hExistingEC2MachineID) registered to all three target groups

info

Two-phase software pull: Lambda handles S3 artifact staging (fast, no Docker daemon needed). EC2 handles Docker image loading and ECR push (requires Docker). This split means Lambda's 900-second timeout is used only for S3 copy operations, not image push, reducing timeout risk.

---

Stack Outputs

After successful deployment, retrieve these values from the Outputs tab of the CloudFormation stack:

Output Key	Condition	Description
LoadBalancerURL	hCreateEC2Machine = true	Primary Yeedu UI URL — https://<alb>:8012 (SSL) or http://<alb>:8002 (non-SSL)
RestAPIURL	hCreateEC2Machine = true	REST API endpoint — https://<alb>:8080 or http://<alb>:8080
FunctionsProxyURL	hCreateEC2Machine = true	Functions Proxy endpoint — https://<alb>:8081 or http://<alb>:8081
LoadBalancerDNS	Always	Raw ALB DNS name — use as CNAME target for your custom domain
CustomDNSInstructions	eUseSSL = true	Exact CNAME mapping to configure (e.g., Point app.example.com CNAME to <alb>)
TargetGroupConfiguration	hCreateEC2Machine = true	Summary of port mappings (ALB → EC2)
EC2InstanceId	hCreateEC2Machine = true	EC2 instance ID — use for SSH or SSM Session Manager
NATGatewayEIP	Always	Elastic IP of the NAT Gateway — whitelist this in downstream firewalls
RDSEndpoint	fCreateRDS = true	RDS PostgreSQL endpoint address
EFSFileSystemId	Always	EFS ID — attach additional worker EC2s using this
EFSMountCommand	Always	Ready-to-run mount command for adding EFS to other instances
S3BucketName	Always	Customer data S3 bucket (new or existing)
ECRRepositories	Always	Full list of 17 ECR repository URIs
ECRLoginCommand	Always	aws ecr get-login-password ... command for Docker login
YeeduVersion	Always	The Yeedu version deployed
YeeduAccessURL	hCreateEC2Machine = true	Final UI URL (uses custom domain if eCustomDnsName was set)
YeeduAccessAdminPassword	Always	Secrets Manager secret name containing YSU0000 admin credentials
LogGroupsCreated	Always	List of CloudWatch log groups created

tip

The admin username is YSU0000. The password is stored in Secrets Manager. See Post-Deployment → Retrieve Admin Credentials for the retrieval command.