Post-Deployment

After the CloudFormation stack reaches CREATE_COMPLETE, complete the following steps.

---

1. Configure DNS

If you set eCustomDnsName (e.g., app.example.com), create a DNS CNAME record:

app.example.com  CNAME  <LoadBalancerDNS output value>

Get the ALB DNS name from the stack Outputs tab (LoadBalancerDNS) or via CLI:

aws cloudformation describe-stacks \
  --stack-name yeedu-prod \
  --query "Stacks[0].Outputs[?OutputKey=='LoadBalancerDNS'].OutputValue" \
  --output text

Once DNS propagates, the Yeedu UI is available at:

SSL	URL
eUseSSL = true	https://app.example.com:8012
eUseSSL = false	http://<alb-dns>:8002

tip

DNS propagation can take a few minutes. Verify with nslookup app.example.com or dig app.example.com.

---

2. Retrieve Admin Credentials

The Yeedu admin account username is YSU0000. The password is auto-generated and stored in AWS Secrets Manager.

# Replace yeedu-prod with your actual stack name
aws secretsmanager get-secret-value \
  --secret-id yeedu-prod-prod-ldap-ysu0000-admin-secret \
  --query SecretString \
  --output text | jq -r '.ldap_ysu0000_admin_password'

info

The secret name follows the pattern: <stack-name>-<fEnvironmentName>-ldap-ysu0000-admin-secret

For example, stack name yeedu-prod with fEnvironmentName = prod → secret name is yeedu-prod-prod-ldap-ysu0000-admin-secret.

---

3. Access the Yeedu UI

Open a browser and navigate to the YeeduAccessURL from the stack Outputs tab.

Log in with:

• Username: YSU0000
• Password: Retrieved from Secrets Manager in the step above

---

4. Restrict SSH Access

By default, the EC2 Security Group allows SSH (port 22) from 0.0.0.0/0. Restrict this in production.

Option A — Restrict to your corporate CIDR:

# Get the EC2 security group ID
EC2_SG=$(aws cloudformation describe-stack-resources \
  --stack-name yeedu-prod \
  --query "StackResources[?LogicalResourceId=='EC2SecurityGroup'].PhysicalResourceId" \
  --output text)

# Remove the open SSH rule
aws ec2 revoke-security-group-ingress \
  --group-id $EC2_SG \
  --protocol tcp --port 22 --cidr 0.0.0.0/0

# Add your corporate CIDR
aws ec2 authorize-security-group-ingress \
  --group-id $EC2_SG \
  --protocol tcp --port 22 --cidr 203.0.113.0/24

Option B — Use SSM Session Manager (no open port 22 needed):

aws ssm start-session --target <EC2InstanceId from Outputs>

The EC2 instance role has CloudWatchAgentServerPolicy attached. To enable SSM, attach AmazonSSMManagedInstanceCore to the EC2 role separately or add it to the CFT before deployment.

---

5. Verify Services are Running

SSH or SSM into the EC2 instance and check all Yeedu containers:

sudo docker ps --format "table {{.Names}}\t{{.Status}}\t{{.Ports}}"

All containers should show Up status. If any container is Exited, check its logs:

sudo docker logs <container_name> --tail 100

The Core-Services-Formation is extracted to /opt/yeedu-software/Core-Services-Formation/.

---

6. Attach YeeduInternalSG to Worker Instances

Any Spark worker EC2 instances that Yeedu provisions must be attached to the YeeduInternalSG security group. This allows:

• EFS (NFS port 2049) access from workers
• Internal service communication on Yeedu ports (8003–8011, 8086, 8200, 8765)

Get the YeeduInternalSG ID:

aws cloudformation describe-stack-resources \
  --stack-name yeedu-prod \
  --query "StackResources[?LogicalResourceId=='YeeduInternalSG'].PhysicalResourceId" \
  --output text

Configure this SG ID in your Yeedu workspace settings so it is automatically attached to all worker nodes.

---

7. Verify S3 Artifact Paths

After a successful deployment with iPullYeeduSoftwares = true, your S3 bucket should contain:

S3_BUCKET=$(aws cloudformation describe-stacks \
  --stack-name yeedu-prod \
  --query "Stacks[0].Outputs[?OutputKey=='S3BucketName'].OutputValue" \
  --output text)

aws s3 ls s3://$S3_BUCKET/yeedu/
# Expected: Core-Services-Formation.tar.gz

aws s3 ls s3://$S3_BUCKET/yeedu_libs/
# Expected: dependency-libs.tar.gz

---

8. Enable RDS Password Rotation (Recommended)

aws secretsmanager rotate-secret \
  --secret-id yeedu-prod-prod-db-secret \
  --rotation-rules AutomaticallyAfterDays=30

---

Resources Created Summary

Resource Type	Count	Deletion Policy
EC2 Instance	0 or 1	Deleted (if hCreateEC2Machine = true)
NAT Gateway + EIP	1	Deleted
Private Subnets	0 or 2	Deleted (if cCreatePrivateSubnets = true)
Security Groups	4	Deleted
Application Load Balancer	1	Deleted
ALB Target Groups	3	Deleted
ALB Listeners	3	Deleted
EFS File System + Mount Targets	1 + 2	Deleted
S3 Bucket	0 or 1	Retained (if gCreateS3Bucket = true)
RDS Instance	0 or 1	Final snapshot taken (if fCreateRDS = true)
IAM Role (EC2)	1	Deleted
IAM Role (Lambda)	0 or 1	Deleted (if iPullYeeduSoftwares = true)
IAM User + Access Key	1	Deleted
IAM Managed Policy	1	Deleted
Secrets Manager Secrets	10	Deleted
Lambda Function	0 or 1	Deleted (if iPullYeeduSoftwares = true)
ECR Repositories	17	Retained
CloudWatch Log Groups	10	Retained

caution

The S3 bucket (DeletionPolicy: Retain), ECR repositories, and CloudWatch log groups are not deleted when the stack is deleted. Remove them manually if no longer needed, or they will continue to incur storage costs.