Prerequisites

The following components are required prior to launching the Yeedu CloudFormation stack. These are commonly present in most AWS environments, but if any are missing, follow the guides below.

1. VPC & Subnets
2. ACM Certificate (HTTPS only)
3. IAM Permissions for Deployment
4. Software Pull — S3 Access

---

VPC & Subnets

info

Optional — only required if a VPC is not already present, or if you want to deploy Yeedu in a new VPC.

The CFT requires an existing VPC with the following subnet layout:

Subnet Type	Count	Purpose
Public subnets	3 (across 3 AZs)	NAT Gateway (subnet 1) + ALB (all 3)
Private subnets	2 (across 2 AZs)	EC2, RDS, EFS — created by CFT or supply existing IDs

Create a VPC (if needed)

1. Open the Amazon VPC console at https://console.aws.amazon.com/vpc/

2. On the VPC dashboard, choose Create VPC.

3. For Resources to create, choose VPC and more.

4. For IPv4 CIDR block, enter an IPv4 address range for the VPC. Example: 172.31.0.0/16.

5. For Number of Availability Zones (AZs), provision subnets in at least 3 AZs so the ALB can span them.

6. Set Number of public subnets to 3 and Number of private subnets to 2.

7. For the NAT Gateway, choose 1 per AZ for production or In 1 AZ for dev/staging.

   caution

   NAT Gateways incur additional hourly and data transfer charges. See NAT Gateway pricing.

8. Choose Create VPC.

tip

Note down the VPC ID, all public subnet IDs, and the AZ names of your private subnets — these are required CFT parameters.

Private Subnet Options

The CFT offers two modes via the cCreatePrivateSubnets parameter:

Option A — Create new private subnets (default: true)

Supply the following parameters and the CFT creates subnets, route table, and NAT routes automatically:

• cPrivateSubnet1CIDR — default 172.31.128.0/25
• cPrivateSubnet2CIDR — default 172.31.128.128/25
• cAvailabilityZone1 — e.g., ap-south-1a
• cAvailabilityZone2 — e.g., ap-south-1b

caution

The default CIDRs assume a 172.31.0.0/16 VPC. Adjust them if your VPC uses a different range. CIDRs must not overlap with any existing subnet in the VPC.

Option B — Use existing private subnets (cCreatePrivateSubnets = false)

Set cCreatePrivateSubnets = false and provide:

• cExistingPrivateSubnet1Id
• cExistingPrivateSubnet2Id

The existing subnets must already route outbound traffic through a NAT Gateway.

---

ACM Certificate (HTTPS only)

info

Optional — only required if eUseSSL = true (default).

The Application Load Balancer (ALB) terminates TLS using an ACM certificate. The certificate must:

• Be issued in the same AWS region as the CloudFormation stack
• Be in the ISSUED state before stack launch
• Cover your custom domain (e.g., app.example.com or *.example.com)

Create an ACM Certificate (if needed)

1. Open the ACM console in your target region.
2. Choose Request a certificate → Request a public certificate.
3. Enter your domain name (e.g., app.yeedu.example.com).
4. Choose DNS validation (recommended) and complete the CNAME validation steps.
5. Once status shows Issued, copy the Certificate ARN.

tip

Supply the Certificate ARN as eACMCertificateArn in the CFT parameters. After deployment, point a CNAME DNS record from your custom domain to the ALB DNS name shown in the stack Outputs tab.

---

IAM Permissions for Deployment

The AWS IAM principal (user or role) that deploys the CloudFormation stack must have permissions to create all resource types used by the template.

At minimum, the deploying principal needs:

ec2:*
iam:CreateRole
iam:AttachRolePolicy
iam:CreatePolicy
iam:PassRole
iam:CreateInstanceProfile
iam:AddRoleToInstanceProfile
iam:CreateUser
iam:CreateAccessKey
rds:*
secretsmanager:*
elasticfilesystem:*
s3:CreateBucket
s3:PutBucketPolicy
s3:PutEncryptionConfiguration
lambda:CreateFunction
lambda:InvokeFunction
lambda:GetFunction
cloudformation:*
ecr:CreateRepository
logs:CreateLogGroup

caution

If your organization uses Service Control Policies (SCPs), verify that none of the above actions are denied at the organization or OU level before launching the stack. Pay special attention to iam:CreateUser and iam:CreateAccessKey — these are often restricted and are needed to create the Yeedu service IAM user.

---

Software Pull — S3 Access

When iPullYeeduSoftwares = true (default), the CFT runs a two-phase software pull:

Phase 1 — Lambda (YeeduSetupLambda)

A Lambda function runs as a CloudFormation Custom Resource before EC2 is created. It:

1. Creates 10 CloudWatch log groups for Yeedu services
2. Creates 17 ECR repositories with scan-on-push and lifecycle policies
3. Creates S3 path prefixes (yeedu/, yeedu_libs/) in the target bucket
4. Copies Core-Services-Formation.tar.gz and dependency-libs.tar.gz from the Yeedu-managed bucket yeedu-softwares to your S3 bucket

Phase 2 — EC2 UserData

After Lambda completes and EC2 boots, the UserData script:

1. Downloads Core-Services-Formation.tar.gz from your S3 bucket (s3://<bucket>/yeedu/)
2. Downloads Docker image .tar files from s3://yeedu-softwares/releases/<version>/docker_images_tars/
3. Runs docker load, docker tag, and docker push to seed your ECR repositories

Component	Source Bucket	Actions
Lambda	yeedu-softwares (Yeedu-managed)	Copy artifacts to customer S3
EC2 UserData	yeedu-softwares	Download + load + push Docker images to ECR
EC2 UserData	Customer S3	Download Core-Services-Formation.tar.gz

info

Lambda runs in the AWS-managed network environment (not inside your VPC), so no VPC endpoint or NAT Gateway configuration is needed for the Lambda S3 copy step. The EC2 instance accesses S3 via the NAT Gateway in the private subnet.

tip

Set iPullYeeduSoftwares = false for re-deployments or upgrades where ECR images are already populated and artifacts are already in your S3 bucket. This skips both Lambda artifact copy and EC2 docker load/push, reducing deployment time significantly.