---
schema_version: "1"
id: 546edeaf907cd7c02eeac454d517398ac8bfa3fbcf4150396d271c3c8b793865
title: AWS Prerequisites
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/private-cloud/3.2/prereq-aws-terraform.md
canonical_url: https://docs.mulesoft.com/private-cloud/3.2/prereq-aws-terraform
source_site: docs.mulesoft.com
content_type: documentation
content_hash: 753762dd9cc54757b4ede40edfecbcf2a05e628610bb40d0ab13ef5b78ab286d
description: MuleSoft Documentation Site
release: "3.2"
latest: false
---
---
product: Anypoint Platform Private Cloud Edition
version: 3.2
---

# AWS Prerequisites

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

If you are using Amazon Web Services (AWS), you must create the resources required to install
Anypoint Platform Private Cloud Edition (Anypoint Platform PCE) on AWS. Anypoint Platform PCE
supports 4-node and 7-node configurations in a production environment on AWS.

You do not need this information if you are starting from bare metal servers.

> [!IMPORTANT] Your infrastructure team, or someone with AWS administrator level knowledge, must
> perform the following tasks. If needed, contact your MuleSoft representative for help.

## AWS Account Permissions and Resources

To install Anypoint Platform PCE on AWS:

- Your AWS account must have AWS keys with `EC2FullAccess` and `S3FullAccess` permissions.

- When you create your AWS environment, the following resources are created:

  <table><caption>Table 1. AWS-Created Resources</caption> <colgroup><col> <col> <col> <col></colgroup><thead><tr><th>AWS Resource</th><th>Number Required (4-node)</th><th>Number Required (7-node)</th><th>Anypoint Monitoring (Optional)</th></tr></thead><tbody><tr><td><p>m5.8xlarge</p></td><td><p>0</p></td><td><p>0</p></td><td><p>3</p></td></tr><tr><td><p>m5.2xlarge</p></td><td><p>4</p></td><td><p>7</p></td><td><p>0</p></td></tr><tr><td><p>root disk @ 500 iops</p></td><td><p>4</p></td><td><p>7</p></td><td><p>3</p></td></tr><tr><td><p>EBS volumes @ 1500 iops</p></td><td><p>8</p></td><td><p>14</p></td><td><p>12</p></td></tr><tr><td><p>EBS volume @ 3000 iops</p></td><td><p>8</p></td><td><p>14</p></td><td><p>0</p></td></tr><tr><td><p>Amazon ELB</p></td><td><p>1</p></td><td><p>1</p></td><td><p>0</p></td></tr><tr><td><p>t2.medium</p></td><td><p>1</p></td><td><p>1</p></td><td><p>0</p></td></tr></tbody></table>

## Run the AWS Provisioner

MuleSoft provides a Docker image that you can use to provision the resources for your AWS account.
You can also run additional custom shell scripts on the provisioned instances as shown in the Custom
provisioning scripts section.

1.  Create an initial instance (t2.small) on your AWS account on any VPC with internet access.

    This instance runs the actual provisioning of the cluster. You must use an AMI that has Docker
    installed by default or you must manually install Docker after creating the AWS instance.

    You can also run provisioner remotely from any other machine with Docker and internet access.

2.  Download the Private Cloud Provisioner (PCP) Docker image from:

    `[https://anypoint-anywhere.s3.amazonaws.com/pcp/private-cloud-provisioner-3.1.14.tar.gz?Signature=jB4UiQgzsSSE3iyaPWYNJ67dCyM%3D&AWSAccessKeyId=AKIAI6LBJNQFR2V3CQWQ&Expires=1801445392](https://anypoint-anywhere.s3.amazonaws.com/pcp/private-cloud-provisioner-3.1.14.tar.gz?Signature=jB4UiQgzsSSE3iyaPWYNJ67dCyM%3D&AWSAccessKeyId=AKIAI6LBJNQFR2V3CQWQ&Expires=1801445392)`

3.  Copy the provisioner Docker image to the instance via SCP:

    scp -i <guest>.pem ~/Downloads/private-cloud-provisioner-3.1.14.tar.gz
    ec2-user@W.X.Y.Z:/home/ec2-user

4.  SSH into the instance:

    ssh -i 'anypoint.pem' ec2-user@W.X.Y.Z

5.  Create the variable file (pce.env) with the environment details using the following values:

    <table><caption>Table 2. Required Environment Variables</caption> <colgroup><col> <col></colgroup><thead><tr><th>Name</th><th>Description</th></tr></thead><tbody><tr><td><p>AWS_ACCESS_KEY_ID</p></td><td><p>Specifies the AWS access ID Terraform uses to connect to your AWS account.</p></td></tr><tr><td><p>AWS_SECRET_ACCESS_KEY</p></td><td><p>Specifies the AWS access key Terraform uses to connect to your AWS account.</p></td></tr><tr><td><p>AWS_SESSION_TOKEN</p></td><td><p>Specifies the AWS temporary session token, if one exists.</p></td></tr><tr><td><p>AWS_KEY_NAME</p></td><td><p>Specifies the AWS SSH key. Do not include the <code>.pem</code> extension.</p></td></tr><tr><td><p>AWS_REGION</p></td><td><p>Specifies the AWS region where Terraform creates the cluster, for example, <code>us-east-2</code>.</p></td></tr><tr><td><p>TF_VAR_ssh_user=&lt;SSH_USER&gt;</p></td><td><p>Specifies the ssh user, for example, <code>ec2-user</code>, <code>centos</code>, etc.</p></td></tr><tr><td><p>TF_VAR_trusted_cidrs_list</p></td><td><p>List of trusted CIDRs that can be accessed from the environment. Use <code>[0.0.0.0/0]</code> to open the cluster to the internet.</p></td></tr><tr><td><p>TELEKUBE_CLUSTER_NAME</p></td><td><p>Specifies the name of the cluster and the corresponding AWS resources.</p></td></tr><tr><td><p>TELEKUBE_NODE_PROFILES</p></td><td><p>Must be set to <code>node</code>.</p></td></tr><tr><td><p>TELEKUBE_NODE_PROFILE_COUNT_node</p></td><td><p>Specifies the number of nodes in your cluster. Possible values are <code>4</code> and <code>7</code>.</p></td></tr><tr><td><p>TELEKUBE_NODE_PROFILE_INSTANCE_TYPE_node</p></td><td><p>Must be <code>m5.2xlarge</code>.</p></td></tr><tr><td><p>TELEKUBE_NODE_PROFILE_COUNT_node_amv</p></td><td><p>Specifies the number of nodes for the AMV addon in your cluster. Must be <code>3</code> if planning to install the AMV addon. Omit otherwise.</p></td></tr><tr><td><p>TELEKUBE_NODE_PROFILE_INSTANCE_TYPE_node_amv</p></td><td><p>Must be <code>m5.8xlarge</code> if planning to install the AMV addon. Omit otherwise.</p></td></tr><tr><td><p>TF_VAR_high_performance_disks</p></td><td><p>Must be set to <code>true</code> for production environments.</p></td></tr></tbody></table>

    You can also include the following set of optional environment variables:

    <table><caption>Table 3. Optional Environment Variables</caption> <colgroup><col> <col></colgroup><thead><tr><th>Name</th><th>Description</th></tr></thead><tbody><tr><td><p>TF_VAR_ami_name</p></td><td><p>Specifies the AMI name to be used for the instances. Use the AMI name, <strong>NOT</strong> the AMI ID. <strong>Ensure that the AMI does not provision any additional volumes</strong>. If you do not set this variable, the provisioner uses the following AMI by default: <code>RHEL-8.3.0_HVM-20201031-x86_64-0-Hourly2-GP2</code></p></td></tr><tr><td><p>TF_VAR_monitoring=&lt;true or false&gt;</p></td><td><p>If true, creates basic instance alarms in Cloudwatch.</p></td></tr><tr><td><p>TF_VAR_use_bastion=&lt;true or false&gt;</p></td><td><p>If true, creates a small instance (using an ASG) in a public subnet as a jumpbox and associates a public IP address, and launches the cluster instances in the private subnets.</p></td></tr><tr><td><p>TF_VAR_internal=&lt;true or false&gt;</p></td><td><p>If true, the cluster instances are launched in private subnets and do not have public IPs associated with them. Also, the provisioned load balancer is internal only.</p></td></tr><tr><td><p>AWS_VPC_ID=&lt;VPC_ID&gt;</p></td><td><p>Specifies an existing VPC that should already have an internet gateway attached to it. Subnets are still provisioned within the existing VPC.</p></td></tr><tr><td><p>AWS_VPC_CIDR=&lt;VPC_CIDR&gt;</p></td><td><p>Enables you to pass a preferred CIDR for the new VPC to be provisioned. (Requires you to not pass a AWS_VPC_ID).</p></td></tr><tr><td><p>TF_VAR_aws_selected_subnets_ids=&lt;SUBNETS_IDS&gt;</p></td><td><p>Enables you to pass a list of subnets IDs on which the instances are launched. If you reuse your own subnets, you need to set up Route Tables, NAT Gateways, and an Internet Gateway, for example, <code>["subnet-0a17317984065f98f", "subnet-0600b4befb27c7949", "subnet-02103e0c935eff75a"]</code>.</p></td></tr><tr><td><p>TF_VAR_subnets=&lt;PRIVATE_SUBNETS_CIDRs&gt;</p></td><td><p>Enables you to optionally pass the preferred CIDRs blocks for the NEW subnets to be provisioned. You must pass the exact minimum number between the number of AZs of the region and the number of nodes you selected for your cluster, for example, <code>'["10.1.0.0/24", "10.1.1.0/24", "10.1.2.0/24"]'</code>.</p></td></tr><tr><td><p>TF_VAR_public_subnets=&lt;PUBLIC_SUBNETS_CIDRs&gt;</p></td><td><p>Enables you to optionally pass the preferred CIDRs blocks for the NEW subnets to be provisioned. You must pass the exact minimum number between the number of AZs of the region and the number of nodes you selected for your cluster, for example, <code>'["10.1.3.0/24", "10.1.4.0/24", "10.1.5.0/24"]'</code>.</p></td></tr><tr><td><p>TF_VAR_role_tag_value=&lt;AWS_TAG_VALUE_FOR_ROLE_LABEL&gt;</p></td><td><p>Enables you to specify a ROLE tag value to be applied to all AWS resources.</p></td></tr></tbody></table>

6.  Load the provisioner Docker image into the local Docker registry:

    docker load -i private-cloud-provisioner-4.0.13.tar.gz

7.  Perform a dry-run test:

    docker run --rm --env-file pce.env
    artifacts.msap.io/mulesoft/core-paas-private-cloud-provisioner:v4.0.13 dry-run

8.  Run the provisioner:

    docker run --rm --env-file pce.env
    artifacts.msap.io/mulesoft/core-paas-private-cloud-provisioner:v4.0.13 cluster-provision

    After the provisioner runs successfully, it displays information about your environment
    including IP addresses and DNS name of the load balancer.

9.  Verify that the provisioning script ran successfully by checking the existence of
    /var/lib/bootstrap\_complete on the instances

## Custom Provisioning Scripts (Optional)

You can have your own shell scripts to run on the provisioned instances before and/or after the PCE
provisioner scripts. To do so, place your shell scripts with .sh extension inside a folder named
`pre-user-data` and/or `post-user-data`. Include the following volume mounts on the docker run
command:

docker run --rm -v
$(pwd)/pre-user-data:/usr/local/bin/provisioner/terraform/external/pre-user-data -v $(pwd)/post-user-data:/usr/local/bin/provisioner/terraform/external/post-user-data
--env-file pce.env artifacts.msap.io/mulesoft/core-paas-private-cloud-provisioner:v4.0.13
cluster-provision

## Open Port 61009 Before Installation

If you are installing Anypoint Platform PCE using the GUI-based installer, you must enable this port
before running the installer. You must open this port in the cluster’s security group before running
the installer using AWS Web Console.

## Destroy Resources

You can destroy all resources that were created using the provisioner by running the
`cluster-deprovision` command, as shown in the following example. Ensure the `TELEKUBE_CLUSTER_NAME`
environment variable in your environment file has the correct value for the target cluster you want
to destroy:

docker run --rm --env-file pce.env
artifacts.msap.io/mulesoft/core-paas-private-cloud-provisioner:v4.0.13 cluster-deprovision

## Troubleshooting

Review the following information in the event you experience problems when creating AWS resources.

- 403 Forbidden

Check that your keys policies are not denying access to any EC2 or S3 resource. You should be able
to run the following basic command using AWS CLI with your keys:

aws sts get-caller-identity

- Limit exceeded

The AWS account might have some limits set on the amount of resources you can create. Delete some
unused resources or request a limit increase on AWS.

- AMI not found

Make sure you are using the AMI name as the value for the environment variable and not the ID.

## See Also

- [Hardware Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-hardware)

- [Software Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-software)

- [Network Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/prereq-network)

- [NFS Server Prerequisites](https://docs.mulesoft.com/private-cloud/3.2/verify-nfs)

- [Preinstallation Verification](https://docs.mulesoft.com/private-cloud/3.2/prereq-gravity-check)

- [Install Terraform](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli)

- [Linux Bastion Hosts on the AWS Cloud: Quick Start Reference Deployment](https://docs.aws.amazon.com/quickstart/latest/linux-bastion/welcome.html)