docs/content/v2024.2/yugabyte-platform/configure-yugabyte-platform/aws.md
Before you can deploy universes using YugabyteDB Anywhere (YBA), you must create a provider configuration. Create an Amazon Web Services (AWS) provider configuration if your target cloud is AWS.
When deploying a universe, YBA uses the provider configuration settings to do the following:
Create VMs on AWS using the following:
Provision those VMs with YugabyteDB software
For more information on setting up an AWS service account and security groups, refer to Cloud permissions to deploy nodes.
Navigate to Integrations > Infrastructure > Amazon Web Services to see a list of all currently configured AWS providers.
To create an AWS provider:
Click Create Config to open the Create AWS Provider Configuration page.
Enter the provider details. Refer to Provider settings.
Click Validate and Save Configuration when you are done and wait for the configuration to validate and complete.
If you want to save your progress, you can skip validation by choosing the Ignore and save provider configuration anyway option, which saves the provider configuration without validating. Note that you may not be able to create universes using an incomplete or unvalidated provider.
The create provider process includes configuring a network, subnetworks in all available regions, firewall rules, VPC peering for network connectivity, and a custom SSH key pair for YBA-to-YugabyteDB connectivity.
To view a provider, select it in the list of AWS Configs to display the Overview.
To edit the provider, select Config Details, make changes, and click Apply Changes. For more information, refer to Provider settings. Note that for YBA version 2.20.1 and later, if the provider has been used to create a universe, you can only edit a subset of fields, including the following:
To view the universes created using the provider, select Universes.
To delete the provider, click Actions and choose Delete Configuration. You can only delete providers that are not in use by a universe.
Enter a Provider name. The Provider name is an internal tag used for organizing provider configurations.
Credential Type. YBA requires the ability to create VMs in AWS. To do this, you can do one of the following:
Use AWS Route 53 DNS Server. Choose whether to use the cloud DNS Server / load balancer for universes deployed using this provider. Generally, SQL clients should prefer to use smart client drivers to connect to cluster nodes, rather than load balancers. However, in some cases (for example, if no smart driver is available in the language), you may use a DNS Server or load-balancer. The DNS Server acts as a load-balancer that routes clients to various nodes in the database universe. YBA integrates with Amazon Route53 to provide managed Canonical Name (CNAME) entries for your YugabyteDB universes, and automatically updates the DNS entry as nodes get created, removed, or undergo maintenance.
You can customize your network, including the virtual network, as follows:
VPC Setup. Choose the VPC setup to use:
Specify an existing VPC. Select this option to use a VPC that you have created in AWS.
Create a new VPC {{<tags/feature/tp>}}. Select this option to create a new VPC using YBA. This option is not recommended for production use cases. If you use this feature and there are any classless inter-domain routing (CIDR) conflicts, the operation can fail silently. This would include, for example, doing the following:
To use this option, contact {{% support-platform %}}.
Click Add Region to add a region to the configuration.
For information on configuring your regions, see Add regions.
Specify the machine images to be used to install on nodes of universes created using this provider.
To add machine images recommended and provisioned by YBA, select the Include Linux versions that are chosen and managed by YugabyteDB Anywhere in the catalog option, and choose the architectures.
To add your own machine images to the catalog:
Click Add Linux Version.
Provide a name for the Linux version. You can see this name when creating universes using this provider.
Choose a CPU architecture.
Enter the Amazon Machine Image (AMI) ID to use for each provider region.
Provide the SSH user and port to use to access the machine image OS. Leave this empty to use the default SSH user.
To configure instances so that the Instance Metadata Service requires IMDSv2, select the Use IMDSv2 option (recommended). If Use IMDSv2 is not selected, the service accepts both IMDSv1 and IMDSv2 requests.
Click Add Linux Version.
To edit custom Linux versions, remove Linux versions, and set a version as the default to use when creating universes, click ... for the version you want to modify.
To be able to provision Amazon Elastic Compute Cloud (EC2) instances with YugabyteDB, YBA requires SSH access.
Enter the SSH user and port to use by default for machine images. You can override these values for custom Linux versions that you add to the Linux Version Catalog.
You can manage SSH key pairs in the following ways:
If you use YBA to manage SSH Key Pairs for you and you deploy multiple YBA instances across your environment, then the AWS provider name should be unique for each instance of YBA integrating with a given AWS account.
If you are using a YBA-managed AMI and plan to use the us-gov-east-1 and us-gov-west-1 regions, you must set the SSH user to centos as these regions use CentOS 7 (as opposed to the default Alma 8 used for other regions). If you don't set the SSH user accordingly, universe deployment to these regions will fail.
You can customize the Network Time Protocol server, as follows:
Select Use AWS's NTP server to enable cluster nodes to connect to the AWS internal time servers. For more information, consult the AWS documentation such as Keeping time with Amazon time sync service.
Select Specify Custom NTP Server(s) to provide your own NTP servers and allow the cluster nodes to connect to those NTP servers.
Select Assume NTP server configured in machine image to prevent YBA from performing any NTP configuration on the cluster nodes. For data consistency, you will be responsible for manually configuring NTP.
{{< warning title="Important" >}}
Use this option with caution. Time synchronization is critical to database data consistency; failure to run NTP may cause data loss.
{{< /warning >}}
For deployment, YBA aims to provide you with access to the many regions that AWS makes available globally. To that end, YBA allows you to select which regions to which you wish to deploy.
If you choose to use VPCs that you have configured, you are responsible for having preconfigured networking connectivity. For single-region deployments, this might just be a matter of region or VPC local Security Groups. Across regions, however, the setup can get quite complex. It is recommended that you use the VPC peering feature of Amazon Virtual Private Cloud (Amazon VPC) to set up private IP connectivity between nodes located across regions, as follows:
To configure a region using your own custom VPCs, click Add Region and do the following:
For each availability zone in which you wish to be able to deploy in the region, do the following:
If you did not provide your own custom AMI IDs, before you can proceed to creating a universe, verify that you can actually spin up EC2 instances with the default AMIs in YBA.
While logged into your AWS account, do the following:
If you are not already subscribed and have not accepted the Terms and Conditions, then you should see the following message:
If that is the case, click Accept Terms and wait for the page to switch to a successful state. After the operation completes, or if you previously subscribed and accepted the terms, you should see a message similar to the following: