<commit_before>---
title: Deploying MicroBOSH to AWS
---

This topic explains how to deploy MicroBOSH to Amazon Web Services (AWS).

##<a id="create-manifest"></a>Step 1: Create a Deployment Manifest ##

The MicroBOSH deployment manifest is a YAML file that defines the components and
properties of the deployment.
Create a manifest for your deployment as follows:

1. Create a local deployment directory to store your manifest.

    <pre class='terminal'>
    $ mkdir ~/my-micro-deployment
    </pre>

1. Create a deployment manifest YAML file.

    The example below is a MicroBOSH deployment manifest template.
	Copy and paste the template into a text editor and save the manifest to your
	deployment directory.

    In the template, you must replace the ELASTIC-IP-ADDRESS,
	MICROBOSH-SUBNET-ID, AVAILABILITY-ZONE, ACCESS-KEY-ID, and SECRET-ACCESS-KEY
	properties. We describe replacing these properties in [Step 2: Prepare an
	AWS Account](#prepare-aws).

    <p class="note"><strong>Note</strong>: The example below has the file name <code>manifest.yml</code>, which we reference in other examples in this topic.</p>

<pre class='code'>
---
name: microbosh

network:
  type: manual
  vip: ELASTIC-IP-ADDRESS # Replace with your Elastic IP address
  ip: 10.0.0.6
  dns: [10.0.0.2]
  cloud_properties:
   subnet: MICROBOSH-SUBNET-ID # Replace with your MicroBOSH Subnet ID

resources:
  persistent_disk: 20000
  cloud_properties:
    instance_type: m1.small
    availability_zone: AVAILABILITY-ZONE # Replace with your Availability Zone

cloud:
  plugin: aws
  properties:
    aws:
      access_key_id: ACCESS-KEY-ID # Replace with your AWSAccessKeyId
      secret_access_key: SECRET-ACCESS-KEY # Replace with your AWSSecretKey
      default_key_name: bosh
      default_security_groups: ["bosh"]
      region: us-east-1
      ec2_private_key: bosh.pem # Path relative to the manifest file

apply_spec:
  agent:
    blobstore: {address: 10.0.0.6}
    nats: {address: 10.0.0.6}
  properties:
    registry: {address: 10.0.0.6}
</pre>

##<a id="prepare-aws"></a>Step 2: Prepare an AWS Account ##

If you do not have an AWS account, [create one](http://goo.gl/MaAybK).

To configure your AWS account for MicroBOSH:

* [Obtain AWS credentials](#credentials)
* [Select an Availability Zone](#availability-zone)
* [Create a Key Pair](#create-key-pair)
* [Create a Virtual Private Cloud](#create-vpc)
* [Create an Elastic IP](#create-eip)
* [Create and configure Security Groups](#create-security)

###<a id="credentials"></a> Obtain AWS Credentials ###

Your AWS credentials consist of an `access_key_id` and a `secret_access_key`.
If you already know your AWS credentials you can skip this step and update
`access_key_id` and `secret_access_key` in your MicroBOSH deployment manifest.

1. Log into the AWS console:
[https://console.aws.amazon.com/console/home](https://console.aws.amazon.com/console/home).

    <%= image_tag("images/micro-aws/aws-console.png") %>

1. Click your account name and select **Security Credentials**.

    <%= image_tag("images/micro-aws/seccred-drop.png") %>

1. In the AWS IAM confirmation box, click **Continue to Security Credentials** to display the Security Credentials page.

    <%= image_tag("images/micro-aws/iam-confirm.png") %>

1. Expand the **Access Keys** section.

    <%= image_tag("images/micro-aws/access-key.png") %>

1. Click **Create New Access Key**.

    <%= image_tag("images/micro-aws/create-key.png") %>

1. In the Create Access Key dialog box, click **Download Key File**.

1. Save the Key File.

1. Close the dialog box.

1. Open the downloaded Key File in a text editor.
Update `access_key_id` and `secret_access_key` in your MicroBOSH deployment manifest with the values from the Key File.

    In the example, the `access_key_id` is _BM456AB123C2GZFTQQHA_ and
    `secret_access_key` is _L2lCSPI9zp7nAzFraZaMonf1OxddoO5Iaaqutx3n_.

    <%= image_tag("images/micro-aws/record-key.png") %>

###<a id="availability-zone"></a>Select an Availability Zone ###

1. In the upper-right corner of the AWS Console, select a Region.

    <%= image_tag("images/micro-aws/select-region.png") %>

1. In the AWS Console, select **EC2**.
The **Availability Zone Status** in the **Service Health** section of the EC2
Dashboard lists usable Availability Zones.
Replace AVAILABILITY-ZONE in your deployment manifest with the one of the usable
**Availability Zones**.

	In this example, usable **Availability Zones** are `us-east-1a`,
	`us-east-1b`, and `us-east-1c`.

    <%= image_tag("images/micro-aws/zones.png") %>

<p class="note"><strong>Note</strong>: Currently, <strong>light</strong> stemcells are only available from the AWS Region of <strong>US East (N. Virginia)</strong>. If you want to use a light stemcell, you must select this region.</strong></p>

###<a id="create-key-pair"></a>Create a Key Pair ###

1. In the AWS Console, select **EC2**.

1. Click **Key Pairs**.

    <%= image_tag("images/micro-aws/key-pairs.png") %>

1. Click **Create Key Pair**.

    <%= image_tag("images/micro-aws/create-key-pair.png") %>

1. In the Create Key Pair dialog box, enter "bosh" as the Key Pair name.

    <%= image_tag("images/micro-aws/name-key-pair.png") %>

1. Click **Create**.

1. Save the `bosh.pem` file.

    <%= image_tag("images/micro-aws/save-pem.png") %>

1. Move the `bosh.pem` file into local deployment directory.
For example, on UNIX run this command:

    <pre class="terminal">
      mv ~/Downloads/bosh.pem ~/my-micro-deployment/bosh.pem
    </pre>

###<a id="create-vpc"></a>Create a Virtual Private Cloud ###

1. On the AWS Console, select **VPC**.

1. Click **Start VPC Wizard**.

    <%= image_tag("images/micro-aws/vpc-wizard.png") %>

1. Select **VPC with a Single Public Subnet** and click **Select**.

1. Complete the VPC form with the following information:
    * **IP CIDR block**: 10.0.0.0/16
    * **VPC name**: microbosh
    * **Public subnet**: 10.0.0.0/24
    * **Availability Zone**: The Availability Zone you selected earlier
    * **Subnet name**: microbosh
    * **Enable DNS hostnames**: Yes
    * **Hardware tenancy**: Default

        <%= image_tag("images/micro-aws/vpc.png") %>

1. Click **Create VPC**.

1. Click **Subnets**.

1. Replace MICROBOSH-SUBNET-ID in your deployment manifest with the **Subnet ID** shown.

    <%= image_tag("images/micro-aws/subnet.png") %>

###<a id="create-eip"></a>Create an Elastic IP ###

1. On the VPC Dashboard, click **Elastic IPs**.

1. Click **Allocate New Address**.

1. In the Allocate Address dialog box, select the **EC2-VPC** network platform.
Click **Yes, Allocate**.

    <%= image_tag("images/micro-aws/allocate-eip.png") %>

1. Replace ELASTIC-IP-ADDRESS in your deployment manifest with the allocated
Elastic IP Address.

###<a id="create-security"></a>Create and Configure Security Groups ###

1. On the VPC Dashboard, click **Security Groups**.

1. Click **Create Security Group**.

1. Complete the Security Group form with the following information:
    * **Name tag**: bosh
    * **Group Name**: bosh
    * **Description**: BOSH Security Group
    * **VPC**: Select the "microbosh" VPC that you created in [Create a Virtual Private Cloud](#create-vpc).

    <%= image_tag("images/micro-aws/create-security.png") %>

1. Click **Yes, Create**.

1. Select the "BOSH Security Group" and click the **Inbound Rules** tab.

    <%= image_tag("images/micro-aws/edit-rules.png") %>

1. Click **Edit**.

1. Add the rules below for access by MicroBOSH and BOSH.

    Various components and functions used with MicroBOSH need specific ports
	opened for inbound traffic.
	For example, the BOSH Director needs port 25555 opened, the BOSH Agents need
	port 6868 opened, and you must open port 22 to allow debugging by SSH.
	In addition, the VMs that BOSH deploys might need access to all TCP and UDP
	ports from within the same Security Group.

    <table border="1" class="nice" >
    	<tr>
    		<th><b>Type</b></th>
    		<th></b>Port Range</b></th>
    		<th><b>Source</b></th>
    	</tr>
    	<tr>
    	  <td>Custom TCP Rule</td><td>25555</td><td>0.0.0.0/0</td>
    	</tr>
    	<tr>
    	  <td>Custom TCP Rule</td><td>6868</td><td>0.0.0.0/0</td>
    	</tr>
    	<tr>
    	  <td>Custom TCP Rule</td><td>22</td><td>0.0.0.0/0</td>
    	</tr>
    	<tr>
    	  <td>All TCP</td><td>ALL</td><td>ID of this security group</td>
    	</tr>
    	<tr>
    	  <td>All UDP</td><td>ALL</td><td>ID of this security group</td>
    	</tr>
    </table>

1. Click **Save**.

    <p class="note"><strong>Note</strong>: Ensure that the <strong>Save Successfully</strong> message displays. You may have to refresh the page to view the updated inbound rules.</p>

## <a id="download-stemcell"></a>Step 3: Download a BOSH Stemcell ##

1. Install the [BOSH Command Line Interface (CLI)](./bosh-cli.html).

1. In a terminal window, run `bosh public stemcells` from your deployment
directory to see a list of publicly available BOSH stemcells.
The list displays the most recent build of each flavor.

    <pre class='terminal'>
    $ bosh public stemcells
    +-------------------------------------------------------------+
    | Name                                                        |
    +-------------------------------------------------------------+
    | bosh-stemcell-2717-aws-xen-ubuntu-trusty-go_agent.tgz       |
    | bosh-stemcell-2717-aws-xen-centos-go_agent.tgz              |
    | light-bosh-stemcell-2717-aws-xen-ubuntu-trusty-go_agent.tgz |
    | light-bosh-stemcell-2717-aws-xen-centos-go_agent.tgz        |
                    ... older stemcells ...
</pre>

1. Run `bosh download public stemcell STEMCELL-NAME`to download a stemcell.<commit_msg>fix typos in deploy-microbosh-to-aws.html<commit_after>---
title: Deploying MicroBOSH to AWS
---

This topic explains how to deploy MicroBOSH to Amazon Web Services (AWS).

##<a id="create-manifest"></a>Step 1: Create a Deployment Manifest ##

The MicroBOSH deployment manifest is a YAML file that defines the components and
properties of the deployment.
Create a manifest for your deployment as follows:

1. Create a local deployment directory to store your manifest.

    <pre class='terminal'>
    $ mkdir ~/my-micro-deployment
    </pre>

1. Create a deployment manifest YAML file.

    The example below is a MicroBOSH deployment manifest template.
	Copy and paste the template into a text editor and save the manifest to your
	deployment directory.

    In the template, you must replace the ELASTIC-IP-ADDRESS,
	MICROBOSH-SUBNET-ID, AVAILABILITY-ZONE, ACCESS-KEY-ID, and SECRET-ACCESS-KEY
	properties. We describe replacing these properties in [Step 2: Prepare an
	AWS Account](#prepare-aws).

    <p class="note"><strong>Note</strong>: The example below has the file name <code>manifest.yml</code>, which we reference in other examples in this topic.</p>

<pre class='code'>
---
name: microbosh

network:
  type: manual
  vip: ELASTIC-IP-ADDRESS # Replace with your Elastic IP address
  ip: 10.0.0.6
  dns: [10.0.0.2]
  cloud_properties:
   subnet: MICROBOSH-SUBNET-ID # Replace with your MicroBOSH Subnet ID

resources:
  persistent_disk: 20000
  cloud_properties:
    instance_type: m1.small
    availability_zone: AVAILABILITY-ZONE # Replace with your Availability Zone

cloud:
  plugin: aws
  properties:
    aws:
      access_key_id: ACCESS-KEY-ID # Replace with your AWSAccessKeyId
      secret_access_key: SECRET-ACCESS-KEY # Replace with your AWSSecretKey
      default_key_name: bosh
      default_security_groups: ["bosh"]
      region: us-east-1
      ec2_private_key: bosh.pem # Path relative to the manifest file

apply_spec:
  agent:
    blobstore: {address: 10.0.0.6}
    nats: {address: 10.0.0.6}
  properties:
    registry: {address: 10.0.0.6}
</pre>

##<a id="prepare-aws"></a>Step 2: Prepare an AWS Account ##

If you do not have an AWS account, [create one](http://goo.gl/MaAybK).

To configure your AWS account for MicroBOSH:

* [Obtain AWS credentials](#credentials)
* [Select an Availability Zone](#availability-zone)
* [Create a Key Pair](#create-key-pair)
* [Create a Virtual Private Cloud](#create-vpc)
* [Create an Elastic IP](#create-eip)
* [Create and configure Security Groups](#create-security)

###<a id="credentials"></a> Obtain AWS Credentials ###

Your AWS credentials consist of an `access_key_id` and a `secret_access_key`.
If you already know your AWS credentials you can skip this step and update
`access_key_id` and `secret_access_key` in your MicroBOSH deployment manifest.

1. Log into the AWS console:
[https://console.aws.amazon.com/console/home](https://console.aws.amazon.com/console/home).

    <%= image_tag("images/micro-aws/aws-console.png") %>

1. Click your account name and select **Security Credentials**.

    <%= image_tag("images/micro-aws/seccred-drop.png") %>

1. In the AWS IAM confirmation box, click **Continue to Security Credentials** to display the Security Credentials page.

    <%= image_tag("images/micro-aws/iam-confirm.png") %>

1. Expand the **Access Keys** section.

    <%= image_tag("images/micro-aws/access-key.png") %>

1. Click **Create New Access Key**.

    <%= image_tag("images/micro-aws/create-key.png") %>

1. In the Create Access Key dialog box, click **Download Key File**.

1. Save the Key File.

1. Close the dialog box.

1. Open the downloaded Key File in a text editor.
Update `access_key_id` and `secret_access_key` in your MicroBOSH deployment manifest with the values from the Key File.

    In the example, the `access_key_id` is _BM456AB123C2GZFTQQHA_ and
    `secret_access_key` is _L2lCSPI9zp7nAzFraZaMonf1OxddoO5Iaaqutx3n_.

    <%= image_tag("images/micro-aws/record-key.png") %>

###<a id="availability-zone"></a>Select an Availability Zone ###

1. In the upper-right corner of the AWS Console, select a Region.

    <%= image_tag("images/micro-aws/select-region.png") %>

1. In the AWS Console, select **EC2**.
The **Availability Zone Status** in the **Service Health** section of the EC2
Dashboard lists usable Availability Zones.
Replace AVAILABILITY-ZONE in your deployment manifest with the one of the usable
**Availability Zones**.

	In this example, usable **Availability Zones** are `us-east-1a`,
	`us-east-1b`, and `us-east-1c`.

    <%= image_tag("images/micro-aws/zones.png") %>

<p class="note"><strong>Note</strong>: Currently, <strong>light</strong> stemcells are only available from the AWS Region of <strong>US East (N. Virginia)</strong>. If you want to use a light stemcell, you must select this region.</strong></p>

###<a id="create-key-pair"></a>Create a Key Pair ###

1. In the AWS Console, select **EC2**.

1. Click **Key Pairs**.

    <%= image_tag("images/micro-aws/key-pairs.png") %>

1. Click **Create Key Pair**.

    <%= image_tag("images/micro-aws/create-key-pair.png") %>

1. In the Create Key Pair dialog box, enter "bosh" as the Key Pair name.

    <%= image_tag("images/micro-aws/name-key-pair.png") %>

1. Click **Create**.

1. Save the `bosh.pem` file.

    <%= image_tag("images/micro-aws/save-pem.png") %>

1. Move the `bosh.pem` file into your local deployment directory.
For example, on UNIX run this command:

    <pre class="terminal">
      mv ~/Downloads/bosh.pem ~/my-micro-deployment/bosh.pem
    </pre>

###<a id="create-vpc"></a>Create a Virtual Private Cloud ###

1. On the AWS Console, select **VPC**.

1. Click **Start VPC Wizard**.

    <%= image_tag("images/micro-aws/vpc-wizard.png") %>

1. Select **VPC with a Single Public Subnet** and click **Select**.

1. Complete the VPC form with the following information:
    * **IP CIDR block**: 10.0.0.0/16
    * **VPC name**: microbosh
    * **Public subnet**: 10.0.0.0/24
    * **Availability Zone**: The Availability Zone you selected earlier
    * **Subnet name**: microbosh
    * **Enable DNS hostnames**: Yes
    * **Hardware tenancy**: Default

        <%= image_tag("images/micro-aws/vpc.png") %>

1. Click **Create VPC**.

1. Click **Subnets**.

1. Replace MICROBOSH-SUBNET-ID in your deployment manifest with the **Subnet ID** shown.

    <%= image_tag("images/micro-aws/subnet.png") %>

###<a id="create-eip"></a>Create an Elastic IP ###

1. On the VPC Dashboard, click **Elastic IPs**.

1. Click **Allocate New Address**.

1. In the Allocate Address dialog box, select the **EC2-VPC** network platform.
Click **Yes, Allocate**.

    <%= image_tag("images/micro-aws/allocate-eip.png") %>

1. Replace ELASTIC-IP-ADDRESS in your deployment manifest with the allocated
Elastic IP Address.

###<a id="create-security"></a>Create and Configure Security Groups ###

1. On the VPC Dashboard, click **Security Groups**.

1. Click **Create Security Group**.

1. Complete the Security Group form with the following information:
    * **Name tag**: bosh
    * **Group Name**: bosh
    * **Description**: BOSH Security Group
    * **VPC**: Select the "microbosh" VPC that you created in [Create a Virtual Private Cloud](#create-vpc).

    <%= image_tag("images/micro-aws/create-security.png") %>

1. Click **Yes, Create**.

1. Select the "BOSH Security Group" and click the **Inbound Rules** tab.

    <%= image_tag("images/micro-aws/edit-rules.png") %>

1. Click **Edit**.

1. Add the rules below for access by MicroBOSH and BOSH.

    Various components and functions used with MicroBOSH need specific ports
	opened for inbound traffic.
	For example, the BOSH Director needs port 25555 opened, the BOSH Agents need
	port 6868 opened, and you must open port 22 to allow debugging by SSH.
	In addition, the VMs that BOSH deploys might need access to all TCP and UDP
	ports from within the same Security Group.

    <table border="1" class="nice" >
    	<tr>
    		<th><b>Type</b></th>
    		<th></b>Port Range</b></th>
    		<th><b>Source</b></th>
    	</tr>
    	<tr>
    	  <td>Custom TCP Rule</td><td>25555</td><td>0.0.0.0/0</td>
    	</tr>
    	<tr>
    	  <td>Custom TCP Rule</td><td>6868</td><td>0.0.0.0/0</td>
    	</tr>
    	<tr>
    	  <td>Custom TCP Rule</td><td>22</td><td>0.0.0.0/0</td>
    	</tr>
    	<tr>
    	  <td>All TCP</td><td>ALL</td><td>ID of this security group</td>
    	</tr>
    	<tr>
    	  <td>All UDP</td><td>ALL</td><td>ID of this security group</td>
    	</tr>
    </table>

1. Click **Save**.

    <p class="note"><strong>Note</strong>: Ensure that the <strong>Save Successfully</strong> message displays. You may have to refresh the page to view the updated inbound rules.</p>

## <a id="download-stemcell"></a>Step 3: Download a BOSH Stemcell ##

1. Install the [BOSH Command Line Interface (CLI)](./bosh-cli.html).

1. In a terminal window, run `bosh public stemcells` from your deployment
directory to see a list of publicly available BOSH stemcells.
The list displays the most recent build of each flavor.

    <pre class='terminal'>
    $ bosh public stemcells
    +-------------------------------------------------------------+
    | Name                                                        |
    +-------------------------------------------------------------+
    | bosh-stemcell-2717-aws-xen-ubuntu-trusty-go_agent.tgz       |
    | bosh-stemcell-2717-aws-xen-centos-go_agent.tgz              |
    | light-bosh-stemcell-2717-aws-xen-ubuntu-trusty-go_agent.tgz |
    | light-bosh-stemcell-2717-aws-xen-centos-go_agent.tgz        |
                    ... older stemcells ...
</pre>

1. Run `bosh download public stemcell STEMCELL-NAME` to download a stemcell.
{'fraction_non_alphanumeric': 0.14704364874625941, 'fraction_numerical': 0.017232483747807243, 'mean_word_length': 3.2731481481481484, 'pattern_counts': {'":': 0, '<': 245, '<?xml version=': 0, '>': 245, 'https://': 4, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 20, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 18, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '802510', 'n_tokens_mistral': 6720, 'n_tokens_neox': 6270, 'n_words': 2028}