Quick Start (CloudFormation)
Yeedu ships one CloudFormation template, automation/aws/yeedu-platform.yaml, and it stands the whole platform up inside an AWS account you already own. There's no separate control plane to register with and no networking for you to hand over.
The template doesn't build a network. It takes a VPC and a subnet that already exist, places a single EC2 instance in that subnet, attaches an encrypted EFS file system and a private S3 bucket, and then hands off to the instance's user data script, which pulls the Yeedu release and starts every service as a container. Everything else is switched on by parameter: a Multi-AZ PostgreSQL database, 17 ECR repositories, 10 CloudWatch log groups, an Elastic IP, and HTTPS terminated with a certificate you supply.
One stack, one instance, one region.
What the stack creates
| Resource | Logical ID | Notes |
|---|---|---|
| EC2 instance | YeeduInstance | Runs every Yeedu service under Docker Compose. 200 GB gp3 root volume, deleted on termination. |
| Security groups | Ec2SecurityGroup, RdsSecurityGroup, EfsSecurityGroup | RDS accepts 5432 and EFS accepts 2049 only from the EC2 security group. |
| IAM role and profile | YeeduIamRole, YeeduInstanceProfile | Six AWS managed policies plus an inline policy for EC2 and EFS calls. |
| IAM user and key | YeeduUser, YeeduAccessKey, YeeduUserPolicy | Named ${AWS::StackName}-${EnvironmentName}-yeedu-user. The key lands in Secrets Manager. |
| S3 bucket | YeeduBucket | Named ${AWS::StackName}-data. AES-256 encryption, all public access blocked, versioning suspended. |
| EFS | YeeduEfs, YeeduEfsMountTarget, YeeduEfsAccessPoint | Encrypted, general purpose, bursting throughput. Access point roots at /yeedu with uid and gid 1000. |
| Secrets | YeeduDbSecret, YeeduConfigSecret, YeeduRdsSecret | A generated 16-character DB password, the IAM access key pair, and the database connection details. |
| RDS | YeeduDb, YeeduDbSubnetGroup, YeeduDbParameterGroup | Only when RdsCreate is true. |
| ECR repositories | 17 repositories | Only when CreateContainerRepositories is true. |
| Log groups | 10 log groups | Only when CreateLogGroups is true. |
| Elastic IP | YeeduElasticIp, YeeduElasticIpAssociation | Only when AssignPublicIp is true. |
The optional pieces
Four parameters decide how much of the stack actually gets built. We'd suggest leaving all four at their template defaults of false for a first look at the product, then turning them on one at a time.
| Parameter | Condition | What it gates |
|---|---|---|
RdsCreate | ShouldCreateRds | Multi-AZ PostgreSQL, its subnet group, and its parameter group. Off by default, since a proof of concept can run without it. |
CreateContainerRepositories | ShouldCreateEcrRepos | The 17 ECR repositories, each keeping the last 10 images. |
CreateLogGroups | ShouldCreateLogGroups | The 10 CloudWatch log groups, each with 30-day retention. |
AssignPublicIp | HasPublicIp | A public IP on the instance plus an Elastic IP association. |
Two more conditions are derived rather than chosen. HasKeyPair is true whenever Ec2KeyName isn't blank, and ShouldUseHttps follows EnableHttps.
What the instance does on boot
The user data script writes its whole run to /var/log/bootstrap.log, and the CloudWatch agent it installs ships /var/log/cloud-init-output.log to the yeedu_userdata_logs group. In order, the script creates a yeedu system user, installs Docker, the AWS CLI v2 and Docker Compose 1.29.2, reads both Secrets Manager secrets, writes /etc/yeedu-env, syncs the release from s3://yeedu-softwares/releases/, pushes any bundled image tarballs into your account's ECR registry, writes the two properties files under /opt/Core-Services-Formation, and finally runs ./yeedu-core-services.sh start.
That last command is where the platform actually comes up.
Where to go next
- Prerequisites covers the VPC, subnets, AMI, key pair and the IAM policy the deploying principal needs.
- CFT Parameters documents all 19 template parameters, their defaults and the two validation rules.
- Deploy the Stack walks through the console and the CLI, then monitoring and deletion.
- Post-Deployment covers the stack outputs, reading the secrets, and confirming the services are up.
- Troubleshooting collects the failures we see most often.
If you'd rather run Yeedu on EKS and drive the install yourself, see Manual Deployment instead.