Launching Carbone instance:

When launching a new Carbone instance, you need only to configure the followings option when starting the EC2 instance :

• configure EC2 Security Group to accept at least inbound connections TCP/4000.
• assign AWSMarketplaceMeteringFullAccess role to ec2 instance

Use Carbone API

When EC2 is fully booted, you can check if Carbone is running by calling : http://"EC2_IP":4000/status

Full API documentation is available here: https://carbone.io/api-reference.html#carbone-cloud-api 

Configuring Carbone:

Full documentation is available here : https://carbone.io/on-aws.html 

You can configure Carbone application by modifying /var/www/carbone-ee/config/config.json. To connect to the EC2 instance, use SSH and the username ec2-user with your private key.

Full Carbone options documentation : https://carbone.io/on-premise.html#options-list 

Using System Manager and Tag to configure Carbone

It's now possible to fully configure Carbone without modifying config.json file.

To make it possible, you first need to add following policy to grant configuration access for Carbone { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "ssm:GetParameter", "Resource": "" }, { "Effect": "Allow", "Action": "ssm:DescribeParameters", "Resource": "" }, { "Effect": "Allow", "Action": [ "ec2:DescribeTags" ], "Resource": [ "*" ] } ] }

Next step is to set configuration in System Manager https://console.aws.amazon.com/systems-manager/parameters/ 

You can now configure Carbone standard option with : CARBONE_EE_* (CARBONE_EE_STUDIO to true to enable studio) CARBONE_EE_STUDIO CARBONE_EE_STUDIOUSER .... CARBONE_S3_* to configure S3 options: CARBONE_S3_templateS3Bucket CARBONE_S3_templateS3BucketRegion .... CARBONE_PUBKEY to set Carbone publikey (for authentification)

If you need to mange multiple Carbone configuration for different environnement, you can set instance TAG to configure config prefix: CARBONE_CONFIG_PREFIX= "/PROD/" for example

Enable Carbone Studio

You can configure CARBONE_EE_STUDIO to true in AWS System Manager

or

You can enable Carbone studio by adding following option in file /var/www/carbone-ee/config/config.json : "studio": true

Store templates and renders on S3 bucket

You can set bucket name and region in file /var/www/carbone-ee/config/config.json with the following options: "templateS3Bucket" : "test-stockage-template", "templateS3BucketRegion" : "us-east-1", "templateS3Folder" : "prod", "renderS3Bucket" : "test-stockage-render", "renderS3Folder" : ""

Authentification is done using EC2 IAM role so you need to add following policy to grant S3 access to you EC2 instance : { "Version": "2012-10-17", "Statement": [ { "Sid": "VisualEditor0", "Effect": "Allow", "Action": [ "s3:PutObject", "s3:GetObject", "s3:GetObjectAttributes", "s3:ListBucket", "s3:DeleteObject" ], "Resource": [ "arn:aws:s3:::test-stockage-template", "arn:aws:s3:::test-stockage-template/", "arn:aws:s3:::test-stockage-render", "arn:aws:s3:::test-stockage-render/" ] } ] }

Enable log export to cloudwatch

You only need to attach *CloudWatchAgentServerPolicy on EC2 IAM role to enable Carbone logs export in CloudWatch

Sensitive data

All customers data are stored in /var/www/carbone-ee/ folder. Only the template are persistent. By defaut API authentification is disable but you can enable it : https://carbone.io/on-premise.html#server-authentication