CloudLens Autopilot for AWS

🏢 Deploy into an existing VPC (brownfield)

Name a VPC and subnet and the stack creates no networking at all: no VPC, no subnets, no internet gateway, no routes. The instances land beside the workloads they monitor.

• ExistingVpcId + ExistingSubnetId — required together
• ExistingDataSubnetId — optional, puts the vPB data plane in its own subnet
• ExistingSecurityGroupId — optional, attaches a pre-approved SG instead of creating one. AdminIngressCidr is then ignored.

Leave ExistingVpcId blank and the four CIDR fields build a fresh VPC instead. That single field is the greenfield / brownfield switch.

curl -sSL https://raw.githubusercontent.com/Keysight-Tech/cloudlens-ansible-aws/main/deploy/deploy-stack.sh | bash -s -- \
  --existing-vpc-id vpc-0abc123 \
  --existing-subnet-id subnet-0def456 \
  --existing-sg-id sg-0aaa111

🩹 Four commands, no stress: check, deploy, replay, remove

For anyone, SE or customer. The doctor finds every setup gap first and prints the exact fix; the deploy asks all of its questions before anything is built and saves your answers; the teardown removes only what it built.

# 1. Is this machine and account ready? Deploys nothing.
curl -sSL https://raw.githubusercontent.com/Keysight-Tech/cloudlens-ansible-aws/main/deploy/deploy-stack.sh | bash -s -- --doctor --region us-east-1

# 2. Deploy. Every question comes first, then one Proceed.
curl -sSL https://raw.githubusercontent.com/Keysight-Tech/cloudlens-ansible-aws/main/deploy/deploy-stack.sh | bash

# 3. Replay a saved deployment anywhere, zero questions (an SE fills the
#    interview once; deploy-profile-<stack>.env is written at the plan step):
curl -sSL https://raw.githubusercontent.com/Keysight-Tech/cloudlens-ansible-aws/main/deploy/deploy-stack.sh | bash -s -- --profile ./deploy-profile-acme.env

# 4. Remove everything it created, when you are done. Audits first, asks before
#    deleting. If the stack has a KVO it offers to release its licences first
#    (or do it in the KVO: Settings > Product Licensing > Deactivate licenses).
curl -sSL https://raw.githubusercontent.com/Keysight-Tech/cloudlens-ansible-aws/main/deploy/teardown-stack.sh | bash -s -- --stack-name YOUR-STACK --region us-east-1

Every run ends with deploy-report-<stack>-<region>.html: what was built, where to sign in, what is tapped, how each phase ended, how to verify, and the exact teardown command. Passwords stay in the mode-600 files it points to, never in the page. Profiles never contain secrets either: licence codes and keys are always typed at the moment of use.

🎯 Tap the customer's workloads, wherever they are

Both tapping paths resolve one selection from customer_input.yaml: ANDed tag_filters, explicit instance_ids, and tapping.exclude_instance_ids drive sensors and agentless mirroring identically, so the two can never target different hosts. The run reports the split up front: which hosts get sensors, which interfaces get mirror sessions (AWS mirrors Nitro instances only), and how many licence credits that demands.

• --tapping sensors|mirror|both|none — one answer for both paths
• --source-vpc-id vpc-... — tap a VPC other than the CloudLens one; repeat it (or list aws.source_vpc_ids in customer_input.yaml) and one KVO fabric is built per VPC
• --source-vpc vpc:az:mgmt:ingress:egress — same, with that VPC's collector placement inline (three distinct subnets in the tapped VPC)
• --eks-cluster NAME / --eks-sample — tap Kubernetes pods in EKS. Pod-to-pod traffic inside a node is invisible to VM sensors and VPC mirroring; the CloudLens K8s sensor sees it. DaemonSet (one sensor per node, fully automated: image pushed to ECR, applied with kubectl, no helm needed) or sidecar (per-pod; your apps get a rendered snippet, never an automatic restart). --eks-sample builds a small test cluster plus a demo app generating continuous pod-to-pod HTTP. K8s sensors register into the same project as the VM sensors and follow the same tool path.

A tapped VPC that is not the CloudLens VPC needs a route to the manager and KVO on 443 and to the tool from the collector egress subnet (VPC peering or Transit Gateway); the run states exactly that when it applies.

curl -sSL https://raw.githubusercontent.com/Keysight-Tech/cloudlens-ansible-aws/main/deploy/deploy-stack.sh | bash -s -- \
  --tapping both \
  --source-vpc-id vpc-0workloads1 \
  --collector-zone us-east-1a \
  --collector-mgmt-subnet subnet-aaa --collector-ingress-subnet subnet-bbb --collector-egress-subnet subnet-ccc

🔒 Private subnets and no public IPs

Many enterprises forbid Elastic IPs on workload subnets. Set AssignPublicIp to no (or pass --no-public-ip) and no EIPs are created. The stack outputs private IPs and you reach the UIs over VPN, Direct Connect, or VPC peering.

🔑 SSH key pair: use an existing one or have it created

A brand new AWS account has no key pairs, which used to block the wizard entirely. Now you choose:

• Create a new key pair for me (default) — the stack creates <StackName>-key, EC2 stores the private key in SSM Parameter Store, and the stack outputs the exact command to download it
• Use an existing key pair — type the name in KeyPairName

The CLI lists the key pairs in your region and lets you pick one or create a new one. In the console it is a text box rather than a dropdown, because CloudFormation cannot make a key pair dropdown optional: a dropdown must always resolve to an existing key, which is exactly what blocks a first deploy.

# Download the auto-created private key (the stack prints this command)
aws ssm get-parameter --name /ec2/keypair/<key-pair-id> --region <region> \
  --with-decryption --query Parameter.Value --output text > my-key.pem && chmod 400 my-key.pem