AWS Infrastructure Provisioning

To deploy the required 3-tier network infrastructure on AWS, follow the guided console setup below to manually provision your VPC, subnets, gateways, security groups, and EC2 instances.

---

1. Console Setup

If you prefer configuring resources manually in your AWS Management Console, proceed with the following steps.

VPC & Subnets

1. Create the VPC:
   • Navigate to VPC -> Your VPCs -> Create VPC.
   • Select VPC only, set IPv4 CIDR to 10.0.0.0/16, and name it mcm-vpc.
2. Create Subnets: Navigate to VPC -> Subnets -> Create subnet. Select mcm-vpc and create subnets (a single subnet can be used, or three subnets for strict tiering):
   • mcm-subnet-access: CIDR 10.0.1.0/24 (Hosts Access Gateway Node VM1). (Can be public or private depending on your network design).
   • mcm-subnet-app: CIDR 10.0.2.0/24 (Hosts App Node VM2).
   • mcm-subnet-db: CIDR 10.0.3.0/24 (Hosts Database Node VM3).

Outbound Internet Access Options

Depending on your enterprise cloud policies, configure outbound internet connectivity for your subnets using one of the following methods:

• AWS NAT Gateway (Standard): Create an AWS NAT Gateway in a public subnet with an Elastic IP, and route 0.0.0.0/0 traffic from mcm-subnet-app and mcm-subnet-db to it.
• Network Firewall / Transit Gateway: Route outbound traffic through an AWS Network Firewall, Third-Party Firewall appliance, or Transit Gateway.
• Corporate Proxy / VPC Endpoints: Route application outbound traffic via an HTTP/HTTPS proxy or AWS VPC Interface/Gateway Endpoints.

EC2 Instance Deployment

• Availability Zone (Optional): You can place the instances in different Availability Zones (e.g., VM1 in us-east-1a, VM2 in us-east-1b, VM3 in us-east-1c) for high availability and fault tolerance.

1. Deploy VM1 (mcm-access):
   • Subnet: mcm-subnet-access. Assign a public IP if VM1 is directly internet-facing, or keep it on a private IP if accessed via an internal load balancer, VPN, or corporate network.
   • AMI: Ubuntu Server 24.04 LTS (x86_64).
   • Instance Type: c7ia.flex.large (2 vCPU, 4GB RAM) or equivalent.
2. Deploy VM2 (mcm-app) & VM3 (mcm-db):
   • Deploy VM2 inside mcm-subnet-app. Type: c7ia.flex.xlarge (4 vCPU, 16GB RAM).
   • Deploy VM3 inside mcm-subnet-db. Type: c7ia.flex.xlarge (4 vCPU, 16GB RAM).
   • Keep VM2 and VM3 on private IPs without public IP assignment.

Security Group Port Rules

Configure the following rules on your AWS Security Groups:

Outbound Connection Requirements

The MCM platform requires outbound HTTPS (port 443) connectivity to the following main domains:

---

2. Next Steps

Once your network infrastructure and instances are provisioned on AWS, you are ready to configure the cluster.

Proceed to Section 3: Installation Procedure in the main deployment guide to continue.