KONG ➕ AWS CloudFormation

This CloudFormation template helps you model and set up Kong's resources in AWS easily.

Note: For Kong's version older than 0.4.2 switch to tag 1.0.0

Summary

You have option to chose between two templates:

1) Kong with Cassandra DB

Provision Kong resources along with a new Cassandra cluster, using The Datastax Cassandra AMI.

Region	HVM AMIs	PV AMIs
us-east-1
us-west-1
us-west-2
eu-west-1
ap-northeast-1
ap-southeast-1
ap-southeast-2
sa-east-1

2) Kong without Cassandra DB (you need to bring yours)

Provisions Kong resources with user provided Cassandra seed nodes.

Region	HVM AMIs	PV AMIs
us-east-1
us-west-1
us-west-2
eu-west-1
ap-northeast-1
ap-southeast-1
ap-southeast-2
sa-east-1

Parameters

Parameter	Default	Description
SSHLocation	0.0.0.0/0	The IP address range that can be used to SSH to the Kong and Cassandra EC2 instances
KongProxyAccess	0.0.0.0/0	The IP address range that can be used to access the Kong admin server
KongAdminAccess	0.0.0.0/0	The IP address range that can be used to access the Kong proxy server
KongKeyName	-	Existing EC2 KeyPair to enable SSH access to the Kong instances
KongFleetMaxSize	2	Max Number of Kong instances (Min: 1)
KongFleetDesiredSize	2	Desired Number of Kong instances (Min: 1)
KongInstanceType	c3.8xlarge	EC2 instance type for Kong. Note: T2 instance is not supported on the EC2-Classic platform
KongVersion	-	Kong version, leave empty to install latest version
KongAvailabilityZones	-	AZ for the Kong instances
CassandraKeyName	-	Existing EC2 KeyPair to enable SSH access to the instances for Cassandra
CassandraFleetSize	1	Number of nodes in cluster. (Min: 1)
CassandraAvailabilityZone	-	Availablity zone in which cassandra cluster would be created, for multi regions and zones cluster please refer to Datastax documentation.
CassandraInstanceType	c3.2xlarge	EC2 instance type for Cassandra
CassandraClusterName	-	Cassandra cluster name
CassandraClusterVersion	2.2.0	Cassandra cluster version
CassandraVersion	Community	Cassandra version
CassandraOpsCenterAccess	0.0.0.0/0	The IP address range that can access OpsCenter for Cassandra cluster management

Instructions:

1. Key Pairs:

   Create two sets of key pairs, one to access Cassandra instances & one for Kong instances. Continue to next step if you want to use an existing key pair

2. Choose a Region & VM Type:

   Choose the region closest to your API servers, and pick the virtualization type you'd like from the list of available templates above.

   You should land on AWS Cloud Formation "Select Template" page

3. Parameters:

   Fill in all the parameters details. If you chose to launch Kong with Cassandra you would be asked to fill in extra parameters to create a Cassandra cluster. check the description of each field and provide appropriate values.

   Note: consult the parameters table for detailed description of parameters

4. Option page:

   Add Tags and other fields according to your requirements.

   Note: The template is configured to add a "Name" tag to each relevant resource

5. Grab a Coffee!:

   It will take several minutes (~20 minutes) to create the stack. Once the stack has a status of CREATE_COMPLETE, click on "Output" tab to get the proxy and Admin URL, it may take 60 seconds more for links to become active.

   Note: To monitor the progress go to AWS CloudFormation console, select the stack in the list. In the stack details pane, click the "Events" tab to see the progress.

6. Use Kong:

   Quickly learn how to use Kong with the 5-minute Quickstart.

SSL Support

You can install SSL Certificate on the Kong Load Balancer or use the SSl plugin on Kong to enable HTTPS support.

1) SSL Certificate for Kong Load Balancer

1. Obtain the Kong Load Balancer id from the "Resources tab".
2. Find the matching Kong Load Balancer instance. 6 Edit Listeners from the bottom pane, click Add.
3. In the Load Balancer Protocol column, select HTTPS (Secure HTTP). This updates the Load Balancer Port, Instance Protocol, and Instance Port columns. In the Instance Protocol column, select HTTP and update the Instance port to 8000.
4. By default, Elastic Load Balancing selects the current predefined security policy, ELBSecurityPolicy-2015-05, for your HTTPS/SSL listener. This is the recommended setting.
5. In the SSL Certificate column, click Change, and then you either upload a new certificate or choose an existing Certificate.
6. Click Save to add the listeners you just configured.
7. Click on Security tab.
8. Click on Security Group id.
9. In the bottom pane, select the Inbound tab.
10. Click Edit.
11. Add Load Balancer Port for the HTTPS to the list and save.

2) Using Kong SSL Plugin

1. SSH on each Kong node, upload the Certificate.
2. Update Kong node Security Group to open TCP port 8443.
3. Add HTTPS listener on Kong Load Balancer forwarding request to 8443 Instance port.
4. Open HTTPS listener port in Kong Load Balancer security group.
5. Enable the Kong SSL plugin.

Important Note

1. The security configuration on the templates opens up all externally accessible ports to incoming traffic from any IP address if default is chosen (0.0.0.0/0)
2. The risk of data leakage is high. If you desire a more secure configuration, please update access fields with appropiate IP address range
3. The template installs many resources on AWS. You will be billed just for the AWS resources used
4. Some of the instance types may not be supported in all the AWS Regions or Availiblity Zones, so chose next best available option

Enterprise Support

Support, Demo, Training, API Certifications and Consulting available at http://getkong.org/enterprise.