AWS Self-Hosted Prerequisites

A self-hosted AWS environment uses resources in your organization’s AWS account. Before creating the environment, prepare a dedicated IAM identity, a VPC with internet access, a subnet, and a security group for the production traffic you plan to carry.

IAM Access

Apply least privilege and keep CLOUDflex credentials separate from personal administrator credentials.

Required EC2 policy

The staged Instance Manager uses the following EC2 actions for discovery, lifecycle controls, tags, instance resizing, deployment, and drive management:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CloudflexStudioEc2Management",
      "Effect": "Allow",
      "Action": [
        "ec2:AttachVolume",
        "ec2:CreateTags",
        "ec2:CreateVolume",
        "ec2:DeleteTags",
        "ec2:DeleteVolume",
        "ec2:DescribeInstanceAttribute",
        "ec2:DescribeInstances",
        "ec2:DescribeInstanceStatus",
        "ec2:DescribeVolumes",
        "ec2:DetachVolume",
        "ec2:ModifyInstanceAttribute",
        "ec2:ModifyVolume",
        "ec2:RebootInstances",
        "ec2:RunInstances",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:TerminateInstances"
      ],
      "Resource": "*"
    }
  ]
}

Some EC2 describe and launch actions require Resource: "*". Add narrower conditions where your AWS design and tested workflows permit them. Deploy Manager templates may require additional AWS services or permissions not established by this Instance Manager policy.

Create the credential

1. In AWS IAM, create the policy above.
2. Create a dedicated programmatic IAM identity and attach the policy.
3. Create an access key for that identity.
4. Store the secret in your approved secrets system; AWS shows it only once.
5. Keep the access key ID and secret available for self-hosted environment creation.

Caution

Never paste real keys into documentation, chat, issue trackers, or source control. Rotate a key immediately if it may have been exposed.

Default VPC and Internet Access

The standard self-hosted setup uses the default VPC in the AWS region selected for the CLOUDflex environment. Confirm that the region has a default VPC and a subnet suitable for the production machines. If your organization replaces the default VPC with a custom network, provide an equivalent VPC, subnet, routing, and security-group configuration.

The subnet used for production machines must have the internet path required by the workflow. A public-subnet design normally uses an internet gateway and a default route to it. A private-subnet design requires an administrator-managed egress path, such as a NAT gateway, and does not provide unsolicited inbound internet access by itself.

Confirm that the deployment application’s subnet and security-group settings identify resources from the same VPC.

Security Group for WHEP, WHIP, and SRT

Create a dedicated security group for CLOUDflex production machines instead of broadening the AWS default security group. The security group must support the traffic used by the production:

• WHIP and WHEP signaling: allow HTTPS traffic on the TCP port used by the configured endpoints. Use TCP 443 when the endpoint uses standard HTTPS.
• WHIP and WHEP media: allow UDP traffic across the media port ranges selected for WHIP ingest and WHEP playback.
• SRT: allow UDP traffic on the ports selected for SRT caller, listener, or rendezvous connections.
• Outbound traffic: allow the corresponding destinations and ports required for return media, signaling, software access, and other production dependencies.

AWS security groups are stateful, so response traffic for an allowed connection is permitted automatically. You still need rules that allow each connection to be initiated in the direction required by the workflow. For example, an internet-facing SRT listener needs an inbound UDP rule for its selected listener port.

Choose the port range

CLOUDflex does not choose universal WHEP, WHIP, or SRT media ranges for a self-hosted network. An AWS administrator must select and document ranges that match the media software and production design. Configure the WHIP range in /etc/nimble/whip_input.json and the WHEP range in /etc/nimble/whep_config.json as described in Manual Nimble Streamer setup.

Choose ports above 1023. Ports 0–1023 are system ports, commonly called privileged ports, and should not be used for administrator-selected media ranges. Check for conflicts with existing services before assigning the ranges, and configure the same values in Nimble and the AWS security-group rules. If you use one fixed ICEUDPMuxPort per protocol instead of ranges, assign different ports to WHIP and WHEP.

Keep rules as narrow as the workflow allows:

• limit inbound sources and outbound destinations to known CIDR ranges where practical;
• open only the TCP and UDP ports the production uses;
• separate production traffic from management access; and
• remove temporary rules after the production.

Caution

Opening a large UDP range to the entire internet increases the exposed network surface. Use the smallest practical range and source scope, then test every required connection direction before the production.

Verify the Prerequisites

Before creating the self-hosted environment:

1. Confirm the IAM access key can perform the required EC2 discovery actions.
2. Confirm the selected AWS region contains the intended VPC and subnet.
3. Confirm the subnet has the required internet route.
4. Confirm the security group allows the planned WHEP, WHIP, and SRT signaling and media traffic.
5. Record the approved port range for operators and engineers.
6. Create the self-hosted environment, then test discovery and a non-critical lifecycle action.