Manually Configuring Ops Manager Director for AWS

Page last updated:

This topic describes how to configure the Ops Manager Director to deploy Pivotal Cloud Foundry (PCF) on Amazon Web Services (AWS).

Before beginning this procedure, ensure that you have successfully completed all of the steps in the Manually Configuring AWS for PCF topic. After completing the procedures in this topic, proceed to the Manually Configuring Elastic Runtime for AWS topic to continue deploying PCF.

Step 1: Access Ops Manager

Note: For security, Ops Manager 1.7 and later require that you log in using a fully qualified domain name to access Ops Manager.

  1. In a web browser, navigate to the fully qualified domain you created in the Step 16: Configure DNS Records section of the Manually Configuring AWS for PCF topic.

  2. When Ops Manager starts for the first time, you must choose one of the following:

Select authentication

Use an Identity Provider (IdP)

  1. Log in to your IdP console and download the IdP metadata XML. Optionally, if your IdP supports metadata URL, you can copy the metadata URL instead of the XML.

  2. Copy the IdP metadata XML or URL to the Ops Manager Use an Identity Provider log in page. Meta om

    Note: The same IdP metadata URL or XML is applied for the BOSH Director. If you are using a separate IdP for BOSH, copy the metadata XML or URL from that IdP and enter it into the BOSH IdP Metadata text box in the Ops Manager log in page.

  3. Enter your Decryption passphrase. Read the End User License Agreement, and select the checkbox to accept the terms.

  4. Your Ops Manager log in page appears. Enter your username and password. Click Login.

  5. Download your SAML Service Provider metadata (SAML Relying Party metadata) by navigating to the following URLs:

    • 5a. Ops Manager SAML service provider metadata: https://OPS-MAN-FQDN:443/uaa/saml/metadata
    • 5b. BOSH Director SAML service provider metadata: https://BOSH-IP-ADDRESS:8443/saml/metadata

    Note: To retrieve your BOSH-IP-ADDRESS, navigate to the Ops Manager Director tile > Status tab. Record the Ops Manager Director IP address.

  6. Configure your IdP with your SAML Service Provider metadata. Import the Ops Manager SAML provider metadata from Step 5a above to your IdP. If your IdP does not support importing, provide the values below.

    • Single sign on URL: https://OPS-MAN-FQDN:443/uaa/saml/SSO/alias/OPS-MAN-FQDN
    • Audience URI (SP Entity ID): https://OP-MAN-FQDN:443/uaa
    • Name ID: Email Address
    • SAML authentication requests are always signed
  7. Import the BOSH Director SAML provider metadata from Step 5b to your IdP. If the IdP does not support an import, provide the values below.

    • Single sign on URL: https://BOSH-IP:8443/saml/SSO/alias/BOSH-IP
    • Audience URI (SP Entity ID): https://BOSH-IP:8443
    • Name ID: Email Address
    • SAML authentication requests are always signed
  8. Return to the Ops Manager Director tile, and continue with the configuration steps below.

Internal Authentication

  1. When redirected to the Internal Authentication page, you must complete the following steps:

    • Enter a Username, Password, and Password confirmation to create an Admin user.
    • Enter a Decryption passphrase and the Decryption passphrase confirmation. This passphrase encrypts the Ops Manager datastore, and is not recoverable.
    • If you are using an HTTP proxy or HTTPS proxy, follow the instructions in the Configuring Proxy Settings for the BOSH CPI topic.
    • Read the End User License Agreement, and select the checkbox to accept the terms.
    • Click Setup Authentication.

    Om login

  2. Log in to Ops Manager with the Admin username and password you created in the previous step.

    Cf login

Step 2: AWS Config Page

  1. Click the Ops Manager Director tile.

    Om tile

  2. Select AWS Config.

    Aws config

  3. Select Use AWS Keys or Use AWS Instance Profile.

    • Access Key ID and AWS Secret Key: To retrieve your AWS key information, use the AWS Identity and Access Management (IAM) credentials that you generated in the Step 3: Create an IAM User for PCF section of the Manually Configuring AWS for PCF topic.
    • AWS IAM Instance Profile: Enter the name of the IAM profile you created in the Step 3: Create an IAM User for PCF section of the Manually Configuring AWS for PCF topic.
  4. Complete the rest of the AWS Management Console Config page:

    • VPC ID: Enter your PCF VPC ID. Locate the VPC ID on the AWS VPC Dashboard page next to the VPC name.
    • Security Group ID: Enter the Group ID of the pcf-vms-security-group you created for your PCF VMs in the Step 6: Configure a Security Group for PCF VMs section of the Manually Configuring AWS for PCF topic. Locate the Group ID in the Security Groups tab of your EC2 Dashboard.
    • Key Pair Name: Enter pcf-ops-manager-key.
    • SSH Private Key: Open the AWS key pair pcf-ops-manager-keys.pem file you generated in the Step 3: Create an IAM User for PCF section of the Manually Configuring AWS for PCF topic. Copy the contents of the .pem file and paste it into the SSH Private Key field.
    • Region: Select the region where you deployed Ops Manager.
    • Encrypt EBS Volumes: Select this checkbox to enable full encryption on persistent disks of all BOSH-deployed VMs except the Ops Manager VM and Director VM. See the Configuring Amazon EBS Encryption for PCF on AWS topic for details on using EBS encryption.
  5. Click Save.

Step 3: Director Config Page

  1. Select Director Config.

    Director aws

  2. Enter at least two of the following NTP servers in the NTP Servers (comma delimited) field, separated by a comma:

    • 0.amazon.pool.ntp.org
    • 1.amazon.pool.ntp.org
    • 2.amazon.pool.ntp.org
    • 3.amazon.pool.ntp.org
  3. (Optional) Enter your JMX Provider IP Address if you are Using JMX Bridge.

  4. (Optional) Enter your Bosh HM Forwarder IP Address if you are using the BOSH HM Forwarder.

  5. Select the Enable VM Resurrector Plugin checkbox to enable the Ops Manager Resurrector functionality and increase Elastic Runtime availability. For more information, see the Using Ops Manager Resurrector on VMware vSphere topic.

  6. Select Enable Post Deploy Scripts to run a post-deploy script after deployment. This script allows the job to execute additional commands against a deployment.

  7. Select Recreate all VMs to force BOSH to recreate all VMs on the next deploy. This process does not destroy any persistent disk data.

  8. Select Enable bosh deploy retries if you want Ops Manager to retry failed BOSH operations up to five times.

  9. Select Keep Unreachable Director VMs if you want to preserve Ops Manager Director VMs after a failed deployment for troubleshooting purposes.

  10. (Optional) Select HM Pager Duty Plugin to enable Health Monitor integration with PagerDuty.

    Director hm pager

    • Service Key: Enter your API service key from PagerDuty.
    • HTTP Proxy: Enter an HTTP proxy for use with PagerDuty.
  11. (Optional) Select HM Email Plugin to enable Health Monitor integration with email.

    Director hm email

    • Host: Enter your email hostname.
    • Port: Enter your email port number.
    • Domain: Enter your domain.
    • From: Enter the address for the sender.
    • Recipients: Enter comma separated addresses of intended recipients.
    • Username: Enter the username for your email server.
    • Password: Enter your username’s password.
    • Enable TLS: Select this checkbox to enable Transport Layer Security.
  12. For Blobstore Location, select S3 Compatible Blobstore and complete the following steps:

    Director blobstore

    • S3 Endpoint: Navigate to the Regions and Endpoints topic in the AWS documentation. Locate the endpoint for your region in the Amazon Simple Storage Service (S3) table and construct a URL using your region’s endpoint. For example, if you are using the us-west-2 region, the URL you create would be https://s3-us-west-2.amazonaws.com. Enter this URL into the S3 Endpoint field in Ops Manager.
    • Bucket Name: Enter the Ops Manager bucket name that you defined in the Manually Configuring PCF for AWS topic.
    • Access Key and Secret Key: To retrieve your AWS key information, use the IAM credentials that you generated in the Manually Configuring AWS for PCF topic.
    • Select V2 Signature or V4 Signature. If you select V4 Signature, enter your Region.

      Note: AWS recommends using Signature Version 4. For more information about AWS S3 Signatures, see the Authenticating Requests documentation.

  13. For Database Location, select External MySQL Database and complete the following steps: Director database

    • From the AWS Console, navigate to the RDS Dashboard.
    • Select Instances, then click the arrow to the left of your instance and select the second icon to display the Details information.
    • Refer to the following table to retrieve the values for the Director Config page:
      RDS Instance Field Ops Manager Director Field
      Endpoint Host
      Port Port, which is 3306.
      DB Name Database, which is bosh.
      Username Username

    • For Password, enter the password that you defined for your MySQL database when you created in the Step 19: Create a MySQL Database using AWS RDS section of the Manually Configuring AWS for PCF topic.
  14. (Optional) Director Workers sets the number of workers available to execute Director tasks. This field defaults to 5.

  15. (Optional) Max Threads sets the maximum number of threads that the Ops Manager Director can run simultaneously. For AWS, the default value is 6. Leave this field blank to use this default value. Pivotal recommends that you use the default value unless doing so results in rate limiting or errors on your IaaS.

  16. (Optional) To add a custom URL for your Ops Manager Director, enter a valid hostname in Director Hostname. You can also use this field to configure a load balancer in front of your Ops Manager Director.

  17. Click Save.

Step 4: Create Availability Zones Page

Note: Pivotal recommends at least three availability zones (AZs) for a highly available installation of Elastic Runtime. The procedures in Manually Configuring AWS for PCF use 3 AZs.

  1. Select Create Availability Zones. Create az
  2. Perform the following steps to add the three AZs you specified in the Step 4: Create a VPC section of the Manually Configuring AWS for PCF topic:

    1. Click Add.
    2. For Amazon Availability Zone, enter the name of the AZ.
    3. Repeat until you have entered all three AZs, in the format REGION-#a, REGION-#b, and REGION-#c. For example, us-west-2a, us-west-2b, and us-west-2c.
  3. Click Save.

Step 5: Create Networks Page

  1. Select Create Networks. Create networks
  2. (Optional) Select Enable ICMP checks to enable ICMP on your networks. Ops Manager uses ICMP checks to confirm that components within your network are reachable.
  3. Perform the following steps to add the network configuration you created for your VPC in the Step 4: Create a VPC section of the Manually Configuring PCF for AWS topic:

    1. Click Add Network.
    2. For Name, enter pcf-management-network.
    3. Create a subnet for each availability zone by clicking Add Subnet. Refer to the table below for the information required to create all three subnets:
      VPC Subnet ID CIDR Reserved IP Ranges DNS Gateway Availability Zones
      pcf-management-subnet-az0 10.0.16.0/28 10.0.16.0-10.0.16.4 169.254.169.253 10.0.16.1 REGION-#a (for example, us-west-2a)
      pcf-management-subnet-az1 10.0.16.16/28 10.0.16.16-10.0.16.20 169.254.169.253 10.0.16.17 REGION-#b (for example, us-west-2b)
      pcf-management-subnet-az2 10.0.16.32/28 10.0.16.32-10.0.16.36 169.254.169.253 10.0.16.33 REGION-#c (for example, us-west-2c)


    4. Click Add Network.
    5. For Name, enter pcf-ert-network.
    6. Create a subnet for each availability zone by clicking Add Subnet. Refer to the table below for the information required to create all three subnets:
      VPC Subnet ID CIDR Reserved IP Ranges DNS Gateway Availability Zones
      pcf-ert-subnet-az0 10.0.4.0/24 10.0.4.0-10.0.4.4 169.254.169.253 10.0.4.1 REGION-#a (for example, us-west-2a)
      pcf-ert-subnet-az1 10.0.5.0/24 10.0.5.0-10.0.5.4 169.254.169.253 10.0.5.1 REGION-#b (for example, us-west-2b)
      pcf-ert-subnet-az2 10.0.6.0/24 10.0.6.0-10.0.6.4 169.254.169.253 10.0.6.1 REGION-#c (for example, us-west-2c)


    7. Click Add Network.
    8. Check the Service Network box. This allows you to dynamically provision VMs in this network for use with on-demand services. Ops Manager does not provision VMs within the specified CIDR range.
    9. Enter pcf-services-network in Name field.
    10. Create a subnet for each availability zone by clicking Add Subnet. Refer to the table below for the information required to create all three subnets:
      VPC Subnet ID CIDR Reserved IP Ranges DNS Gateway Availability Zones
      pcf-services-subnet-az0 10.0.8.0/24 10.0.8.0-10.0.8.3 169.254.169.253 10.0.8.1 REGION-#a (for example, us-west-2a)
      pcf-services-subnet-az1 10.0.9.0/24 10.0.9.0-10.0.9.3 169.254.169.253 10.0.9.1 REGION-#b (for example, us-west-2b)
      pcf-services-subnet-az2 10.0.10.0/24 10.0.10.0-10.0.10.3 169.254.169.253 10.0.10.1 REGION-#c (for example, us-west-2c)
  4. Click Save.

Step 6: Assign AZs and Networks

  1. Select Assign AZs and Networks. Assign az
  2. Use the drop-down menu to select a Singleton Availability Zone. The Ops Manager Director is deployed into this AZ.
  3. Use the drop-down menu to select pcf-management-network under Network. The Ops Manager Director is deployed into this network.
  4. Click Save.

Step 7: Security Page

  1. Select Security.

    Om security

  2. In Trusted Certificates, enter a custom certificate authority (CA) certificate to insert into your organization’s certificate trust chain. This feature enables all BOSH-deployed components in your deployment to trust a custom root certificate. If you want to use Docker Registries for running app instances in Docker containers, use this field to enter your certificate for your private Docker Registry. See the Using Docker Registries topic for more information.

  3. Choose Generate passwords or Use default BOSH password. Pivotal recommends that you use the Generate passwords option for greater security.

  4. Click Save. To view your saved Director password, click the Credentials tab.

Step 8: Syslog Page

  1. Select Syslog. Syslog bosh

  2. (Optional) To send BOSH Director system logs to a remote server, select Yes.

  3. In the Address field, enter the IP address or DNS name for the remote server.

  4. In the Port field, enter the port number that the remote server listens on.

  5. In the Transport Protocol dropdown menu, select TCP, UDP, or RELP. This selection determines which transport protocol is used to send the logs to the remote server.

  6. (Optional) Mark the Enable TLS checkbox to use TLS encryption when sending logs to the remote server.

    • In the Permitted Peer field, enter either the name or SHA1 fingerprint of the remote peer.
    • In the SSL Certificate field, enter the SSL certificate for the remote server.
  7. Click Save.

Step 9: Resource Config Page

  1. Select Resource Config. Resource config new

  2. Adjust any values as necessary for your deployment. Under the Instances, Persistent Disk Type, and VM Type fields, choose Automatic from the drop-down menu to allocate the recommended resources for the job. If the Persistent Disk Type field reads None, the job does not require persistent disk space.

    Note: Pivotal recommends provisioning an Ops Manager Director VM with at least 8 GB memory.

    Note: If you set a field to Automatic and the recommended resource allocation changes in a future version, Ops Manager automatically uses the new recommended allocation.

  3. Click Save.

Step 10: Complete the Ops Manager Director Installation

  1. Return to the Installation Dashboard.
  2. Click Apply Changes.
  3. Ops Manager Director begins to install. The Changes Applied window displays when the installation process successfully completes.

    Vpc step16

  4. Proceed to the Manually Configuring Elastic Runtime for AWS topic to continue deploying PCF.

Create a pull request or raise an issue on the source for this page in GitHub