Preparing to Deploy PCF on AWS Using Terraform
Page last updated:
Warning: Pivotal Operations Manager v2.0 is no longer supported because it has reached the End of General Support (EOGS) phase as defined by the Support Lifecycle Policy. To stay up to date with the latest software and security updates, upgrade to a supported version.
This guide describes the preparation steps required to install Pivotal Cloud Foundry (PCF) on Amazon Web Services (AWS) using Terraform templates.
The Terraform template for PCF on AWS describes a set of AWS resources and properties. For more information about how Terraform creates resources in AWS, see the AWS Provider topic on the Terraform site.
You may also find it helpful to review different deployment options in the Reference Architecture for Pivotal Cloud Foundry on AWS.
In addition to fulfilling the prerequisites listed in the Installing Pivotal Cloud Foundry on AWS topic, ensure you have the following:
- The Terraform CLI
- In your AWS account, ensure you have an IAM user with the following permissions:
Before you can run Terraform commands to create infrastructure resources, you must fill out a template variables file.
Navigate to the Pivotal Application Service (PAS) release on Pivotal Network.
Download the AWS Terraform zip file.
Extract the contents of the zip file and move the folder to the
workspacedirectory on your local machine.
From a terminal window, navigate to the folder:
$ cd ~/workspace/TERRAFORMING-AWS-FOLDER
Create a new file named
$ touch terraform.tfvars
terraform.tfvarsfile and paste in the following contents:
env_name = "YOUR-ENVIRONMENT-NAME" access_key = "YOUR-ACCESS-KEY" secret_key = "YOUR-SECRET-KEY" region = "YOUR-AWS-REGION" availability_zones = ["YOUR-AZ-1", "YOUR-AZ-2", "YOUR-AZ-3"] ops_manager_ami = "YOUR-OPS-MAN-IMAGE-AMI" dns_suffix = "YOUR-DNS-SUFFIX" ssl_cert = <<SSL_CERT -----BEGIN CERTIFICATE----- YOUR-CERTIFICATE -----END CERTIFICATE----- SSL_CERT ssl_private_key = <<SSL_KEY -----BEGIN EXAMPLE RSA PRIVATE KEY----- YOUR-PRIVATE-KEY -----END EXAMPLE RSA PRIVATE KEY----- SSL_KEY
Edit the values in the file according to the table below:
Value to replace Guidance
Enter a name to use to identify resources in AWS. Terraform prepends the names of the resources it creates with this environment name. Example:
Enter your AWS Access Key ID of the AWS account in which you want Terraform to create resources.
Enter your AWS Secret Access Key of the AWS account in which you want Terraform to create resources.
Enter the name of the AWS region in which you want Terraform to create resources. Example:
Enter three availability zones from your region. Example:
Enter the source code for the Ops Manager Amazon Machine Image (AMI) you want to boot. You can find this code in the PDF included with the Ops Manager release on Pivotal Network.
If you want to encrypt your Ops Manager VM, create an encrypted AMI copy from the AWS EC2 dashboard and enter the source code for the coped Ops Manager image instead. For more information about copying an AMI, see step 9 of Launch an Ops Manager AMI in the manual AWS configuration topic.
Enter a domain name to use as part of the system domain for your PCF deployment. Terraform creates DNS records in AWS using
YOUR-DNS-SUFFIX. For example, if you enter
example.comfor your DNS suffix and have
pcfas your environment name, Terraform will create DNS records at
Enter a certificate to use for HTTP load balancing. For production environments, use a certificate from a Certificate Authority (CA). For test environments, you can use a self-signed certificate.
Your certificate must specify your system domain as the common name. Your system domain is
It also must include the following subdomains:
Enter a private key for the certificate you entered.
Complete this step if you want to do any of the following:
- Use an RDS for your deployment
- Deploy the Isolation Segment tile
terraform.tfvars file, specify the appropriate variables from the sections below.
Note: You can see the configurable options by opening the
variables.tf file and looking for variables with default values.
If you plan to deploy the Isolation Segment tile, add the following variables to your
YOUR-PRIVATE-KEY with a certificate and private key.
This causes terraform to create an additional HTTP load balancer across three availability zones to use for the Isolation Segment tile.
create_isoseg_resources = 1 iso_seg_ssl_cert = <<ISO_SEG_SSL_CERT -----BEGIN CERTIFICATE----- YOUR-CERTIFICATE -----END CERTIFICATE----- ISO_SEG_SSL_CERT iso_seg_ssl_cert_private_key = <<ISO_SEG_SSL_KEY -----BEGIN EXAMPLE RSA PRIVATE KEY----- YOUR-PRIVATE-KEY -----END EXAMPLE RSA PRIVATE KEY----- ISO_SEG_SSL_KEY
If you want to use an RDS for Ops Manager and PAS, add the following to your
rds_instance_count = 1
If you want to specify a username for RDS authentication, add the following variable to your
rds_db_username = username
Follow these steps to use the Terraform CLI to create resources on AWS:
From the directory that contains the Terraform files, run
terraform initto initialize the directory based on the information you specified in the
$ terraform init
terraform plan -out=planto create the execution plan for Terraform.
$ terraform plan -out=plan
terraform apply planto execute the plan from the previous step. It may take several minutes for Terraform to create all the resources in AWS.
$ terraform apply plan
In a browser, navigate to the DNS provider for the DNS suffix you entered in your
Create a new NS (Name server) record for your PCF system domain. Your system domain is
In this record, enter the name servers included in
env_dns_zone_name_serversfrom your Terraform output.
Proceed to the next step in the deployment, Configuring BOSH Director on AWS Using Terraform.