Cloud Spectra Gateway -- Quick Start v1.0.0

1. Overview

Cloud Spectra Gateway is an AWS networking appliance that deploys entirely into your own AWS account. It replaces metered AWS networking and LLM-API spend with a fixed EC2 cost -- your cloud, off the meter. All traffic and configuration stay inside your account: there is no vendor control plane and no data leaves your boundary.

You subscribe on the AWS Marketplace, launch a CloudFormation stack, and within minutes you have a running gateway with a management dashboard. Outbound NAT works immediately; you turn on additional features from the dashboard as you need them.

Cloud Spectra Gateway replaces the AWS services you are currently metered on with in-appliance equivalents:

Cloud Spectra ships as three tiers -- Platform, Network, and Security -- which stack, so each higher tier includes everything in the one below it. Platform carries the compute and Kubernetes worker stack (CPU and GPU) and makes a single stateful application cost-elastic; Network adds the networking data plane; Security adds inline inspection, enforcement and the governed AI LLM gateway. For the full breakdown of every feature and how it works, see the User Guide; for how the appliance is assembled internally, see the Architecture guide.

The ElasticApps tier Platform

ElasticApps is a separate Marketplace tier for a different job: making one stateful open-source application cost-elastic without clustering or a front-end load balancer. You pick a single app -- Grafana, ClickHouse, OpenSearch, PostgreSQL, Neo4j, Trino, Prometheus and more -- and the Cloud Spectra control plane runs it on a single instance that is vertically right-sized: it moves the app onto a bigger instance when it is busy and a smaller one when it is idle, and it can run that instance on Spot for a deeper discount. A sticky EBS data volume follows the app across every resize and replacement, and a stable Elastic IP and DNS name keep its address unchanged -- so the instance can move to the right size, and across Availability Zones, while the data and the endpoint stay put. Because the software fee is a small multiple of the instance's on-demand price (with a per-hour cap), scaling the box down directly shrinks your bill.

flowchart LR
    APP["One stateful app
(Grafana / ClickHouse /
Postgres / Trino / ...)"] --> Q{"App load?"}
    Q -->|"busy"| UP["Move to a
bigger instance"]
    Q -->|"idle"| DOWN["Move to a smaller
instance"]
    UP --> KEEP["Sticky EBS keeps the data
Elastic IP + DNS keep the address"]
    DOWN --> KEEP
    KEEP --> APP
    style APP fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a
    style UP fill:#d1fae5,stroke:#10b981,color:#065f46
    style DOWN fill:#d1fae5,stroke:#10b981,color:#065f46
    style KEEP fill:#fef3c7,stroke:#f59e0b,color:#92400e

CPU and GPU worker nodes

The CPU and GPU worker stacks -- both part of the Platform tier -- are worker-node AMIs rather than appliances. They exist to give a Kubernetes cluster ready-to-join nodes without you having to bake and maintain the image yourself, so there are no runtime settings to configure in the dashboard once a node is launched -- you launch the AMI and the node joins your cluster.

• The CPU worker stack -- a Kubernetes worker AMI with the containerd runtime, kubeadm/kubelet ready to join a cluster, and the Calico CNI pre-installed.
• The GPU worker stack -- the same worker AMI plus the NVIDIA driver, the CUDA toolkit, the vLLM runtime, and the NVIDIA device plugin pre-installed, for GPU workloads such as model serving.

Both sit in Platform, the lowest tier in the Cloud Spectra ranking, which runs Platform -> Network -> Security. A capability gated at that floor is therefore available in every tier above it: the sticky EBS data volume, which re-homes a persistent volume onto a replacement instance without reformatting, is the main example.

Deployment flow at a glance

graph TD
    MP["AWS Marketplace
subscribe to a tier"] --> CF["CloudFormation stack
new-VPC or existing/BYO-VPC"]
    CF --> ASG["Per-AZ Auto Scaling Group
one ASG per Availability Zone"]
    ASG --> GWLB["Gateway Load Balancer (GENEVE)
horizontal scale"]
    GWLB --> EIP["Elastic IP
stable endpoint"]
    EIP --> DASH["HTTPS dashboard
port 9443 (nginx, self-signed)"]
    DASH --> DONE["Login & configure"]
    style MP fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a
    style CF fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a
    style DONE fill:#d1fae5,stroke:#10b981,color:#065f46

2. Prerequisites

To complete this quick start you need:

• An AWS account where you can subscribe on the Marketplace and create resources.
• A chosen AWS Region to deploy into (any commercial region works).
• Permissions to create CloudFormation stacks and the resources they create: EC2 instances, VPC networking, IAM roles, Auto Scaling groups, and an Elastic IP.
• No EC2 key pair needed. The stack creates its own key pair and stores the private key in SSM Parameter Store for you; the stack Outputs include the command to download it (see section 5).
• Optional: an AWS Certificate Manager (ACM) certificate if you want TLS termination on port 443, in front of your own services, to serve a trusted certificate. This does not change the management dashboard's certificate -- in v1 the dashboard always serves a per-instance self-signed certificate.

3. Choose a deployment

Cloud Spectra Gateway supports three deployment methods. This quick start focuses on the Marketplace 1-click CloudFormation path; the other two are covered in detail in the User Guide.

CloudFormation: new VPC vs existing/BYO VPC

The Marketplace listing offers two CloudFormation templates. Pick the one that matches your environment:

• New-VPC template -- Cloud Spectra creates a fresh VPC, subnets, route tables, and an internet gateway for you. This is the simplest starting point and is the default.
• Existing / BYO-VPC template -- Cloud Spectra deploys into a VPC and subnets you already operate. Use this for production accounts where the network is already established.

4. Deploy via CloudFormation

Estimated time: 8-10 minutes

5. First login

# 1. Download the stack-generated private key
#    (copy this command verbatim from the AccessInstancePrivateKeyCommand stack output)
aws ssm get-parameter --name /ec2/keypair/<KEY_PAIR_ID> --with-decryption \
  --query Parameter.Value --output text > ~/.ssh/<KEY_NAME> && chmod 400 ~/.ssh/<KEY_NAME>

# 2. SSH in as user "admin" with that key
ssh -i ~/.ssh/<KEY_NAME> admin@<ELASTIC_IP>

# 3. Read the one-time dashboard init password (root-only file)
sudo cat /etc/cloudspectra/dashboard_init_pw

6. NAT works out of the box

As soon as the stack reaches CREATE_COMPLETE, source NAT is already running on the appliance -- no configuration step is required. Private instances whose route tables point default traffic at the Cloud Spectra ENI immediately reach the internet through the gateway's Elastic IP.

graph LR
    subgraph VPC["Your VPC"]
        PRIV["Private subnet instances
(no public IP)"]
        GW["Cloud Spectra Gateway
sNAT on per-AZ ENI"]
    end
    EIP["Elastic IP
(stable egress)"]
    NET["Internet"]
    PRIV -->|"0.0.0.0/0 route"| GW
    GW --> EIP
    EIP --> NET
    style GW fill:#d1fae5,stroke:#10b981,color:#065f46
    style EIP fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a

# From a private instance routed through Cloud Spectra:
curl -s https://checkip.amazonaws.com

# The returned IP should match the gateway's Elastic IP
# (the AccessElasticIp value from the stack Outputs).

7. Enable a feature

Every additional capability is turned on the same way: from the dashboard (or the config API on port 8080, or the Terraform provider). Per-feature configuration reference -- including firewall rules, the Squid proxy, TLS termination, and the AI Gateway -- lives in the User Guide. Here is the pattern using one Network-tier feature, the forward HTTP proxy.

flowchart LR
    A["Dashboard (HTTPS 9443)"] --> B["Toggle a feature on"]
    B --> C["Config saved to
SSM Parameter Store"]
    C --> D["Gateway nodes reconcile
and apply the change"]
    D --> E["Feature live
on all AZs"]
    style A fill:#dbeafe,stroke:#3b82f6,color:#1e3a8a
    style E fill:#d1fae5,stroke:#10b981,color:#065f46

# Send outbound traffic through the Cloud Spectra forward proxy
# (username is always "admin"; copy PROXY_PASSWORD from the
#  Web Proxy panel's Proxy Credential card)
export http_proxy=http://admin:<PROXY_PASSWORD>@<GATEWAY>:<PROXY_PORT>
export https_proxy=$http_proxy
curl -s https://checkip.amazonaws.com

Key ports

8. Verify

A quick end-to-end check confirms the gateway is healthy and routing correctly.

If outbound traffic does not return the gateway's Elastic IP, confirm the private subnet's route table sends 0.0.0.0/0 to the Cloud Spectra ENI for that AZ. Common questions and troubleshooting are collected in the FAQ.

9. Next steps

You now have a running Cloud Spectra Gateway with NAT live and a feature enabled. Where to go from here: