Create an AWS OpsWorks for Chef Automate Server by using AWS CloudFormation

Sign in to the AWS Management Console and open the AWS CloudFormation console at https://console.aws.amazon.com/cloudformation.

On the AWS CloudFormation home page, choose Create stack.

In Prerequisite - Prepare template, if you are using the example AWS CloudFormation template, choose Template is ready.

In Specify template, choose the source of your template. For this walkthrough, choose Upload a template file, and upload an AWS CloudFormation template that creates a Chef Automate server. Browse for your template file, and then choose Next.

An AWS CloudFormation template can be in either YAML or JSON format. An example AWS CloudFormation template is available for you to use; be sure to replace example values with your own. You can use the AWS CloudFormation template designer to build a new template or validate an existing one. For more information about how to do this, see AWS CloudFormation Designer Interface Overview in the AWS CloudFormation User Guide.

On the Specify stack details page, enter a name for your stack. This won't be the same as the name of your server, it is only a stack name. In the Parameters area, paste the values that you created in Prerequisites. Enter the password in Password.

Paste the contents of the RSA key file in PivotalKey. In the AWS CloudFormation console, you must add newline (\n) characters at the end of each line of the pivotal key value, as shown in the following screenshot. Choose Next.

On the Configure stack options page, you can add tags to the server you're creating with the stack, and choose an IAM role for creating resources if you have not already specified an IAM role to use in your template. When you're finished specifying options, choose Next. For more information about advanced options such as rollback triggers, see Setting AWS CloudFormation Stack Options in the AWS CloudFormation User Guide.

On the Review page, review your choices. When you are ready to create the server stack, choose Create stack.

While you are waiting for AWS CloudFormation to create the stack, view the stack creation status. If stack creation fails, review the error messages shown in the console to help you resolve the issues. For more information about troubleshooting errors in AWS CloudFormation stacks, see Troubleshooting Errors in the AWS CloudFormation User Guide.

When server creation is finished, your Chef Automate server is available on the AWS OpsWorks for Chef Automate home page, with a status of online. Generate a new Starter Kit and the Chef Automate dashboard credentials from the server's Properties page. After the server is online, the Chef Automate dashboard is available on the server's domain, at a URL in the following format: https://your_server_name-randomID.region.opsworks-cm.io.

aws opsworks describe-servers --server-name server_name

Be sure to complete the Prerequisites for creating an AWS OpsWorks for Chef Automate server.

Create a service role and an instance profile. AWS OpsWorks provides an AWS CloudFormation template that you can use to create both. Run the following AWS CLI command to create an AWS CloudFormation stack that creates the service role and instance profile for you.

aws cloudformation create-stack --stack-name OpsWorksCMRoles --template-url https://s3.amazonaws.com/opsworks-cm-us-east-1-prod-default-assets/misc/opsworks-cm-roles.yaml --capabilities CAPABILITY_NAMED_IAM

After AWS CloudFormation finishes creating the stack, find and copy the ARNs of service roles in your account.

aws iam list-roles --path-prefix "/service-role/" --no-paginate

In the results of the list-roles command, look for service role and instance profile entries that resemble the following. Make a note of the ARNs of the service role and instance profile, and add them to the AWS CloudFormation template that you are using to create your server stack.

{
    "AssumeRolePolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": "sts:AssumeRole",
                "Effect": "Allow",
                "Principal": {
                    "Service": "ec2.amazonaws.com"
                }
            }
        ]
    },
    "RoleId": "AROZZZZZZZZZZQG6R22HC",
    "CreateDate": "2018-01-05T20:42:20Z",
    "RoleName": "aws-opsworks-cm-ec2-role",
    "Path": "/service-role/",
    "Arn": "arn:aws:iam::000000000000:role/service-role/aws-opsworks-cm-ec2-role"
},
{
    "AssumeRolePolicyDocument": {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Action": "sts:AssumeRole",
                "Effect": "Allow",
                "Principal": {
                    "Service": "opsworks-cm.amazonaws.com"
                }
            }
        ]
    },
    "RoleId": "AROZZZZZZZZZZZZZZZ6QE",
    "CreateDate": "2018-01-05T20:42:20Z",
    "RoleName": "aws-opsworks-cm-service-role",
    "Path": "/service-role/",
    "Arn": "arn:aws:iam::000000000000:role/service-role/aws-opsworks-cm-service-role"
}

Create the AWS OpsWorks for Chef Automate server by running the create-stack command again.

aws cloudformation create-stack --stack-name stack_name --template-body file://template.yaml or json --parameters ParameterKey=PivotalKey,ParameterValue="base64_encoded_RSA_public_key_value"

The following is an example that includes sample values for the CHEF_AUTOMATE_ADMIN_PASSWORD and CHEF_AUTOMATE_PIVOTAL_KEY attributes. Run a similar command if you did not specify values for these attributes in your AWS CloudFormation template.

aws cloudformation create-stack --stack-name "OpsWorksCMChefServerStack" --template-body file://opsworkscm-server.yaml --parameters ParameterKey=PivotalKey,ParameterValue="$(openssl rsa -in "pivotalKey.pem" -pubout)" ParameterKey=Password,ParameterValue="SuPer\$ecret890"

When the stack creation is finished, open the Properties page for the new server in the AWS OpsWorks for Chef Automate console, and download a starter kit. Downloading a new starter kit resets the Chef Automate dashboard administrator password.

If your server will use a custom domain, certificate, and private key, follow steps for configuring knife.rb in (Optional) Configure knife to Work with a Custom Domain, and then go on to step 7.

If you are not using a custom domain, download the root certificate authority (CA) certificate from the following Amazon S3 bucket location: https://s3.amazonaws.com/opsworks-cm-us-east-1-prod-default-assets/misc/opsworks-cm-ca-2020-root.pem. Save the certificate file in a secure but convenient location. This certificate is required to configure knife.rb in the next step.

To use knife commands on the new server, update Chef knife.rb configuration file settings. An example knife.rb file is included with the starter kit. The following example shows how to set up knife.rb on a server that does not use a custom domain. If you are using a custom domain, see (Optional) Configure knife to Work with a Custom Domain for knife configuration instructions.

When the server creation process is finished, go on to Configure the Chef Server Using the Starter Kit. If stack creation fails, review the error messages shown in the console to help you resolve the issues. For more information about troubleshooting errors in AWS CloudFormation stacks, see Troubleshooting Errors in the AWS CloudFormation User Guide.