Sandbox Edition

​

Overview

​

Before You Start

1. Your public IP address
   Run:
   curl https://checkip.amazonaws.com
   
   Note the result. You’ll use it as YOUR_IP/32 (example: 203.0.113.45/32)
2. AWS Account with an active AWS Marketplace subscription
3. EC2 Key Pair in your target region (for SSH access)
4. VPC with a public subnet (the subnet must have an internet gateway route)

​

Security Model

• You must restrict access to your IP or corporate network
• You should not use 0.0.0.0/0 (this would expose the application to the public internet with no authentication) exposing what your sandbox has published to it. Using AWS Security Groups allows the restriction of the instance to be tied to an individual or corporate network

​

Deployment Steps

​

Step 1: Subscribe on AWS Marketplace

1. Go to AWS Marketplace
2. Click Continue to Subscribe
3. Accept terms and wait 1 to 2 minutes for processing
4. Click Continue to Configuration
5. Select your AWS region
6. Click Continue to Launch
7. Under “Choose Action”, select Launch CloudFormation
8. Click Launch

​

Step 2: Configure CloudFormation Parameters

​

Step 3: Launch the Stack

1. Click Next (Stack options page, no changes needed)
2. Click Next (Review page)
3. Check the acknowledgment box for IAM resource creation
4. Click Submit

​

Step 4: Wait for Completion

​

Step 5: Access the Application

1. Click on your stack name
2. Go to the Outputs tab
3. Find the ApplicationUrl output
4. Click the URL or copy it to your browser

• IP-Restricted (No Custom Domain): http://ec2-XX-XX-XX-XX.compute-1.amazonaws.com (the public DNS address using HTTP)
• Custom Domain (No SSL): http://your-domain.example.com (HTTP protocol)
• Custom Domain (With SSL): https://your-domain.example.com (HTTPS protocol, after manual SSL setup)

​

Outputs Reference

​

Retrieving Credentials

# Use the SSHCommand from Outputs, then run:
sudo cat /etc/aletyx/credentials

aws ssm start-session --target INSTANCE_ID
sudo cat /etc/aletyx/credentials

​

Common Configurations

​

Single User (Recommended for POC)

AllowedCidr: YOUR_IP/32

​

Team Access (Corporate Network)

AllowedCidr: 10.0.0.0/8

​

Adding Additional IPs After Deployment

# Get the Security Group ID from CloudFormation Resources tab
aws ec2 authorize-security-group-ingress \
  --group-id sg-XXXXX \
  --protocol tcp \
  --port 80 \
  --cidr ADDITIONAL_IP/32 \
  --region us-east-1

​

Domain and SSL Options

​

Three Supported Options

​

Option 1: IP-Restricted HTTP (Default URL)

AllowedCidr: YOUR_IP/32
CustomDomain: ""
HostedZoneName: ""

​

Option 2: IP-Restricted HTTP (Custom Domain)

AllowedCidr: YOUR_IP/32
CustomDomain: demo
HostedZoneName: example.com

​

Option 3: IP-Restricted HTTPS (Two-Step SSL Setup)

AllowedCidr: YOUR_IP/32
CustomDomain: demo
HostedZoneName: example.com

1. Get your security group ID from CloudFormation Resources tab
2. Temporarily open port 80 for Let’s Encrypt validation (2-3 minutes):
   # Get security group ID from CloudFormation
   SG_ID="sg-xxxxx"
   
   # Temporarily open port 80
   aws ec2 authorize-security-group-ingress \
     --group-id $SG_ID \
     --protocol tcp \
     --port 80 \
     --cidr 0.0.0.0/0 \
     --region us-east-1
   
3. Run SSL setup on the instance:
   # SSH to your instance
   ssh -i your-key.pem ec2-user@demo.example.com
   
   # Run SSL setup script
   sudo /usr/local/bin/ssl-setup.sh demo.example.com admin@example.com 8080
   
4. IMMEDIATELY close port 80 after SSL completes:
   # Close port 80
   aws ec2 revoke-security-group-ingress \
     --group-id $SG_ID \
     --protocol tcp \
     --port 80 \
     --cidr 0.0.0.0/0 \
     --region us-east-1
   

• You control exactly when port 80 is open (2-3 minutes)
• You’re watching it happen
• You close it immediately after SSL completes
• Minimal risk window

​

What’s NOT Supported

• Port 80 would be open to the world during stack creation
• Application is accessible without authentication
• 5-10 minute window where anyone can access
• High security risk

​

Troubleshooting

​

Cannot connect to application

1. Wait for startup: The application needs 2 to 3 minutes after stack creation
2. Check your IP: Run curl https://checkip.amazonaws.com and compare with your AllowedCidr
3. Verify subnet is public: The subnet must have a route to an internet gateway

​

IP address changed

# Remove old rule
aws ec2 revoke-security-group-ingress \
  --group-id sg-XXXXX \
  --protocol tcp \
  --port 80 \
  --cidr OLD_IP/32 \
  --region us-east-1

# Add new rule
aws ec2 authorize-security-group-ingress \
  --group-id sg-XXXXX \
  --protocol tcp \
  --port 80 \
  --cidr NEW_IP/32 \
  --region us-east-1

​

Cannot SSH to instance

1. Check key permissions: chmod 400 ~/.ssh/your-key.pem
2. Verify AllowedCidr includes your IP (SSH uses port 22, which is also restricted)
3. Alternative: Use AWS Systems Manager Session Manager instead

​

Application shows errors

sudo tail -f /var/log/aletyx-sandbox.log

sudo systemctl restart aletyx-sandbox

​

Stack creation failed

• Subnet not public: Use a subnet with an internet gateway route
• Invalid CIDR format: Must include the prefix (example: 203.0.113.45/32, not just the IP)
• Key pair not found: Create or select an existing EC2 key pair in your region

​

Cleanup

1. Go to CloudFormation
2. Select your stack
3. Click Delete
4. Confirm

aws cloudformation delete-stack \
  --stack-name decision-control-sandbox \
  --region us-east-1

​

Cost Reference

​

Quick Reference

​

Support

• Documentation: https://docs.aletyx.ai
• Support Email: aws-support@aletyx.ai
• Support Portal: https://my.aletyx.ai

​

Important: Security Model

​

The Sandbox Has NO Login Screen

• Auto-login enabled for fast POC/testing without password management
• NO authentication - No username/password required to access
• MUST be IP-restricted - Security enforced ONLY by AWS Security Group
• Cannot be exposed to public internet - Would allow anyone full access

​

How Security Works

Internet → AWS Security Group → EC2 Instance → Application
           ↑
           Only allowed IPs can pass through

• AWS Security Group blocks ALL traffic except from your IP
• Your IP is the ONLY one that can reach the application
• This is secure (equivalent to VPN access)

​

Quick Start (5 Minutes)

​

Prerequisites

1. Your IP address: Run curl https://checkip.amazonaws.com
2. AWS Account with marketplace subscription
3. EC2 Key Pair for SSH access
4. VPC with public subnet

​

Deploy Now

1. Subscribe to product in AWS Marketplace
2. Launch with CloudFormation
3. Use these parameters:
   InstanceType: t3.large
   KeyName: YOUR-KEY-NAME
   VpcId: YOUR-VPC-ID
   SubnetId: YOUR-SUBNET-ID           # must be public
   AllowedCidr: YOUR_IP/32             # YOUR IP FROM STEP 1
   CustomDomain: ""                    # leave empty
   HostedZoneName: ""                  # leave empty
   
4. Wait 5 minutes for stack to complete
5. Go to “Outputs” tab → Click “ApplicationUrl”
6. Done!

​

Step-by-Step Deployment

​

Step 1: Get Your IP Address

curl https://checkip.amazonaws.com

​

Step 2: Subscribe to AWS Marketplace

1. Go to AWS Marketplace
2. Search “Aletyx Decision Control Sandbox”
3. Click “Continue to Subscribe”
4. Accept terms (wait 1-2 minutes for processing)
5. Click “Continue to Configuration”
6. Select your region (e.g., us-east-1)
7. Click “Continue to Launch”
8. Select “Launch CloudFormation”
9. Click “Launch”

​

Step 3: CloudFormation Parameters

InstanceType: t3.large              # recommended - or t3.medium for smaller
KeyName: your-keypair-name          # select your existing EC2 key pair
AmiId: ""                           # leave empty - uses marketplace AMI

VpcId: vpc-xxxxx                    # your VPC
SubnetId: subnet-xxxxx              # MUST be public subnet with internet access
AllowedCidr: YOUR_IP/32             # example: 203.0.113.45/32

CustomDomain: ""                    # leave empty
HostedZoneName: ""                  # leave empty

​

Step 4: Review and Launch

1. Click “Next” (Configure stack options - no changes needed)
2. Click “Next” (Review)
3. Check “I acknowledge that AWS CloudFormation might create IAM resources”
4. Click “Submit”

​

Step 5: Wait for Completion

• You’ll see resources being created
• Wait for status: CREATE_COMPLETE (takes 3-5 minutes)

• Check “Events” tab for error message
• Common issues: Subnet not public, AllowedCidr format wrong

​

Step 6: Access the Application

1. Click on your stack name
2. Go to “Outputs” tab
3. You’ll see these outputs:

4. Click ApplicationUrl (or copy/paste into browser)

• IP-Restricted (No Custom Domain): http://ec2-XX-XX-XX-XX.compute-1.amazonaws.com (public DNS address with HTTP)
• Custom Domain (No SSL): http://your-domain.example.com (HTTP protocol)
• Custom Domain (With SSL): https://your-domain.example.com (HTTPS protocol, after manual SSL setup)

5. Wait 2-3 minutes after stack creation for application to start
6. You’re in! No login needed - auto-login enabled

​

Getting Your Credentials

​

Method 1: SSH to Get Credentials

# 1. Copy SSHCommand from CloudFormation Outputs
ssh -i ~/.ssh/your-key.pem ec2-user@ec2-XX-XX-XX-XX.compute-1.amazonaws.com

# 2. Get credentials
sudo cat /etc/aletyx/credentials

# Output:
# Admin Username: admin
# Admin Password: RandomGeneratedPassword123!

​

Method 2: Systems Manager (No SSH Key Needed)

# Get instance ID from CloudFormation Outputs
INSTANCE_ID="i-0abc123..."

# Connect via Session Manager
aws ssm start-session --target $INSTANCE_ID

# Get credentials
sudo cat /etc/aletyx/credentials

​

Supported Deployments

​

Option 1: Personal IP-Restricted (RECOMMENDED)

AllowedCidr: YOUR_IP/32          # Your IP only
CustomDomain: ""                 # Leave empty
HostedZoneName: ""               # Leave empty

• Personal POC/testing
• Development
• Customer demos (via screen share)

​

Option 2: Corporate Network

AllowedCidr: 10.0.0.0/8          # Your corporate CIDR
CustomDomain: ""                 # Leave empty
HostedZoneName: ""               # Leave empty

• Team testing
• Internal demos
• Multi-user POCs

• 10.0.0.0/8 - Large networks
• 172.16.0.0/12 - Medium networks
• 192.168.0.0/16 - Small networks

​

NOT SUPPORTED Deployments

​

Public Access (Open to Internet)

# DO NOT USE
AllowedCidr: 0.0.0.0/0          # DANGEROUS - exposes to public
CustomDomain: ""
HostedZoneName: ""

• No login screen - anyone can access
• Full application access to public internet
• High security risk
• Data exposure

​

Custom Domain with SSL

# DO NOT USE
AllowedCidr: 0.0.0.0/0          # DANGEROUS
CustomDomain: demo
HostedZoneName: example.com

• Let’s Encrypt requires port 80 open to world
• No login screen - application fully accessible during setup
• 3-5 minute window where anyone can access
• High security risk

​

Demo Scenarios

​

Scenario: Show to a Customer

1. Deploy IP-restricted (YOUR_IP/32)
2. Access the application from your computer
3. Share your screen during the demo (Zoom, Teams, etc.)
4. Customer sees everything - full application functionality
5. Zero security risk - application never exposed to public

​

Scenario: Customer Wants Hands-On Access

# Add customer's IP
AllowedCidr: 198.51.100.45/32

# OR customer's corporate network
AllowedCidr: 198.51.100.0/24

# Get security group ID from CloudFormation Resources
SG_ID="sg-xxxxx"

# Add customer's IP
aws ec2 authorize-security-group-ingress \
  --group-id $SG_ID \
  --protocol tcp \
  --port 80 \
  --cidr 198.51.100.45/32 \
  --region us-east-1

​

Scenario: Need HTTPS URL

• Use IP-restricted HTTP (it’s secure when restricted!)
• Screen share for demos
• For production with SSL, use Production edition (has authentication)

​

Troubleshooting

​

Can’t Access Application

1. Wait 2-3 minutes after stack creation for app to start
2. Check your IP hasn’t changed:
   # Get your current IP
   curl https://checkip.amazonaws.com
   
   # Compare with AllowedCidr parameter in CloudFormation
   
3. Update Security Group if IP changed:
   # Get your new IP
   NEW_IP=$(curl -s https://checkip.amazonaws.com)
   
   # Get security group ID from CloudFormation Resources tab
   SG_ID="sg-xxxxx"
   
   # Remove old rule (use old IP)
   aws ec2 revoke-security-group-ingress \
     --group-id $SG_ID \
     --protocol tcp \
     --port 80 \
     --cidr OLD_IP/32 \
     --region us-east-1
   
   # Add new rule
   aws ec2 authorize-security-group-ingress \
     --group-id $SG_ID \
     --protocol tcp \
     --port 80 \
     --cidr ${NEW_IP}/32 \
     --region us-east-1
   
4. Check application status via SSH:
   ssh -i your-key.pem ec2-user@ec2-XX-XX-XX-XX.compute-1.amazonaws.com
   sudo systemctl status aletyx-sandbox
   
   # Should show: "active (running)"
   

​

Can’t SSH to Instance

1. Fix key permissions:
   chmod 400 ~/.ssh/your-key.pem
   
2. Check AllowedCidr allows port 22:
   • CloudFormation parameter AllowedCidr must include your IP
   • Security group allows SSH (port 22) from your CIDR
3. Use Systems Manager instead (no key needed):
   aws ssm start-session --target i-INSTANCE-ID
   

​

Application Shows Error Page

# Application logs
sudo tail -f /var/log/aletyx-sandbox.log

# Nginx logs
sudo tail -f /var/log/nginx/error.log

# System logs
sudo journalctl -u aletyx-sandbox -f

sudo systemctl restart aletyx-sandbox

# Wait 30 seconds
sudo systemctl status aletyx-sandbox

​

Stack Creation Failed

1. “Subnet not public”:
   • Solution: Use a subnet with internet gateway route
   • Or create new public subnet
2. “Invalid CIDR format”:
   • Solution: Use format like 203.0.113.45/32 (IP/32)
   • Not just IP without /32
3. “Key pair not found”:
   • Solution: Create EC2 key pair first
   • Or select existing key pair

​

Cleanup

​

Delete Your Deployment

​

Via AWS Console

1. Go to CloudFormation Console
2. Select your stack
3. Click “Delete”
4. Confirm deletion
5. Wait 3-5 minutes

​

Via AWS CLI

aws cloudformation delete-stack \
  --stack-name aletyx-sandbox-dev \
  --region us-east-1

# Check deletion progress
aws cloudformation describe-stacks \
  --stack-name aletyx-sandbox-dev \
  --region us-east-1

​

What Gets Deleted

• EC2 instance (stops hourly charges)
• Security group
• IAM role and instance profile
• All associated resources

​

What Doesn’t Get Deleted

• SSH key pair (reusable - keep it)
• VPC and subnets (shared resources)
• Your data (not backed up - save before deleting!)

​

Cost Information

​

Hourly Cost (us-east-1)

• t3.medium: ~$0.04/hour (~$30/month if left running)
• t3.large: ~$0.08/hour (~$60/month if left running)

​

Save Money

• Delete when not in use - Redeploy takes only 5 minutes
• Stop instance (keeps data, still charges for storage)
• Use t3.medium for light testing

​

Common Commands Reference

​

Check Application Status

sudo systemctl status aletyx-sandbox

​

View Logs

# Application
sudo tail -f /var/log/aletyx-sandbox.log

# Nginx
sudo tail -f /var/log/nginx/access.log
sudo tail -f /var/log/nginx/error.log

​

Restart Application

sudo systemctl restart aletyx-sandbox

​

Get Credentials

sudo cat /etc/aletyx/credentials

​

Check Your Current IP

curl https://checkip.amazonaws.com

​

Summary

​

The Sandbox Is

• Fast to deploy (5 minutes)
• Easy to use (auto-login, no password management)
• Secure when IP-restricted
• Perfect for POCs, testing, demos

​

Remember

• MUST be IP-restricted - Use YOUR_IP/32 or corporate CIDR
• Do NOT use 0.0.0.0/0 - Not secure (no login screen)
• Do NOT configure SSL - Not supported securely
• Screen share for demos - Professional and secure

​

Quick Deploy Checklist

1. Get IP: curl https://checkip.amazonaws.com
2. Deploy CloudFormation with AllowedCidr: YOUR_IP/32
3. Wait 5 minutes
4. Click ApplicationUrl in Outputs
5. Done!

​

Need Help?