StorageLink AMI Deployment

TLDR

Purpose: Launch StorageLink BYOL as a standalone EC2 instance from the AMI, without CloudFormation

Recommended: Use the Single Instance CloudFormation template in the Installation guide instead; it creates the IAM role, security group, Elastic IP, and admin account for you

Steps:

1. Subscribe to StorageLink BYOL on AWS Marketplace (free)
2. Create an IAM policy and role for S3 buckets named storagelink-i-*
3. Launch the AMI from the EC2 console with the role, a 32 GiB disk, and ports 22, 80, and 443 open to your IP
4. Associate an Elastic IP, open https://<ip-address>, create the admin account, and start the free 30-day trial

Product: StorageLink by Thorn Technologies — cloud storage gateway for secure file sharing

Overview

This guide launches the StorageLink BYOL Amazon Machine Image (AMI) as a standalone EC2 instance.

We recommend the StorageLink (Single Instance - Existing Network) CloudFormation template described in the Installation guide instead. A manual launch has to recreate by hand what that template sets up: the IAM role, the security group, a 32 GiB disk, the Elastic IP address, and the first admin account.

Using the pay-as-you-go listing?

The same steps work with the AMI from the Standard (pay-as-you-go) StorageLink listing. It bills a $0.08 USD/hour software fee and is licensed for up to 10 StorageLink users. See StorageLink Standard vs BYOL.

Subscribe on AWS Marketplace

1. Open the StorageLink BYOL listing on AWS Marketplace and click View purchase options.
2. The public offer is free of charge. Under Pricing details, select the Unit dimension (License units, $0.00) and leave Number of units at 1; the Subscribe button stays disabled until a dimension is selected. Click Subscribe at the bottom of the page and wait a few minutes for the subscription to complete. You only need to subscribe once per AWS account.

Create an IAM policy

The policy lets StorageLink create and use S3 buckets whose names start with storagelink-i-, and write its logs to CloudWatch. It matches the policy the CloudFormation templates create.

1. Go to the AWS console > IAM > Policies and click Create policy.
2. Select the JSON tab and paste in the policy below. Replace <your-account-id> with your 12-digit AWS account ID.
3. Click Next, enter StorageLinkPolicy as the Policy name, and click Create policy.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation",
                "s3:ListBucket",
                "s3:CreateBucket",
                "s3:PutBucketPublicAccessBlock"
            ],
            "Resource": "arn:aws:s3:::storagelink-i-*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:PutObject",
                "s3:DeleteObject"
            ],
            "Resource": "arn:aws:s3:::storagelink-i-*/*",
            "Condition": {
                "StringEquals": {
                    "s3:ResourceAccount": "<your-account-id>"
                }
            }
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "logs:DescribeLogStreams",
                "logs:CreateLogGroup",
                "logs:GetLogEvents",
                "ec2:DescribeAvailabilityZones",
                "ec2:DescribeInstances",
                "ec2:DescribeTags"
            ],
            "Resource": "*"
        }
    ]
}

Note: To let StorageLink use buckets with other names, add their ARNs (for example arn:aws:s3:::my-bucket and arn:aws:s3:::my-bucket/*) to the first two statements. You can also connect a bucket with access keys instead; see Access Key and Secret.

Create an IAM role

1. Go to the AWS console > IAM > Roles and click Create role.
2. Under Trusted entity type, select AWS service. Under Use case, select EC2, then click Next.
3. Search for StorageLinkPolicy, check the box next to it, and click Next.
4. Enter StorageLinkRole as the Role name and click Create role.

Launch the instance

1. Go to the AWS console > EC2 and click Launch instance.
2. Enter a Name. Under Application and OS Images, click Browse more AMIs, open the AWS Marketplace AMIs tab, search for StorageLink BYOL, and click Select.
3. Instance type: For testing, use a t3.medium. The t3 class is cheaper, but cannot handle sustained traffic. For production, use an m5.large or larger.
4. Key pair: Select a key pair whose private key you own.
5. Network settings: Choose a VPC and a public subnet, and set Auto-assign public IP to Enable. The default VPC and any of its subnets (172.31.x.0/20) work. Create a security group that allows:
   • SSH (port 22) from your IP address. Get it from http://checkip.dyndns.org/ and add /32 (for example, 1.2.3.4/32).
   • HTTP (port 80) and HTTPS (port 443) from your IP address, or from 0.0.0.0/0 if many users will connect.
6. Configure storage: Set the root volume to 32 GiB. The AMI defaults to 8 GiB; the CloudFormation templates use 32 GiB, the smallest size they allow.
7. Expand Advanced details and set IAM instance profile to StorageLinkRole. Selecting the role at launch gives the instance S3 access from its first boot.
8. Click Launch instance.

StorageLink creates its S3 bucket, storagelink-i-<instance-id>, when you create the admin account on the Welcome page (see below), and uses it for the root folder. If the instance cannot create the bucket at that moment — for example, because its role does not yet allow storagelink-i-* buckets — StorageLink still points the root folder at storagelink-i-<instance-id>, and fixing the role afterwards does not create the bucket by itself. After you fix the role, run Test Connection on the root folder's cloud connection (see Cloud Connections); with working permissions, the test creates the missing bucket.

Associate an Elastic IP address

As with any server, you want to assign it an Elastic IP address, which is like a static IP address. Otherwise, the public IP address changes whenever you stop the instance.

1. Go to the AWS console > EC2 > Elastic IPs and click Allocate Elastic IP address, then Allocate.
2. Select the new address and choose Actions > Associate Elastic IP address.
3. Choose your StorageLink instance and click Associate.

Sign in and start your free trial

1. Open https://<elastic-ip-address> in your browser and accept the self-signed certificate warning.
2. Because no CloudFormation parameters created an admin account, the Welcome page asks you to create one. Enter a username and a password of 12 or more characters. See First Launch Experience.
3. A StorageLink BYOL instance starts unlicensed: until you start a trial or activate a license, non-administrator users cannot sign in and file transfers are blocked. Use the Start a 30-day free trial card at the top of the admin UI to start your trial.

When you are ready to license the instance, see Purchasing a License. On AWS, the license is purchased through AWS Marketplace as a private offer on the StorageLink BYOL listing.