Quick Start Guide

Time to first share: about 20–30 minutes after the stack reaches CREATE_COMPLETE.

Before you start

Confirm these once (details in VPC Prerequisites):

• AWS® account with permissions to launch CloudFormation® stacks — see Identity and permissions for deployer IAM tiers
• VPC ready (subnets, NAT, S3 + DynamoDB® endpoints — see checklist)
• Active Directory® domain + a join account (computer-join permission)
• A browser that can reach the Admin UI — public by default (the stack uses safe networking defaults; Admin UI is reachable from the internet unless you change advanced settings later)

Identities and permissions (planning)

Roadrunner SMB™ uses three separate identities. Plan credentials before deploy:

Identity 1 builds it. Identity 3 runs it day-to-day. Identity 2 rescues it when AD is down.

Evaluation (POC): Broad AWS admin + Domain Admin for join and Admin UI is acceptable for time-boxed trials.

Secure production: Scoped CloudFormation deployer IAM, delegated AD join account (not Domain Admin), dedicated admin AD group with Domain Admins disabled in Settings.

Full detail: Identity and permissions · Deployer permission matrix · AD domain join delegation

Step 1 — Subscribe and launch

Choose Single-AZ or Dual-AZ (Marketplace delivery option)

You pick the deployment delivery option when you subscribe in AWS Marketplace — not on the CloudFormation form. The launch template you receive determines subnet layout and the parent stack name:

Cluster Node Count is a separate choice on the Create stack page (1–4 nodes). Common patterns:

• Single-AZ + 1 node — lowest-cost evaluation (no AZ-level redundancy)
• Dual-AZ + 2 nodes — production HA minimum (default for Dual-AZ)

Dual-AZ with a single node is supported for test scenarios but does not provide multi-node high availability.

1. Open Roadrunner SMB in AWS Marketplace and Subscribe to the delivery option that matches your target (Single-AZ or Dual-AZ).

2. Click Continue to Configuration → pick your Region → Continue to Launch.

3. Choose Launch CloudFormation → Launch.

4. On the Create stack page you should see three parameters:

   Parameter	What to enter
   VPC ID	Select your VPC from the dropdown (CloudFormation lists VPCs in the Region)
   Cluster Node Count	2 (default) · 1 for evaluation only · up to 4
   EC2 Instance Type	c6i.2xlarge (default) · pick a cost-effective c6i (up to ~12.5 Gbps, good for evals) or high-networking c6in/m6in (up to ~200 Gbps) size from the dropdown

   Private and public subnets are auto-discovered inside the VPC you select. The Marketplace container image and other advanced settings are pre-filled by the release — you do not set them at launch.

   Active Directory is not a CloudFormation parameter. You join the domain in Step 4.

5. Acknowledge both capability checkboxes, then Create stack:

   • IAM resources with custom names — the appliance creates standard IAM roles.
   • CAPABILITY_AUTO_EXPAND — required because the launch template uses a nested stack (see below).

6. Wait for the parent stack to reach CREATE_COMPLETE (typically 5–10 minutes). It creates a nested child stack that deploys ECS, EFS, the NLB, and the rest of the appliance.

If the stack fails with VPC Unsuitable, open the nested stack’s Events tab for the detailed reason, fix your VPC per VPC Prerequisites, delete the failed stacks, and relaunch.

Your two CloudFormation stacks

Marketplace launch creates two stacks. This is normal.

Where to find URLs and setup instructions: always use the parent stack’s Outputs tab (RoadrunnerSMB-SingleAZ / RoadrunnerSMB-DualAZ). Do not open the nested …-InnerStack-… stack for day-one setup unless you need advanced troubleshooting outputs.

Cluster ID: Marketplace sets a fixed cluster identifier rrsmb-prod for DynamoDB tables and cluster state. Stack names are for CloudFormation operations only — they do not appear in table names like rrsmb-acl-rrsmb-prod-<share>. One Roadrunner SMB appliance per AWS Region is supported today.

Step 2 — Open the Admin UI

The Admin UI is served on your stack’s internet-facing Network Load Balancer. You must use HTTPS — HTTP is not supported.

Find the URL in CloudFormation (recommended)

1. Open the AWS CloudFormation console in the same Region as your stack.

2. Click the parent stack: RoadrunnerSMB-SingleAZ or RoadrunnerSMB-DualAZ (not the nested …-InnerStack-… stack).

3. Open the Outputs tab.

4. Use one of these outputs:

   Output	Use it for
   AFirstTimeSetupInstructions	START HERE — copy the one-click setup URL from this output (valid ~24 hours)
   AdminUIUrl	Admin console URL (https://…) after setup, or to open the wizard landing page
   NlbDnsName	SMB hostname (\\<NlbDnsName>\<sharename>)

5. From AFirstTimeSetupInstructions, copy the https://…/api/fts/initial-setup?… line into your browser (or use AdminUIUrl). Confirm the URL starts with https:// (do not change it to http://).

6. The First-Time Setup wizard opens.

By default the Admin UI is reachable from the public internet on HTTPS/443. If you later restrict access (advanced), connect only from allowed networks.

Find the NLB DNS name in EC2 (alternate)

1. Open EC2 → Load Balancers (same Region).
2. Select the load balancer created by your stack (name includes your stack name).
3. On the Details tab, copy DNS name (same hostname as AdminUIUrl / NlbDnsName).
4. In your browser, go to https://<dns-name> (HTTPS required).

Step 3 — Get the bootstrap credentials

First-Time Setup is gated by a JSON secret in AWS Secrets Manager. The wizard asks for one field from this secret (or you can use the one-click URL below).

Secret location

EnvironmentName is a CloudFormation parameter (default prod). If you changed it at launch, substitute your value in the secret name.

Open the secret in AWS

1. CloudFormation → parent stack (RoadrunnerSMB-SingleAZ or RoadrunnerSMB-DualAZ) → Outputs.
2. Click BootstrapSecretConsoleUrl (or open Secrets Manager and search for rrsmb/prod/bootstrap-secret).
3. Choose Retrieve secret value. The secret is JSON (not a single plain-text password).

JSON fields (schema version 2)

Fastest path: On the parent stack Outputs tab, open AFirstTimeSetupInstructions and copy the https:// link into your browser. It exchanges initialSetupToken automatically and opens the wizard. More detail: Quick Start.

Security: Retrieve values only from Secrets Manager. Roadrunner SMB does not print these fields in CloudWatch or application logs when the secret ARN is configured.

After First-Time Setup completes

The service removes initialSetupToken from the JSON and writes a new recoverySecret. The initial token cannot be reused. Use recoverySecret only for recovery or reset procedures described in the Admin Guide.

Step 4 — Complete First-Time Setup

Work through the wizard in order:

Domain join usually takes 30–90 seconds. Use Test before Join Domain.

Step 5 — Log in

Sign in to the Admin UI with the domain account you used to claim admin. You should see the Dashboard.

Step 6 — Create your first share

1. Shares → Create Share.
2. Name the share (e.g. data).
3. Set permissions (preset or custom AD groups).
4. Create — wait 15–60 seconds for the share to appear on all nodes.

Step 7 — Mount from Windows®

On a domain-joined Windows PC, in File Explorer:

\\<NlbDnsName>\<sharename>

Use NlbDnsName from the parent stack Outputs tab (same hostname family as AdminUIUrl). Sign in with your AD credentials.

Step 8 — Verify

• Share opens in File Explorer
• You can create a file and folder
• Another permitted AD user can access the share

Harden for production — restrict Admin UI access

The launch form only asks for VPC and node count; networking defaults allow Admin UI HTTPS (port 443) from the internet. For production, narrow Admin UI access after deploy.

Which security group: Admin UI HTTPS is controlled by the NLB security group (name rrsmb-<EnvironmentName>-nlb), not the cluster node security group. The stack parameter is AdminIngressCidr (inbound 443/TCP on that NLB security group).

Recommended steps:

1. CloudFormation → nested stack (…-InnerStack-…) → Update → set AdminIngressCidr to trusted CIDRs (office /32, VPN egress range, or jump-box public IP).
2. Complete the update — CloudFormation adjusts the NLB security group rule on port 443.

Jump box pattern: set AdminIngressCidr to your bastion’s public /32, connect to the bastion, then open AdminUIUrl from a browser on the bastion (or SSH port-forward NLB:443).

Do not use AdminCidr for Admin UI — that parameter controls Prometheus (9090) and SSH ops (22222) on node security groups (rrsmb-<EnvironmentName>-nodes), not the Admin UI listener.

Detail: Security overview — Restricting Admin UI access · Deployment Guide — Admin UI access

Common first-time issues

More help: Support & Troubleshooting.

What's next

• Identity and permissions — planning identities before deploy
• Admin Guide — shares, cluster health, updates
• Known Limitations — before production cutover
• VPC Prerequisites — network checklist