cloudform-om-config.html.md.erb

---
title: Configuring Ops Manager Director on AWS
owner: Ops Manager
---

<strong><%= modified_date %></strong>

This topic describes how to configure the Ops Manager Director after deploying the CloudFormation template for [Pivotal Cloud Foundry&reg;](https://network.pivotal.io/products/pivotal-cf) (PCF) on Amazon 
Web Services (AWS).
Use this topic when [Installing Pivotal Cloud Foundry&reg; Using AWS CloudFormation](./cloudform.html).

Before beginning this procedure, ensure that you have successfully completed all
steps in the [Deploying the CloudFormation Template for PCF on AWS](./cloudform-template.html) and the [Launching an Ops Manager Director Instance on AWS CloudFormation](./cloudform-om-deploy.html) topics.
After you complete this procedure, follow the instructions in the [Deploying Elastic Runtime on AWS CloudFormation](./cloudform-er-config.html) topic.

## <a id='outputs'></a>Step 1: Open the Outputs Tab in AWS Stacks ##

<%= partial 'aws_stacks_view_outputs' %>

## <a id='access-om'></a>Step 2: Access Ops Manager ##

<p class="note"><strong>Note</strong>: Ops Manager 1.7 security features require that you log in using a fully qualified domain name to access Ops Manager.</a></p> 

1. In a web browser, navigate to the fully qualified domain you created in the [Create a DNS Entry](./cloudform-om-deploy.html#create-dns) step of [Launching an Ops Manager Director Instance on AWS](./cloudform-om-deploy.html).

1. When Ops Manager starts for the first time, you must choose one of the following:
    * [Use an Identity Provider](#idp): If you use an Identity Provider, an external identity server maintains your user database.
    * [Internal Authentication](#internal): If you use Internal Authentication, PCF maintains your user database.

    <%= image_tag("select-authentication.png") %>

### <a id='idp'></a>Use an Identity Provider ###

1.  Log in to your identity provider and use the information below to configure SAML Service Provider Properties:
    * Service Provider Entity ID: opsman-login
    * ACS URL : https:<span>//<span>OPS-MANAGER-FQDN/uaa/saml/SSO/alias/opsman-login
    * Binding : HTTP Post
    * SLO URL: https:<span>//<span/>OPS-MANAGER-FQDN/uaa/saml/SingleLogout/alias/opsman-login
    * Binding : HTTP Redirect
    * Name ID : Email Address

1. When redirected to the **Use an Identity Provider** page, you must complete the following steps:
    * Retrieve the metadata URL from your Identity Provider and copy it into the **Use an Identity Provider** area. 
    * Create a passphrase. Ops Manager encrypts data using the passphrase that you provide.
    * Read the **End User License Agreement**, and select the checkbox to accept the terms.
    * Click **Setup Authentication**.

    <%= image_tag("meta-url.png") %>

1. Your Identity Provider login page appears. Enter your username and password. Click **Login**.

### <a id='internal'></a>Internal Authentication ###

1. When redirected to the **Internal Authentication** page, you must complete the following steps:
    * Enter a **Username**, **Password**, and **Password confirmation** to create an Admin user.
    * Enter a **Decryption passphrase** and the **Decryption passphrase confirmation**. This passphrase encrypts the Ops Manager datastore, and is not recoverable if lost.
    * If you are using an **Http proxy** or **Https proxy**, follow the [PCF Director Proxy Settings](./pcf-director-proxy-settings.html) instructions.
    * Read the **End User License Agreement**, and select the checkbox to accept the terms.
    * Click **Setup Authentication**.

 	<%= image_tag("om-login.png") %>

1. Log in to Ops Manager with the Admin username and password that you created in the previous step.

    <%= image_tag("cf-login.png") %>

## <a id='aws-config'></a>Step 3: AWS Config Page ##

1. Click the **Ops Manager Director** tile.

    <%= image_tag("cloudform/om-tile.png") %>

1. Select **AWS Config** to open the **AWS Management Console Config** page.

    <%= image_tag("cloudform/aws-config.png") %>

1. Select **Use AWS Keys** or **Use AWS Instance Profile**.
    * If you choose to use AWS keys, complete the fields with information from 
      the **[Outputs](#outputs)** tab for your stack in the AWS Console:
        * **Access Key ID**: Use the value of **PcfIamUserAccessKey**.
        * **AWS Secret Key**: Use the value of **PcfIamUserSecretAccessKey**.
    * If you choose to use an AWS instance profile, enter the name of your AWS 
      Identity and Access Management (IAM) profile.

1. Complete the remainder of the **AWS Management Console Config** page with the following information.
    * **VPC ID**: Use the value of **PcfVpc** from your **Outputs** tab.
    * **Security Group ID**: Open the AWS EC2 Dashboard and click **Security
      Groups**. Select the security group with the **Description** `PCF VMs
      Security Group`. Copy the **Group ID** of this group into the Ops Manager 
      **Security Group ID** field.
    * **Key Pair Name**: Use the name of your pre-existing AWS key pair.
      You selected this key pair name when you first 
      [deployed Ops Manager Director](cloudform-om-deploy.html#deploy).
    * **SSH Private Key**: Open your AWS key pair `.pem` file in a 
      text editor. Copy the contents of the `.pem` file and paste it into the 
      **SSH Private Key** field.
    * **Region**: Select the region where you deployed Ops Manager.
    * **Encrypt EBS Volumes**: Select this checkbox to enable full encryption 
      on persistent disks of all BOSH-deployed virtual machines (VMs), except 
      for the Ops Manager VM and Director VM. See the [Configuring Amazon EBS 
      Encryption for PCF on AWS](cloudform-om-ebs-config.html) topic for 
      details on using EBS encryption.

1. Click **Save**.

## <a id='director-config'></a>Step 4: Director Config Page ##

1. Select **Director Config** to open the **Director Config** page.

	<%= image_tag("cloudform/director-config.png") %>

1. In the **NTP Servers (comma delimited)** field, enter at least two of the 
following NTP servers, separated by a comma:
    * `0.amazon.pool.ntp.org`
    * `1.amazon.pool.ntp.org`
    * `2.amazon.pool.ntp.org`
    * `3.amazon.pool.ntp.org`

1. Select the **Enable VM Resurrector Plugin** checkbox to enable the Ops
Manager Resurrector functionality and increase Elastic Runtime availability.

1. Select **Recreate all VMs** to force BOSH to recreate all VMs on the next deploy. This process does not destroy any persistent disk data.

1. Select **HM Pager Duty Plugin** to enable Health Monitor integration with PagerDuty.
    * **Service Key**: Enter your API service key from PagerDuty.
    * **HTTP Proxy**: Enter an HTTP proxy for use with PagerDuty.

1. Select **HM Email Plugin** to enable Health Monitor integration with email.
    * **Host**: Enter your email hostname.
    * **Port**: Enter your email port number.
    * **Domain**: Enter your domain.
    * **From**: Enter the address for the sender.
    * **Recipients**: Enter comma-separated addresses of intended recipients.
    * **Username**: Enter the username for your email server.
    * **Password**: Enter the password password for your email server.
    * **Enable TLS**: Select this checkbox to enable Transport Layer Security.

1. For **Blobstore Location**, select **S3 Compatible Blobstore** and complete the following steps:
    * In a browser, reference the [**Amazon Simple Storage Service (Amazon S3) table** ](http://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region), and find the region for your AWS account.
    * Prepend `https://` to the **Endpoint** for your region, and copy it into
    the Ops Manager **S3 Endpoint** field. For example, in the **us-west-2** region, enter `https://s3-us-west-2.amazonaws.com` into the field.
    * Complete the following fields with information from the **Outputs** tab in the AWS Console:
        * **Bucket Name**: Use the value of **PcfOpsManagerS3Bucket**.
        * **Access Key ID**: Use the value of **PcfIamUserAccessKey**.
        * **AWS Secret Key**: Use the value of **PcfIamUserSecretAccessKey**.
    * Select **V2 Signature** or **V4 Signature**. If you select **V4 Signature**, enter your **Region**.

1. For **Database Location**, select **External MySQL Database** and complete the following fields with information from the **Outputs** tab in the AWS Console:
    * **Host**: Use the value of **PcfRdsAddress**.
    * **Port**: Use the value of **PcfRdsPort**.
    * **Username**: Use the value of **PcfRdsUsername**.
    * **Password**: Use the value of **PcfRdsPassword**.
    * **Database**: Use the value of **PcfRdsDBName**.

1. **Max Threads** sets the maximum number of threads that the Ops Manager Director can run simultaneously. Pivotal recommends that you leave the field blank to use the default value, unless doing so results in rate limiting or errors on your IaaS.

1. Click **Save**.

## <a id='az'></a>Step 5: Create Availability Zones Page ##

1. Select **Create Availability Zones**.
<%= image_tag("cloudform/create-az.png") %>
1. Use the following steps to create one or more Availability Zones for your applications to use:
    * Click **Add**.
    * For **Amazon Availability Zone**, enter the value of **PcfPrivateSubnetAvailabilityZone** from the **Outputs** tab in the AWS Console. 
    * **(Optional)** If you are using a second **Amazon Availability Zone**, click **Add**. Enter the value of **PcfPrivateSubnet2AvailabilityZone** from the **Outputs** tab in the AWS Console.
    * Click **Save**.

## <a id='network'></a>Step 6: Create Networks Page ##
1. Select **Create Networks**.
<%= image_tag("cloudform/create-networks.png") %>
1. Select **Enable ICMP checks** to enable ICMP on your networks. Ops Manager uses ICMP checks to confirm that components within your network are reachable.
1. Use the following steps to create one or more Ops Manager networks:
    * Click **Add Network**.
    * Enter a unique **Name** for the network.
    * Click **Add Subnet** to create one or more subnets for the network.
    * In the **VPC Subnet ID** field, use the value of **PcfPrivateSubnetId** from the **Outputs** tab in the AWS Console. 
    * For **CIDR**, enter `10.0.16.0/20`. Ops Manager deploy VMs to this CIDR block. 
    * For **Reserved IP Ranges**, enter `10.0.16.1-10.0.16.9`. Ops Manager avoids deploying VMs to any IP address in this range.
    * Enter `10.0.0.2` for **DNS** and `10.0.16.1` for **Gateway**.
    * Select which **Availability Zones** to use with the network.
    * **(Optional)** If you are using a second subnet, click **Add Subnet**. In the **VPC Subnet ID** field, use the value of **PcfPrivateSubnet2Id**. Enter the rest of the fields using the information provided above. 

1. Click **Save**.

1. If the following ICMP error message appears, you can ignore the warning. Dismiss the warning, and move on to the next step.

    <%= image_tag("cloudform/config-error.png") %>

## <a id="assign-azs"></a>Step 7: Assign AZs and Networks Page##

1. Select **Assign AZs and Networks**.
<%= image_tag("cloudform/assign-az.png") %>
1. Use the drop-down menu to select a **Singleton Availability Zone**. The Ops Manager Director installs in this Availability Zone.
1. Use the drop-down menu to select a **Network** for your Ops Manager Director.
1. Click **Save**.

## <a id='security'></a>Step 8: Security Page ##

1. Select **Security**.
    <%= image_tag("../images/om-security-aws.png") %>

1. In **Trusted Certificates**, enter a custom certificate authority (CA) certificate to insert into your organization's certificate trust chain. This feature enables all BOSH-deployed components in your deployment to trust a custom root certificate. If you want to use Docker Trusted Registries for running app instances in Docker containers, use this field to enter your certificate for your private Docker Trusted Registry. See the [Using Docker Trusted Registries](../opsguide/docker-registry.html) topic for more information.
1. Choose **Generate passwords** or **Use default BOSH password**. Pivotal recommends that you use the **Generate passwords** option for greater security.
1. Click **Save**. To view your saved Director password, click the **Credentials** tab.

## <a id='resource-config'></a>Step 9: Resource Config Page

1. Select **Resource Config**.
<%= image_tag("cloudform/resource-config-new.png") %>
1. Adjust any values as necessary for your deployment. Under the **Instances**, **Persistent Disk Type**, and **VM Type** fields, choose **Automatic** from the drop-down menu to allocate the recommended resources for the job. If the **Persistent Disk Type** field reads **None**, the job does not require persistent disk space.

    <p class="note"><strong>Note</strong>: If you set a field to <strong>Automatic</strong> and the recommended resource allocation changes in a future version, Ops Manager automatically uses the updated recommended allocation.</p> 

## <a id='complete'></a>Step 10: Complete the Ops Manager Director Installation ##

1. Click the **Installation Dashboard** link to return to the Installation
Dashboard.

1. Click **Apply Changes**. If the following ICMP error message appears, click
**Ignore errors and start the install**.

    <%= image_tag("cloudform/install-error.png") %>

1. Ops Manager Director installs. This may take a few moments. When the installation process successfully completes, the **Changes Applied** window appears.

    <%= image_tag("cloudform/ops-manager-complete.png") %>

1. After you complete this procedure, follow the instructions in the [Deploying Elastic Runtime on AWS CloudFormation](./cloudform-er-config.html) topic.