Resources & FAQ

Q: What is it?

A:  The solution deploys Keycloak (an open source identity and access management software) on Amazon Web Services.

Q：What are the user scenarios?

A：You can use this solution to quickly build up identity and access management system in the Amazon Web Services Cloud with the power of Keycloak. Keycloak provides features such as Single-Sign On/Out, Identity Brokering and Social Login, User Federation etc. Please find more details on Keycloak official website.

Q: How does it work?

A:  The solution leverages CloudFormation template or Cloud Development Kit(CDK) to automatically deploy and configure a high available Keycloak cluster on Amazon Web Services Cloud. 

The Keycloak cluster will run with Amazon Fargate in the Amazon ECS environment. The corresponding databases and ALB load balancers will be automatically configured.

Q：How much does it cost?

A：You will be charged based on the actual usages of cloud resources. The number of instances is one of the key factors for the cost when using this solution.

Q：What prerequisites do I need to prepare before starting？

A：

1. Make sure you already have a EC2 key pair in the target region.
2. Make sure you already have a VPC with at least two public subnets, two private subnets, and one NAT gateway in the public subnet.
3. Make sure you already have a ICP-licensed domain.
   

Q：Can I deploy the solution in any Region?

A：You can deploy this solution in most of Amazon Web Services regions, including both Beijing Region operated by NWCD and Ningxia Region operated by Sinnet.

Q：What database types are supported by this solution?

A：You can choose one of the following database types:

1. Amazon RDS Database, which includes two database instances to provide a highly available environment.

2. Amazon Aurora Serverless Database, which provides a highly available environment, and this model does not create any database instances.

3. Amazon RDS Database instance, which provides a single database instance and is not recommended for production environment.

Q：How to specify the initial username and password?

A：The initial administrator accounts and passwords for Keycloak and Databases will be automatically generated and saved in Amazon Secrets Manager for security and compliance purposes.

Q：Why the deployment of Aurora Serverless Database failed?

A：The fact that some Available Zones(AZ) in certain regions(such as us-west-2) do not yet support Aurora Serverless, will result in deployment failure. Please refer to the CloudFormation failure message and select the appropriate AZs for your deployment.