AWS solutions documentation change
Summary
Added new 'CloudFormation parameters' section detailing parameters for PrebidServerStack and BidderSimulatorStack, connectivity modes (RTB Fabric/VPC peering), and ContainerImageUri usage
Security assessment
The change documents security-related parameters like 'InstallCloudFrontAndWAF' (enables DDoS protection) and network security configurations (VPC peering/RTB Fabric), but doesn't address a specific vulnerability. Security documentation is added through parameter descriptions.
Diff
diff --git a/solutions/latest/prebid-server-deployment-on-aws/configure-the-solution.md b/solutions/latest/prebid-server-deployment-on-aws/configure-the-solution.md index a9467f0de..c6bf788cc 100644 --- a//solutions/latest/prebid-server-deployment-on-aws/configure-the-solution.md +++ b//solutions/latest/prebid-server-deployment-on-aws/configure-the-solution.md @@ -7 +7 @@ -Opting out of using CloudFront and AWS WAFManaging configuration files for the solution +Opting out of using CloudFront and AWS WAFCloudFormation parametersManaging configuration files for the solution @@ -43,0 +44,107 @@ For users who decide not to use CloudFront and AWS WAF with this solution, follo +## CloudFormation parameters + +This section describes the CloudFormation parameters available for the PrebidServerStack and BidderSimulatorStack. These parameters are configured at deploy time via the `deploy.sh` script or directly through CloudFormation. + +### PrebidServerStack parameters + +The following table lists the CloudFormation parameters for the primary Prebid Server stack (`prebid-server-deployment-on-aws`). + +Parameter | Type | Default | Description +---|---|---|--- +`InstallCloudFrontAndWAF` | String | `Yes` | Deploy CloudFront and AWS WAF for content delivery and DDoS protection. Set to `No` to use your own CDN (requires `SSLCertificateARN`). +`SSLCertificateARN` | String | _(empty)_ | ARN of an SSL certificate in AWS Certificate Manager. Required only when `InstallCloudFrontAndWAF` is set to `No`. +`ECSTaskMinCapacity` | Number | `2` | Minimum number of ECS Fargate tasks for the Prebid Server service. Provides baseline redundancy. +`ECSTaskMaxCapacity` | Number | `300` | Maximum number of ECS Fargate tasks the service can scale to under load. +`RequestsPerTargetThreshold` | Number | `5000` | Number of requests per target that triggers ECS auto-scaling. Valid range: 100–10000. +`SpotInstanceWeight` | Number | `1` | Relative capacity weight for Fargate Spot instances. Set to `0` to use only on-demand capacity. +`ContainerImageUri` | String | _(empty)_ | ECR image URI for the Prebid Server container. Leave empty to build from source during deployment. See ContainerImageUri parameter. +`EnableLogAnalytics` | String | `false` | Enable auction-level log analytics pipeline (EFS → DataSync → S3 → Glue ETL → Athena). Allowed values: `true`, `false`. +`EnableRtbRequesterGateway` | String | `false` | Provision an RTB Fabric Requester Gateway for partner connectivity. The Fabric Link lifecycle is managed by the `simulator-fabric-link.sh` script. Allowed values: `true`, `false`. +`SimulatorVpcId` | String | _(empty)_ | VPC ID of the BidderSimulatorStack. Required for VPC peering connectivity mode. +`SimulatorAlbSgId` | String | _(empty)_ | ALB Security Group ID from the BidderSimulatorStack. Allows traffic from PrebidServerStack VPC over VPC peering. +`SimulatorRouteTableId1` | String | _(empty)_ | First private subnet route table ID from the BidderSimulatorStack VPC. Used for return traffic routing over VPC peering. +`SimulatorRouteTableId2` | String | _(empty)_ | Second private subnet route table ID from the BidderSimulatorStack VPC. Used for return traffic routing over VPC peering. +`SimulatorEndpoint` | String | _(empty)_ | Internal ALB DNS name of the bidder simulator. Used as the ECS bidder endpoint when VPC peering is the connectivity model. + +### BidderSimulatorStack parameters + +The following table lists the CloudFormation parameters for the optional Bidder Simulator stack (`BiddingServerSimulator`). + +Parameter | Type | Default | Description +---|---|---|--- +`EnableRtbFabric` | String | `true` | Deploy an RTB Fabric Responder Gateway in the simulator VPC. Set to `false` for VPC peering mode. Allowed values: `true`, `false`. + +### Connectivity modes + +The solution supports two connectivity models between the Prebid Server and the Bidder Simulator (or partner bidders). Choose the appropriate mode based on your region and requirements. + +#### RTB Fabric (recommended) + +RTB Fabric provides a private, low-latency network for real-time bidding traffic between a Requester Gateway (in the Prebid Server VPC) and a Responder Gateway (in the bidder VPC). + +**When to use:** Default mode. Use when deploying in an AWS Region that supports RTB Fabric. + +**How it works:** + + 1. Set `EnableRtbRequesterGateway=true` on PrebidServerStack to provision the Requester Gateway. + + 2. Set `EnableRtbFabric=true` on BidderSimulatorStack to provision the Responder Gateway. + + 3. After both stacks are deployed, the `simulator-fabric-link.sh` script creates a Fabric Link connecting the two gateways, waits for it to become active, and updates the ECS task definition with the link URL. + + + + +**deploy.sh usage:** + + + ./deploy.sh --deploy-bidding-simulator --simulator-connectivity rtb-fabric \ + --profile <profile> --region <region> + +#### VPC peering (fallback) + +VPC peering provides direct network connectivity between the Prebid Server VPC and the Bidder Simulator VPC using standard AWS VPC peering. + +**When to use:** Fallback for AWS Regions where RTB Fabric is not available. + +**How it works:** + + 1. Set `EnableRtbFabric=false` on BidderSimulatorStack (no Responder Gateway). + + 2. The `deploy.sh` script reads VPC peering parameters (VPC ID, ALB Security Group ID, route table IDs, and ALB endpoint) from BidderSimulatorStack outputs and passes them to PrebidServerStack. + + 3. PrebidServerStack creates the VPC peering connection, routes, and security group rules automatically. + + + + +**deploy.sh usage:** + + + ./deploy.sh --deploy-bidding-simulator --simulator-connectivity vpc-peering \ + --profile <profile> --region <region> + +###### Note + +The VPC peering parameters (`SimulatorVpcId`, `SimulatorAlbSgId`, `SimulatorRouteTableId1`, `SimulatorRouteTableId2`, `SimulatorEndpoint`) are populated automatically by `deploy.sh` when using `--simulator-connectivity vpc-peering`. You do not need to set them manually. + +### ContainerImageUri parameter + +The `ContainerImageUri` parameter controls how the Prebid Server container image is sourced. + +Value | Behavior +---|--- +_(empty, default)_ | The solution builds the Prebid Server container image from source during deployment. This is the standard CDK deployment path — CodeBuild compiles the Java application, builds the Docker image, and pushes it to ECR. +ECR image URI (e.g., `123456789012.dkr.ecr.us-east-1.amazonaws.com/prebid-server:latest`) | The solution uses the specified pre-built container image directly. No build step is performed. Use this when deploying via synthesized CloudFormation templates or when you have a custom Prebid Server image in ECR. + +**Common use cases for ContainerImageUri:** + + * **Pre-built image from GitHub release** — The repository includes a pre-built container image at `deployment/container/prebid-server.tar.gz` (tracked via Git LFS). The `deploy.sh --container-image` flag loads this tar.gz, pushes it to ECR, and passes the resulting URI as `ContainerImageUri`. + + * **Custom Prebid Server build** — If you maintain a custom fork of Prebid Server Java with additional adapters or patches, build your image separately, push to ECR, and provide the URI. + + * **CloudFormation-only deployment** — When deploying the synthesized template directly (without CDK), provide a pre-existing ECR image URI since CodeBuild is not available in this path. + + + + @@ -281 +388 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -CDK Stack Parameters +CloudFormation Stack Parameters