AWS solutions documentation change
Summary
Updated deployment instructions with new flags, added two-step deployment flow for bidder simulator, detailed RTB Fabric connectivity options, and container image handling
Security assessment
Changes focus on deployment mechanics, connectivity options, and workflow improvements without addressing vulnerabilities or security features. No evidence of security fixes or vulnerabilities mentioned.
Diff
diff --git a/solutions/latest/prebid-server-deployment-on-aws/deploy-the-solution.md b/solutions/latest/prebid-server-deployment-on-aws/deploy-the-solution.md index 3ec586060..d5b8889b3 100644 --- a//solutions/latest/prebid-server-deployment-on-aws/deploy-the-solution.md +++ b//solutions/latest/prebid-server-deployment-on-aws/deploy-the-solution.md @@ -45,2 +45,2 @@ For a streamlined deployment experience on Linux/macOS, use the provided `deploy - # Deploy with analytics (most common use case) - ./deploy.sh --enable-log-analytics --profile <your-aws-cli-profile> --region <your-region> + # Deploy Prebid Server only (no simulator) + ./deploy.sh --profile <your-aws-cli-profile> --region <your-region> @@ -48 +48 @@ For a streamlined deployment experience on Linux/macOS, use the provided `deploy - # Deploy with bidder simulator + # Deploy with bidder simulator (RTB Fabric connectivity — default) @@ -51,2 +51,8 @@ For a streamlined deployment experience on Linux/macOS, use the provided `deploy - # Deploy with bidder simulator and RTB Fabric - ./deploy.sh --deploy-bidding-simulator --include-rtb-fabric --profile <your-aws-cli-profile> --region <your-region> + # Deploy with bidder simulator (VPC peering fallback for non-RTB regions) + ./deploy.sh --deploy-bidding-simulator --simulator-connectivity vpc-peering --profile <your-aws-cli-profile> --region <your-region> + + # Deploy with RTB Fabric gateway for future partner onboarding (no simulator) + ./deploy.sh --enable-rtb-requester-gateway --profile <your-aws-cli-profile> --region <your-region> + + # Deploy with a pre-built container image (tar.gz) + ./deploy.sh --container-image deployment/container/prebid-server.tar.gz --profile <your-aws-cli-profile> --region <your-region> @@ -54,2 +60,8 @@ For a streamlined deployment experience on Linux/macOS, use the provided `deploy - # Deploy with all features enabled - ./deploy.sh --deploy-bidding-simulator --include-rtb-fabric --enable-log-analytics --profile <your-aws-cli-profile> --region <your-region> + # Deploy with an existing ECR image URI + ./deploy.sh --container-image 123456789012.dkr.ecr.us-east-1.amazonaws.com/prebid-server:latest --profile <your-aws-cli-profile> --region <your-region> + + # Deploy with analytics enabled + ./deploy.sh --enable-log-analytics --profile <your-aws-cli-profile> --region <your-region> + + # Synthesize CloudFormation templates (no deployment) + ./deploy.sh --synth --profile <your-aws-cli-profile> --region <your-region> @@ -59 +71,29 @@ The `deploy.sh` script automatically: - * Copies AMT bidder files to the Docker build context when `--deploy-bidding-simulator` is used + * Performs a two-step deployment when `--deploy-bidding-simulator` is used (BidderSimulatorStack first, then PrebidServerStack with outputs as parameters) + + * Copies AMT bidder files to the Docker build context for the simulator + + * Handles container image loading and ECR push when `--container-image` points to a tar.gz file + + * Creates the RTB Fabric Link via `simulator-fabric-link.sh` after deployment (when using RTB Fabric connectivity) + + * Sets up the Python virtual environment and installs dependencies + + + + +#### deploy.sh flags + +Flag | Default | Description +---|---|--- +`--deploy-bidding-simulator` | `false` | Deploy the optional BidderSimulatorStack for quick start testing. Triggers the two-step deployment flow. +`--simulator-connectivity MODE` | `rtb-fabric` | Connectivity model between Prebid Server and the bidder simulator. Values: `rtb-fabric` (default, uses AWS RTB Fabric) or `vpc-peering` (fallback for regions without RTB Fabric). +`--enable-rtb-requester-gateway` | `false` | Provision an RTB Fabric Requester Gateway in the PrebidServerStack for partner onboarding. Use this when you want the gateway without deploying the simulator. +`--container-image PATH_OR_URI` | _(build from source)_ | Container image source. Accepts a local tar.gz file path (the script loads, tags, and pushes to ECR) or an existing ECR image URI. When omitted, CDK builds the container from source during deployment. +`--enable-log-analytics` | `false` | Enable the custom analytics adapter for detailed auction-level data collection through the ETL pipeline. +`--profile PROFILE` | _(none)_ | AWS CLI profile to use for all AWS operations. +`--region REGION` | _(none)_ | AWS region to deploy to. +`--synth` | _(deploy)_ | Run `cdk synth` instead of `cdk deploy`. Generates CloudFormation templates without deploying. + +#### Two-step deployment flow + +When `--deploy-bidding-simulator` is specified, `deploy.sh` performs a two-step deployment: @@ -61 +101 @@ The `deploy.sh` script automatically: - * Sets up the Python virtual environment + 1. **Step 1 — Deploy BidderSimulatorStack:** Deploys the bidder simulator infrastructure (VPC, ALB, Lambda bidder, and optionally the RTB Fabric Responder Gateway). The script reads CloudFormation outputs from this stack to configure the next step. @@ -63 +103 @@ The `deploy.sh` script automatically: - * Installs dependencies + 2. **Step 2 — Deploy PrebidServerStack:** Deploys the core Prebid Server infrastructure, passing BidderSimulatorStack outputs as CloudFormation parameters (for example, `EnableRtbRequesterGateway=true` for RTB Fabric, or VPC peering parameters for the VPC peering path). @@ -65 +104,0 @@ The `deploy.sh` script automatically: - * Runs CDK with the appropriate context flags @@ -68,0 +108,29 @@ The `deploy.sh` script automatically: +This ordering ensures that the PrebidServerStack receives the correct connectivity parameters from the already-deployed simulator stack. + +#### RTB Fabric Link (post-deployment step) + +When deploying with `--simulator-connectivity rtb-fabric` (the default), `deploy.sh` automatically runs `deployment/simulator-fabric-link.sh create` after both stacks are deployed. This script: + + * Creates an RTB Fabric Link between the Requester Gateway (PrebidServerStack) and the Responder Gateway (BidderSimulatorStack) + + * Polls the link status with exponential backoff until it becomes active + + * Accepts the link from the responder side (same-account simulator) + + * Updates the ECS task definition with the Fabric Link URL endpoint + + * Triggers a rolling ECS deployment (~30 seconds) + + + + +The Fabric Link is managed independently of CloudFormation — no stack update is required. The link ID is persisted in AWS Systems Manager Parameter Store for lifecycle management. + +You can also manage the Fabric Link manually: + + + # Check link status + ./deployment/simulator-fabric-link.sh status --stack-name prebid-server-deployment-on-aws --profile <profile> --region <region> + + # Delete the link (run before stack destruction) + ./deployment/simulator-fabric-link.sh delete --stack-name prebid-server-deployment-on-aws --profile <profile> --region <region> @@ -80,2 +148,2 @@ For customization or manual deployment: - # Deploy with bidder simulator - cdk deploy --all --context deployBiddingSimulator=true --profile <your-aws-cli-profile> --region <your-region> + # Deploy Prebid Server only + cdk deploy prebid-server-deployment-on-aws --profile <your-aws-cli-profile> --region <your-region> @@ -83,2 +151,5 @@ For customization or manual deployment: - # Deploy with bidder simulator and RTB Fabric - cdk deploy --all --context deployBiddingSimulator=true --context includeRtbFabric=true --profile <your-aws-cli-profile> --region <your-region> + # Deploy with bidder simulator (two-step: deploy BSS first, then PSS with parameters) + cdk deploy BiddingServerSimulator --context deployBiddingSimulator=true --profile <your-aws-cli-profile> --region <your-region> + cdk deploy prebid-server-deployment-on-aws --context deployBiddingSimulator=true \ + --parameters prebid-server-deployment-on-aws:EnableRtbRequesterGateway=true \ + --profile <your-aws-cli-profile> --region <your-region> @@ -87 +158,5 @@ For customization or manual deployment: - cdk deploy --all --context enableLogAnalytics=true --profile <your-aws-cli-profile> --region <your-region> + cdk deploy prebid-server-deployment-on-aws --context deployBiddingSimulator=true \ + --parameters prebid-server-deployment-on-aws:EnableLogAnalytics=true \ + --profile <your-aws-cli-profile> --region <your-region> + +###### Note @@ -89,2 +164 @@ For customization or manual deployment: - # Deploy without optional components - cdk deploy --all --profile <your-aws-cli-profile> --region <your-region> +When deploying manually with CDK, you must run `deployment/simulator-fabric-link.sh create` separately after deployment to establish the RTB Fabric Link. @@ -100 +174 @@ Deploys an optional bidder simulator stack for quick start testing. The simulato - * internal ALB + Lambda and VPC peering + * Internal ALB + Lambda bidder @@ -111 +185,5 @@ Deploys an optional bidder simulator stack for quick start testing. The simulato -**RTB Fabric (`--include-rtb-fabric`)** +When the simulator is deployed, `deploy.sh` uses a two-step deployment flow: BidderSimulatorStack deploys first, then PrebidServerStack receives the simulator outputs as CloudFormation parameters. + +**Simulator Connectivity (`--simulator-connectivity`)** + +Controls how Prebid Server connects to the bidder simulator: @@ -113 +191 @@ Deploys an optional bidder simulator stack for quick start testing. The simulato -Enables AWS RTB Fabric integration for low-latency, cost-optimized private network connectivity. Requirements: + * `rtb-fabric` (default) — Uses AWS RTB Fabric for low-latency, cost-optimized private network connectivity. Creates a Requester Gateway in the Prebid Server VPC and connects to the Responder Gateway in the Bidder Simulator VPC via a Fabric Link. The link is created automatically by `simulator-fabric-link.sh` after deployment. @@ -115 +193 @@ Enables AWS RTB Fabric integration for low-latency, cost-optimized private netwo - * Must be used with `--deploy-bidding-simulator` + * `vpc-peering` — Uses VPC peering with direct routes and security group rules. Use this as a fallback for regions where RTB Fabric is not available. @@ -117 +194,0 @@ Enables AWS RTB Fabric integration for low-latency, cost-optimized private netwo - * RTB Fabric must be available in your deployment region @@ -120,0 +198 @@ Enables AWS RTB Fabric integration for low-latency, cost-optimized private netwo +**RTB Requester Gateway (`--enable-rtb-requester-gateway`)** @@ -122 +200 @@ Enables AWS RTB Fabric integration for low-latency, cost-optimized private netwo -When enabled, the solution creates: +Provisions an RTB Fabric Requester Gateway in the PrebidServerStack without deploying the simulator. Use this when you want to prepare the gateway for future partner onboarding. After deployment, create Fabric Links manually using the AWS CLI or `simulator-fabric-link.sh`. @@ -124 +202 @@ When enabled, the solution creates: - * Requester Gateway in the Prebid Server VPC +**Container Image (`--container-image`)** @@ -126 +204 @@ When enabled, the solution creates: - * Responder Gateway in the Bidder Simulator VPC +Specifies a custom container image source instead of building from source during deployment: @@ -128 +206 @@ When enabled, the solution creates: - * Fabric Link connecting the two gateways + * **tar.gz file path** — The script loads the image into the local container runtime, creates an ECR repository, tags, and pushes the image. Example: `--container-image deployment/container/prebid-server.tar.gz` @@ -130 +208 @@ When enabled, the solution creates: - * Lambda function for automatic link acceptance + * **ECR URI** — Uses an existing image directly. Example: `--container-image 123456789012.dkr.ecr.us-east-1.amazonaws.com/prebid-server:latest` @@ -141 +219 @@ You can view the status of the stack in the AWS CloudFormation console in the ** -**Time to deploy:** Approximately 10-15 minutes (varies based on optional components) +**Time to deploy:** Approximately 10–15 minutes (varies based on optional components). When using RTB Fabric connectivity, the Fabric Link creation adds approximately 30–60 seconds after stack deployment. @@ -151 +229 @@ Quotas -CDK Stack Parameters +CloudFormation Stack Parameters