Skip to main content
CMDashCyber Maturity Dashboard
DocsAdministrationRunning CMDash in your AWS account

Running CMDash in your AWS account

Purpose: launch CMDash in your own AWS account from the CMDash AMI and a CloudFormation template, take its plan from AWS Marketplace or a license file, and keep it updated and backed up.

CMDash runs in your account from one CloudFormation template and one CMDash AMI. The template builds the network, the instance, the data volume, the S3 buckets and, on the production template, the load balancer and the database. The AMI carries the images, so nothing downloads when the instance first boots. The same code runs as in CMDash Cloud. The install runs on the Enterprise plan, and Enterprise costs the same wherever it runs. To compare this with CMDash Cloud and with running CMDash on your own servers, read Choose where CMDash runs.

Pick a template

TemplateUse it for
cmdash-selfhosted-eval.yamlAn evaluation or a private pilot: one instance with an Elastic IP and a self-signed certificate
cmdash-selfhosted-prod.yamlProduction: an Application Load Balancer with an ACM certificate, the instance in a private subnet, and an encrypted Multi-AZ Amazon RDS for PostgreSQL database
cmdash-selfhosted-govcloud.yamlAWS GovCloud (US): the production shape with FIPS endpoints and a US-regions-only rule

The eval and production templates are published for us-east-1, us-east-2, us-west-1 and us-west-2. The GovCloud template also accepts us-gov-west-1 and us-gov-east-1. Every template allows internet access on ports 80 and 443 only, with no SSH by default: you reach the instance through AWS Systems Manager Session Manager.

Choose how the plan is licensed

Set the Licensing parameter once, at launch.

LicensingWhere the plan comes from
license-fileA signed CMDash license file that you upload in the app. The install makes no AWS License Manager call.
marketplaceYour AWS Marketplace subscription. The install checks the entitlement with AWS License Manager through its instance role.

The GovCloud template takes a license file. If you buy through AWS Marketplace, subscribe to the self-hosted listing first. Enterprise on Marketplace is sold as a private offer: ask CMDash for one. The buyer's steps, including how a hosted subscription is attached to an organization, are in Buying CMDash on AWS Marketplace, and the Marketplace page is at www.cmdash.com/marketplace/aws.

Launch

  1. In the CloudFormation console, create a stack from the template for your shape and fill in the parameters. The production template needs a DomainName and either a HostedZoneId or a CertificateArn.
  2. Wait for CREATE_COMPLETE. The stack succeeds only when the application's readiness check answers, which requires the database, Redis and the S3 bucket.
  3. Read the stack outputs, including Url and SsmSessionCommand.
  4. On the production template, if you did not pass HostedZoneId, point your domain at the LoadBalancerDnsName output.
  5. Open the Url output and register the first account. It creates the organization and becomes its Owner.
  6. Open Settings → License to see the license state, or on Marketplace installs the subscription state and when AWS last confirmed it.

The eval template serves a self-signed certificate, so your browser shows a warning on the first visit.

Mail, sign-in and integrations

Invitations and password resets need a mail transport. The launch guide shows how to connect Amazon SES. Single sign-on, SCIM and LDAP work as they do on Enterprise anywhere, against your own identity provider (SSO, SCIM & LDAP). Connector traffic leaves from your own VPC, so you can fix and allow-list its address (IP Ranges & Allow-Listing).

Update

There are two paths.

  • In the app. Open Settings → Updates and apply a release. The updater rolls the api and then the web service and rolls back if the health check fails. A release that needs a database migration is not offered as a one-click update. See Updating CMDash.
  • A new AMI. Update the stack to a template version with the new AMI. CloudFormation replaces the instance, the new instance takes over the data volume, and if its first boot fails the old instance is restored and the stack ends in UPDATE_ROLLBACK_COMPLETE.

Back up and restore

Backup and recovery are your responsibility.

  • A daily timer writes a Postgres dump and the license directory to your own S3 backups bucket. Both buckets are versioned, encrypted, private and kept when you delete the stack. BackupRetentionDays sets how long backups are kept.
  • The production and GovCloud templates also run an encrypted Multi-AZ database with automated backups.
  • Back up the application secrets yourself where the guide says to: a restored database cannot use its stored integration credentials without its CREDENTIAL_ENCRYPTION_KEY.
  • Rehearse a restore at least once a quarter.

The restore steps are in the self-hosting guide below, and the policy is in Self-hosted backup and recovery.

This page is the product manual, published from the repository at docs/user/admin/run-in-your-aws-account.md. Customers read the same text inside CMDash under Help. Last updated October 25, 2026.

Running CMDash in your AWS account — CMDash Docs