# What is QMCLOUD Welcome to the QMCLOUD documentation. This page provides a brief overview of QMCLOUD. QMCLOUD is an AI and No Code technologies-based platform for composing, visualizing, and deploying cloud infrastructure resources. QMCLOUD supports deploying many cloud infrastructure components including Virtual Network (VNET or VPC), Virtual Machines (VM's) and modern resources such as Containers and Serverless components. QMCLOUD currently supports AWS, Azure, vSphere, and K8 cloud platforms. A desired state in QMCLOUD can be defined using various methods including the following: a) Canvas and Drag/Drop - The desired infrastructure can be drawn on a canvas using drag and drop method b) Smart wizard - The smart deployment wizard guides a user through specific deployment scenarios for various infrastructure resources. c) AI Copilot - The AI Copilot is an assistant where you can enter a description of the desired cloud infrastructure you want to deploy. The AI Copilot assistant will then automatically create the configuration and render the visualization on the canvas. QMCLOUD automatically generates all the required code and uses cloud providers/plug-ins to deploy appropriate cloud infrastructure resources. In summary, with QMCLOUD one can, compose, edit, and deploy secure and best practices-based cloud infrastructure resources with minimal programming experience. QMCLOUD is available in a SaaS version, as an AWS Marketplace appliance or in a self-hosted environment. {% hint style="info" %} Announcing the launch of SaaS version and an AI Copilot for QMCLOUD. You can learn more at or read this documentation. You can also get started at {% endhint %} QMCLOUD is a patent pending technology Copyright © 2024. appmodz corporation – All rights reserved # Overview This page provides an overview of QMCLOUD and the various components. ## Summary QMCLOUD allows a user to compose, edit, and deploy cloud infrastructure resources with minimal programming experience. Once a user initiates the deployment of the desired state, QMCLOUD generates the required code automatically on behalf of the user and uses a third-party software (Pulumi) to initiate the deployment of resources. QMCLOUD stores various configuration details in its internal database about a stack and the cloud resources that are deployed including properties, connections, and state of deployment. QMCLOUD currently relies on the external Pulumi service to store the current state of the cloud infrastructure resources. The state is a set of metadata about the infrastructure so that it can managed appropriately. Each stack (a unit of infrastructure) has its own state, and state is how QMCLOUD knows when and how to create, read, delete, or update cloud resources. Note - Please refer to this link on what is Pulumi service, and its state and how it stores the metadata. ## Logical Components QMCLOUD consists of the following logical components: * Organization * Workspace * Stack, Stack group and Stack profile * Canvas * Users, Permissions, and Roles The following diagram depicts the high-level structure and components of QMCLOUD and their relationships. Diagram – QMCLOUD components and their relationships ![](/files/a4tVyu6EGTazVB3WFlS6) # Component Details This page describes each of the QMCLOUD components in detail. ### Organization Organization is a logical component that acts as a security boundary for a set of resources. A default organization (called “common”) is created during the installation. It is recommended that the user create a new organization to organize all the resources. Multiple organizations can be created to suite specific requirements where logical separation is required. For example, multiple organizations can be created to represent business units within a large organization. ### Workspace Workspace is a logical entity that acts as a boundary for all the infrastructure resources defined using one or more stacks (unit of infrastructure) contained within the organization. A workspace consists of one or more stacks. For example, multiple workspaces can be created to represent business applications within a large organization. ### Component (or Resource) A component is a low-level object in QMCLOUD that represents a cloud resource. A component is represented as a square shaped image on a canvas. A collection of one or more components forms a deployable unit of infrastructure and is referred to as a Stack. For example, AWS VPC is referred to as a component. Othe examples include Subnets, IAM Role, NAT gateway. ### Connection A connection connects two components to each other and defines the relationship of the compnents. For example, a Subnet is connected to a Vpc thus defining the relationship and dependency. A subnet cannot exist in isolation and needs to be part of a Vpc. The connection are depicted as lines on the canvas and can be drawn using the mouse controls by connecting the dot (connection points of a component). {% hint style="info" %} QMCLOUD has a new feature called "Auto Connection". This feature auto connects many common components with each other and reduces the time and effort that is required to make connections. For example, if there is a single VPC and multiple subnets on the canvas and when auto connection icon is clicked, the system automatically connects all subnets to the Vpc. The auto connection feature is a list of connections saved in the QMCLOUD database. Auto Connection property of a stack - A user can add additional connections to be reused across other stacks by checking the option of Auto Connection on properties of a stack. When a stack is successfully deployed, all the connections in the stack will be saved in the database. {% endhint %} ### Stack Stack is a logical entity for a collection of cloud resources and is considered a unit for deployment. A workspace consists of one or more stacks. ### Stack group Stack group is a logical entity for a collection of stacks. Resources within a stack group can be referenced by other resources in another stack. For example, an AWS VPC in Stack 1 can be referenced by a Subnet in Stack 2 where both stacks are within a stack group. ### Stack profile Stack profile defines the credentials required to connect to the appropriate cloud provider. A stack profile can be set as a Shared Profile that other users in the organization can use. The following combination constitutes a profile and defines the credentials to connect to the cloud provider: For AWS - AWS Region, Access Key, Secret Key. For Azure – clientID, clientSecret, tenantID, subscriptionID ### Canvas A canvas is an area where infrastructure can be composed by using shapes and connectors. Shapes can be connected using connectors to the appropriate properties of the shapes to indicate dependencies or additional properties. The following diagram depicts a shape and the various associated properties. Each of the dots on the edge of the shape represents either a connection point or a specific property. The green dot is used to initiate a connection to another shape. The connection always connects to a red dot that represents a specific property of the shape. Diagram – Anatomy of shapes and connectors ![](/files/wcJkhQ5f1BIMO32lumYj) For example, a stack can consist of an AWS VPC and Subnets as depicted in the diagram * The name of the VPC is defined by the name property (defined as dev101 in this example) * The name of the subnet is defined by the name property (defined as public-subnet-1 in this example) * A connection is made between VPC and the subnet. This connection defines the property “vpcId” of the subnet object. The property details are shown when a user hovers over the mouse controls on the red dot * The VPC (dev101) is defined as consisting of a subnet (public-subnet-1) # Security and RBAC This page describes the security and role-based access control system in QMCLOUD. QMCLOUD components are secured using an RBAC (Role based access control) system. The RBAC system consists of users, roles, permissions, and scope. **Users** All users (also referred to as an identity) accessing QMCLOUD are required to be defined as part of the RBAC system. A user can belong to one or more Organization(s). A user object requires additional attributes to be defined including username, email address, password, address details, the associated organization and security roles. **Roles** A Role is a set of permissions assigned to a user object. A role can assign permissions using sets to the following objects – ORGANIZAITON, USERS, WORKSAPCE, STACKS, and ROLES. **Permission** Permissions are a combination of one or more of the following actions - GET, CREATE, UPDATE and DELETE. Each of these permissions are associated with an action in Q-Cloud. For example: For a user who is assigned a role that allows CREATE permissions, can CREATE various objects including users, roles, workspace, organization, and stacks. **Scope** A scope defines the organization boundary of the permission sets. Scope can be either LOCAL or GLOBAL. A local scope explicitly defines a single organization where the permission applies. This organization is defined at the user level. A global scope applies to all organizations defined in Q-Cloud. **Example RBAC system:** The following diagram depicts the RBAC system components and their relationships. There are two fictious organizations shown – namely - ACME and TOYSR. Diagram - RBAC components and their relationship
A fictious user John Doe is assigned the “Admin” role and is assigned to both the organization. The scope of the admin role is defined as GLOBAL. Based on this definition of the role, John has admin access with all the permissions to both the organizations. A fictious user Mary Joe is assigned “TOYSR-Admin” role. The scope of this ‘TOYSR-Admin” role is defined as LOCAL. Mary is assigned to the TOYSR organization with the “TOYSR-Admin” role. In this case, Mary is limited to administering the TOYSR organization and does not have any access to the ACME organization. # Dependencies QMCLOUD relies on the following third-party components: 1. Pulumi - Pulumi is a modern infrastructure as code platform that allows you to use familiar programming languages and tools to build, deploy, and manage cloud infrastructure. You can learn more about Pulumi here - 2. Cloud service providers - QMCLOUD uses various cloud providers using the corresponding Pulumi providers for each of the platforms. (Examples include AWS Provider, Azure Provider) 3. Cloud service provider accounts and credentials - QMCLOUD relies on cloud accounts and appropriate credentials provided by the user to connect to each of the providers to provision and manage resources. (Example AWS IAM Users) 4. The AI Copilot service uses the external Azure Open AI service and gpt3.5-turbo language model # Architecture The QMCLOUD software is made up of multiple docker containers and besides the SaaS platform, it can be installed in a customer’s environment including public cloud or private cloud. {% hint style="info" %} The following architecture is relevant for self-hosting and AWS marketplace appliance options only. The SaaS version of QMCLOUD uses a similar architecture but varies significantly to account for multi- tenancy and RBAC. {% endhint %} The following diagram depicts the architecture of QMCLOUD. Diagram – QMCLOUD architecture
The following components are depicted in the diagram: 1. User workstation 2. URL / FQDN used to access QMCLOUD 3. Set of docker containers that constitutes QMCLOUD Sofware 4. Proxy or Load balancer 5. Backend – NodeJS, and Java 6. Front end - ReactJS 7. Postgres database 8. Pulumi Automation API 9. Pulumi state software using app.pulumi.com 10. Azure cloud platform 11. AWS cloud platform # Main features This section lists the main features of QMCLOUD. {% hint style="info" %} The following features are available with the advanced edition subscription only: a) Multiuser support (up to 4) b) Support for GitHub repositories for stacks c) Pricing API integration to get estimates for AWS and Azure stacks. When you are logged into QMCLOUD, you can navigate to the configuration menu item and licensing section to upgrade. {% endhint %} The following are the main features of QMCLOUD. Refer to the concepts section for further details. 1. Create and manage logical entities including organization, workspace, stack profile, stack group and a stack 2. Add and manage cloud components and categories that each of the components belong to (Example AWS Vpc in the EC2 category) 3. Create users, roles and assign roles to users for RBAC (role-based access control) 4. Define GitHub repository credentials for a user 5. Create a stack (unit of infrastructure) using a canvas, guided wizard, AI Copilot or by importing a stack definition file 6. Compose the desired target cloud infrastructure on a canvas using "No Code" technologies including drag/drop, auto connections and the AI Copilot assistant 7. Create a stack using a guided wizard. The guided wizard uses a set of resources pre-defined in a template (or a blueprint) 8. Define various properties of the cloud resources (or components) 9. Add and update connections between various components to define dependencies 10. Create a template using an already deployed stack 11. List and review properties of cloud resources 12. Review the TS/JS code generated by QMCLOUD and configure code commit to a pre-defined github repository for tracking and auditing 13. Estimate the cost of the cloud resources defined in a stack. This feature is only available for AWS stacks. Estimates for Azure cloud resources will be available soon. 14. Scan a cloud account and import the resources in a stack. The imported resources are marked as Read Only. This feature is currently meant for inventory, drift and cost management. It is not possible to make any changes to the resources and actively manage them. 15. Detect drift of cloud resources and their properties 16. Use RESTful API's to integrate with various CI/CD tools (Example - Jenkins) 17. The AI Copilot is an assistant where you can enter a description of the desired cloud infrastructure you want to deploy. The assistant then creates the appropriate configuration and renders the visualization on the canvas for deployments 18. Coming Soon * Security Policies * Cost policies # Installation and Configuration This page lists the general pre-requisites, installation and configuration requirements for QMCLOUD. QMCLOUD is available in the following options: 1. SaaS 2. AWS Marketplace appliance 3. Self-hosted container environment # QMCLOUD SaaS This section describes the various editions and the corresponding functionality with the SaaS version of QMCLOUD. The SaaS version of QMCLOUD is a subscription-based service. There is no need for an end user to install the QMCLOUD software. {% hint style="info" %} The URL for accessing QMCLOUD (SaaS) software is {% endhint %} QMCLOUD is available in the following editions: | Developer Edition | Advanced Edition | Enterprise Edition | | ------------------------------------------------------- | ----------------------------------------------------------------------- | ----------------------------------------------------------------------- | | $99/month or $950/year | $147/month or $1499/year | Contact us for more details | | One organization, and one user | One organization with up to 4 users | Multiple organization, workspaces and users | | RBAC - Not applicable due to only a single user support | RBAC capabilities based on workspace | RBAC based on organization and workspace | | Supports AWS, Azure, K8 cloud providers | Supports AWS, Azure, K8 cloud providers | Supports AWS, Azure, K8 and vSphere cloud providers | | AI Copilot | AI Copilot | AI Copilot | | | Detect drift, Scan, and Import resources from an existing cloud account | Detect drift, Scan, and Import resources from an existing cloud account | | | Estimate cost for resources | Estimate cost for resources | | | | Coming soon - Security and Cost Policies | # SaaS Registration This section describes the registration process for the SaaS version of QMCLOUD. Navigate to the QMCLOUD SaaS URL at and select the Register button as highlighted below: Diagram - QMCLOUD Registration
Enter the details including Name, Email ID and Password. Note that the "Tenant Name" option is being deprecated and may not be available:
Once you enter all the information, you will receive an OTP (one time password) via email and the registration page will prompt to enter the OTP as shown below:
Once you enter the OTP and click submit, the activation process is completed. Once the registration process is successful you will be presented with the home page of QMCLOUD (SaaS). {% hint style="info" %} You will need to accept the "Privacy Policy" and the "Terms and Conditions" for the QMCLOUD service. Please carefully read and review the policies for use. {% endhint %} # AWS Marketplace QMCLOUD is available as an appliance in the AWS marketplace in two editions - Developer and Enterprise. {% hint style="info" %} Refer to the AWS marketplace appliance documentation for further details on installation and configuration. {% endhint %} {% hint style="info" %} Get started with the AWS marketplace appliance with the links below: Enterprise Edition - Developer Edition - [https://aws.amazon.com/marketplace/pp/prodview-yagzyjvas2wcs](https://aws.amazon.com/marketplace/pp/prodview-yagzyjvas2wcs?sr=0-3\&ref_=beagle\&applicationId=AWSMPContessa) {% endhint %} {% hint style="info" %} The AWS marketplace "Developer Edition" supports only a single user. It has the following limitations: a) Supports a single organization and a workspace that limits RBAC capabilities b) The RBAC (Role Based Access Control) capabilities are not needed as it supports only one user c) It does not support the "Cost Estimate" feature {% endhint %} # Self-hosting Setup QMCLOUD in a customer environment * **Pre-requisites for** QMCLOUD **software** * A Linux virtual machine. Preferably Ubuntu 20.x based VM with Docker * A minimum of 2 vcpu’s and 16GB of memory * A minimum of 50GB disk space * Optional - Load balancer with https-based listener, and SSL certificate * Pulumi account and token * Optional - AWS SES credentials for registration and email functionality **Pre-requisites for each of the cloud platform that** QMCLOUD **supports:** * **AWS** * AWS Account(s) * IAM user and a minimum of programmatic access with appropriate permissions * Access and secret key(s) * **Azure** * Azure Account and Subscription * Service principal details including App (Client) ID, Object ID, Tenant ID, Client Secret The installation and setup of QMCLOUD containers is beyond the scope of this page. Please contact support at for a detailed installation guide. # User Interface and Navigation This section highlights various menu items, icons, sections and general navigation in QMCLOUD. A user interacts with QMCLOUD mainly using: 1. Web interface - A user primarily interacts with QMCLOUD using the web interface. 2. RESTful API's - The web interface (also referred to as the front end) in turn interacts with the backend system in QMCLOUD using built in API's. A user can also directly interact with the API when there is a need to integrate QMCLOUD with a CI/CD system or tools. # Main menu Once a user is logged in, the home page is displayed. The home page menu items are laid out in the vertical menu bar as shown below: Diagram - Main menu items
# Dashboard The dashboard on the main menu provides: 1. A summary of various items in QMCLOUD including organizations, workspaces, stacks, deployed stacks, and users. A user can click on any of the summary boxes to get to the corresponding menu item 2. A deployment wizard drop-down list that the user can select an option to initiate deployment 3. A summary of all the resources that are deployed in Q-Cloud Diagram - Dashboard
# General action buttons Many of the menu items in QMCLOUD have the action buttons. For example, under stacks, the action buttons are Add, Delete, Import, Export and Refresh buttons as shown below: Diagram - Common action buttons
# Stack and Canvas When a stack is created, the infrastructure can be composed using the Canvas. The canvas has many sections as shown below including: To get to the canvas, a user selects the option of “Canvas” on the stack as highlighted below: Diagram - List of stacks and open canvas
The following diagram highlights the various items and action buttons on the canvas: Diagram - Canvas details
# Stack Details A user can view additional details about a stack either by selecting the stack details icon on the list of stacks or the stack details item on the canvas. On the canvas, when a user selects the “Stack Details” option, the following details are displayed: Diagram - Stack details, info
Diagram - Stack details, output properties
Diagram - Stack details, code editor
Diagram - Stack details, templates
# Getting started This section describes an example of how QMCLOUD can be used to deploy cloud infrastructure in AWS. The following are the main steps: Assumptions: It is assumed that QMCLOUD is already setup - either as a marketplace appliance or in a self-hosted environment. With a QMCLOUD SaaS environment, many of the instructions in this section don't apply and are managed by QMCLOUD. **a)** Setup and configure Pre-requisites **b)** Create an organization **c)** Create a role and assign permissions **d)** Create a user and assign an organization and a role **e)** Create a workspace **f)** Create a stack **g)** Compose and deploy basic network components to AWS # Pre-requisites The following are the general pre-requisites to deploy cloud resources in AWS: * [ ] AWS account * [ ] An IAM user with appropriate permissions to list, describe, create, update and delete cloud resources * [ ] The users secret and access key details * [ ] The AWS region where the cloud infrastructure will be deployed to * [ ] Address block (CIDR - IPv4) for VPC and Subnets ## Important Note: QMCLOUD relies on the Pulumi service for deployment of cloud resources. For a self-hosted environment or an AWS marketplace appliance, a user is required to: 1. Create or use an existing Pulumi account 2. Create an access token from Pulumi 3. Configure QMCLOUD to use the access token under Configuration Important note: In the SaaS version of QMCLOUD, there is no need for a user to create or setup Pulumi accounts and tokens. The SaaS version of QMCLOUD automatically manages the capabilities on the behalf of the users. Please refer to the Pulumi link below and documentation to get started to create an account. Pulumi offers various tiers of accounts including a free account. {% embed url="" %} Pulumi - Get started {% endembed %} # Login to QMCLOUD Navigate to the QMCLOUD URL that was setup and login using the username and password details. The login screen is displayed as shown below: Diagram – QMCLOUD login screen
Type in the username and password and click on the login button to initiate the login process. Once the login is successful, a dashboard is displayed. {% hint style="info" %} Self hosted or AWS Marketplace appliance - When you navigate to the QMCLOUD URL the first time, it prompts for user details including name, email address etc. to create the first user in its security system. An email is sent to the email address to set the initial password. The first user is a "Super User" with all the permissions in QMCLOUD. {% endhint %} {% hint style="info" %} SaaS environment - a user is required to go through a registration and activation process to access QMCLOUD. {% endhint %} # Create organization The default organization in QMCLOUD is called “common”. An additional customer specific organization can be created if required. {% hint style="info" %} In a SaaS environment, an additional organization can only be created with the Advanced Edition license subscription. The other editions (Developer or Teams) allow only one default organization and an additional organization cannot be created. {% endhint %} **1.** Navigate to the administration section in the menu items and select Organization **2.** Select “Add” to add an organization **3.** Enter the following details: * Organization Name * Description (if any) * Tags (if any) # Add Role **1.** Navigate to the administration section in the menu items and select Roles **2.** Select “Add” to add a new Role (if a predefined role cannot be used) **3.** Enter the following details: * Role Name * Description * Select the appropriate permissions and scope * Submit to save the role # Add User **1.** Navigate to the administration section in the menu items and select Users **2.** Select “Add” to add a user **3.** Enter the following details: * First Name, Last Name * Email ID (this is the username that the user will use to login to QMCLOUD) * Country Code and Phone number * Address * License (if applicable) * Add an appropriate organization that the user will belong to and the appropriate role # Add Components Navigate to the components section in the menu items {% hint style="info" %} The updated version of QMCLOUD is pre-installed with all the required components and there is no need to manually add the components. {% endhint %} If the components are not pre-installed or were not added Select “Add” to add new components. The following dialog box is display. Diagram – Add components ![](/files/vToMNbADisQJpLApWHWE) 1. Select the platform. For example, AWS 2. Select the category of components to be added. For example, ec2 3. Select the required components that will be used. For example – Select All 4. Select the optional appmodz category that will be used to store and display the components. 5. If there are no categories listed, choose the option of Create New. For example, type in AWS Networking 6. Select Add Components 7. A loader is displayed to indicate work in progress. Do not refresh or navigate away from this screen. The time it takes to add the components varies depending on the number of components that are added. Typically, it takes a few minutes when you select to add all the components for a particular category. Once the components are added, close the Add Components dialog box # Add Stack Profile **1.** Navigate to the administration section in the menu items and select Stack Profile **2.** Select “Add” to add a profile **3.** Enter the following details: * Select the appropriate platform form the list * Select the appropriate authentication type from the list * Desired profile name * The Access and Secret Keys (For AWS) * The cloud provider region that is to be used (For example us-east-1) * Select the shared profile option if the profile is to be shared with other users # Add Workspace **1.** Navigate to the deployment section in the menu items and select Workspace **2.** Select “Add” to add a new workspace **3.** Enter the following details: * Name * Select an appropriate organization. In the SaaS version, if the user is not licensed yet, the organization list is empty * Select the appropriate user assigned for this workspace * Select the cloud provider for this workspace # Add Stack **1.** Navigate to the deployment section in the menu items and select Stack **2.** Select “Add” to add a new Stack and choose the type of Stack {% hint style="info" %} There are three different types of stacks that can be created. A canvas-based stack, a deployment wizard-based stack and a definition file based stack. {% endhint %} **3.** Enter the following details for a Canvas based stack: * Stack name * Select the appropriate workspace * Select an appropriate user * Select the platform as AWS in this case * Select a predefined template if required * Select a stack group if required * Select an appropriate stack profile associated with the platform * Enter details of a GitHub repository where you want the automatically generated code to be pushed to. This functionality requires: * A user configures the appropriate username and the corresponding access token for the repository access under user properties * The repository is created before hand * The format of the repository is a URL - For example, [https://github.com/\/\](https://github.com/appmodz/ssp) * Check the box "Enable AutoConnect" if you want the component connections in the stack to be saved for reuse * Click on Save Satck # Compose Infrastructure Using the Canvas Once a stack is defined, cloud infrastructure can be composed using the canvas component. Navigate to the deployment section in the menu items and select the check box for the appropriate Stack to edit. Under the action’s column, click on the “Canvas” action and a blank canvas is displayed as shown below: Diagram - Open Canvas action
Diagram - Blank Canvas
# Add AWS Vpc In this tutorial, we will compose a AWS VPC and two Subnets. On the Canvas page, enter VPC in the component search box and select the component Vpc as shown below: Diagram – Stack, Component list, Select Vpc
Using the mouse controls, drag the Vpc component on to the canvas Using the mouse controls, Select the Vpc shape on the Canvas The VPC properties dialog box opens on the right side of the Canvas Enter the following minimum following properties as shown below: Diagram - Enter Vpc properties
In this example, Enter CidrBlock as 172.20.0.0/16 and Name as aws-vpc-1 Enter "Submit" to save the settings {% hint style="info" %} Important Note – Shapes (objects) may have many properties and not all properties are required. It is assumed that the user is aware of the minimum properties that are required for each of the components. For additional information on properties for each of the components, you can refer to Pulumi documentation for AWS at . Each of the AWS components have a detailed description and examples listed in this document. {% endhint %} # Add Subnets **1.** Under the navigation sub menu, expand “Networking” and select Subnet **2.** Using the mouse controls, drag Subnet on to the canvas **3.** Select the Subnet shape on the Canvas **4.** The Subnet properties dialog box opens on the right of the canvas **5.** Enter the following minimum details for the Subnet: * CidrBlock (Example 172.20.0.0/18) * Name (Example public-subnet-1) Diagram – AWS subnet details
**6.** Select Submit to save the settings. **7.** Repeat the steps to add another Subnet and define the properties. For example: * CidrBlock (Example 172.20.64.0/18) * Name (Example private-subnet-1) Diagram – AWS subnet additional details
# Connect VPC and Subnets Once the VPC and Subnet components have been added to the canvas and their properties are defined, it is now required to define the VPC properties for each of the subnets. As the desired VPC doesn’t exist yet in our example, we will define the VPC property of each of the subnets by using connectors. Each of the shapes on the canvas are shown with various dots on the edge of the shape, that represent the properties of the object. When you hover your mouse controls on the dots, the appropriate property representing dot is displayed on the canvas near the shape. Connectors (Or lines or arrows) can be created by connecting the green and the red dots of shapes. By selecting the green dot on an object/shape and dragging to the appropriate red dot on the shape that is being connected, a connector is created. A connector connects the two objects and defines properties or dependencies. In our case for connecting VPC and the Subnets, use the Mouse control to select the green dot on the VPC object and drag and connect to the red dot on the Subnet object. The following diagram depicts the red dot on the Subnet shape that corresponds to VPCID: Diagram – Component shape and properties
Using the mouse controls, select the green dot on the VPC object and draw a line to connect to the red dot on the subnet. This connector defines the VPCID property for the subnet. Diagram – Connectors
The following diagram depicts all the required connections to connect VPC and the two subnets. Diagram – VPC and Subnets connected using connectors
# Save Canvas State Once the desired infrastructure is composed, the state of all the objects and connections can be saved. Click on the save action bottom near the left bottom of the canvas as shown below: Diagram - Canvas with AWS VPC and Subnets
# Deploy the Infrastructure Once the canvas state is saved, the following action buttons are selected in sequence to deploy the desired infrastructure: Diagram - Deployment action buttons
Save - The save action button saves the canvas state including components, properties, and connectors Validate – The validate action button validates the desired infrastructure (Properties and Syntax) Plan – Confirm the desired infrastructure can be deployed (Checks dependencies and connections to the cloud provider) Apply – Deploy the desired infrastructure Each of the actions when competed displays a log message. The log message will indicate a success, or an error and details can be checked by selecting the appropriate log message. Example of the log messages on the canvas: Diagram – Logs
The following diagram depicts the completion of all the actions required for deploying the VPC and the subnets. It shows the logs section that displays the successful actions. Diagram – Canvas, deployment sate and status
This completes the getting started section. # AI Copilot The AI Copilot is an assistant where you can enter a description of the desired cloud infrastructure you want to deploy and thus reduces the effort required to compose the desired infrastructure. The AI Copilot extends the No Code technologies-based functionality in QMCLOUD for cloud deployments. Using the AI Copilot assistant, you can enter a description of the desired Cloud infrastructure you want to deploy in the prompt window. The Copilot will then automatically generate the required configuration. The Copilot will then render the components and connections with appropriate properties on the canvas. The user can then easily deploy the cloud infrastructure. One of the main use cases for the AI Copilot will be where the user is unsure about all the components required to deploy a service. For example, in AWS EKS, a user will need to compose many components including VPC, Subnets, Routing, Gateways, EKS Cluster, Nodes and IAM roles and policies. The user can enter a description in a prompt and incrementally build the required infrastructure. As with any generative AI based technology, the more information and context that is provided to the assistant, the more accurate responses will be. The advantage of QMCLOUD AI Copilot is that the assistant will render the desired infrastructure on a canvas where the user can review, make changes if required and validate before deployments. In summary the AI Copilot further simplifies and reduces the effort required to deploy Cloud infrastructure. # Example deployment using AI Copilot This section will walk you through a deployment of an AWS VPC and Subnet infrastructure. The following are the main steps to deploy infrastructure using the AI Copilot: 1. Pre-requisites It is assumed that you are able to login to QMCLOUD and have created the pre-requisites including stack profile and a stack. 2. Select the stack and click on canvas button to open the canvas 3. Select the AI Copilot assistant button on the bottom right of the canvas as shown below (marked with a red arrow):

Canvas - AI Copilot chat icon

4. The AI Copilot assistant window opens as shown below. Refer to the user interaction prompt window at the bottom of the assistant (marked with red):

AI Copilot assistant

5. Enter a description of the desired infrastructure to be deployed. For example, in this case the user enters the following description as shown below and click the small arrow button to submit the description: > create the following components including aws vpc named vpcaws1 with cidr 172.35.0.0/19, one public subnet with /20, an igw, a "route table association", a "route table" for this vpc and a "route" with default route of 0.0.0.0/0 with target gateway as the igw in the route. 6. The AI Copilot will automatically generate an appropriate configuration based on the user description and prompts the user to click ok as shown below:

AI Copilot assistant output

7. Once the user selects "Ok" the assistant generates the visualization and renders the proposed infrastructure on the canvas as shown below:

AI Copilot assistant canvas render

8. The user can now review the proposed configuration and make changes if any. 9. As with any generative AI based technology, the more information and context that is provided to the assistant, the more accurate responses will be. For example, in a case where a user may not have added the context, the assistant may miss a dependency between various components. In this example deployment, the "Subnet" component may not be connected to the "Vpc" component. The user can manually connect the Subnet and the Vpc components together using a connector. (Select the red dot for the Subnet component representing the vpcid property and connect to the green dot of the Vpc component) 10. The user can now initiate the deployment using the Save, Validate, Plan and Deploy action buttons on the canvas as shown below marked in red:

AI Copilot canvas action buttons

11. Once the deployment is completed, the user can check the logs by clicking on the "Status" area at the bottom of the canvas. A status log is shown as shown below:

Status Log

12. This completes the deployment using the AI Copilot assistant. In summary, the AI Copilot assistant was used to enter a description of the desired AWS infrastructure and the assistant generates the required configuration and renders the visualization on the canvas. The user can make changes if any and initiate the deployment. # AI Copilot pre-defined prompts This section provides a pre-defined list of prompts that a user can readily use. The following is a list of pre-defined description templates that a user can enter in the AI Copilot assistant description window. Please note that it is important for the user to review the description and make necessary changes to reflect the desired infrastructure based on specific requirements. {% hint style="info" %} QMCLOUD will soon include a list of common pre-defined templates in the assistant area on the canvas. {% endhint %} 1. AWS basic VPC infrastructure > create the following components including aws vpc named vpcaws1 with cidr 172.35.0.0/19, one public subnet with /20, an igw, a "route table association", a "route table" for this vpc and a "route" with default route of 0.0.0.0/0 with target gateway as the igw in the route. 2. AWS basic EKS infrastructure > create an aws eks deployment with one vpc, 2 subnets, one route table, one route table association, one route, one igw, one eks cluster, one iam role, with one vpc-cni add on, and one node group with two nodes {% hint style="info" %} Coming Soon - More pre-defined description templates for Azure, and K8. {% endhint %} # Additional resources Please refer to the following resources for additional details. Copyright © 2021. appmodz corporation – All rights reserved # Explainer video A brief explainer video about QMCLOUD: {% embed url="" %} # Short video on AI Copilot A short video on AI Copilot in QMCLOUD: {% embed url="" %} # Quick walkthrough videos The following are a series of short walkthrough videos to assist you to getting started with a few examples. {% embed url="" %} YouTube Playlist {% endembed %} {% embed url="" %} Intro {% endembed %} {% embed url="" %} Part 1 – Setup Pre-requisites (2min:40sec) {% endembed %} {% embed url="" %} Part 2a – Create Stack (5min) {% endembed %} {% embed url="" %} Part 2b – Create a stack using a template (2m:15sec) {% endembed %} {% embed url="" %} Part 2c – Create a stack using a Smart Wizard (3m:45sec) {% endembed %} {% embed url="" %} Part 3 – Managing a stack (3m) {% endembed %} # Walkthrough of deployment of AWS EKS Series of videos on YouTube for walkthrough of deployment of AWS EKS. {% hint style="info" %} The updated product name is "QMCLOUD" instead of Q-Cloud that is embedded in the video. {% endhint %} {% embed url="" %} # Examples This section provides a few examples of cloud infrastructure deployment using QMCLOUD. # Deploy AWS Firewall and Networking with QMCLOUD Deploy an AWS landing zone components with No Code technology in QMCLOUD This section outlines how one can use “No Code” technology in QMCLOUD to deploy the necessary networking and security components including VPC, Routing, Gateways, Firewall, and NLB to protect an application. The main goal of the No Code technology in QMCLOUD is to allow one to compose, configure, visualize and deploy the desired infrastructure components with ease and without having to write code or know programming constructs. In addition, QMCLOUD generates the necessary infrastructure code and can be stored in a code repository for tracking, change control and auditing purposes thus fully leveraging the concepts of CI/CD including automation, velocity, safety, reliability, and reusability. {% hint style="info" %} Contact us if you are interested in learning more about the No Code technology in the QMCLOUD platform or want to use this template. {% endhint %} # Application and landing zone components The sample web application deployment described in this section consists of the following: 1. Ubuntu server with NGINX web server hosted on an EC2 instance in a private subnet 2. Network load balancer is deployed in a protected subnet and exposes the web server to the Internet 3. AWS firewall is deployed in the public subnet and inspects all ingress and egress traffic. the firewall rules allow only web server related traffic to the Internet (80, 443) and allows ssh connections to the web server initiated internally within the VPC The following diagram depicts the landing zone that is used in this sample deployment:

AWS Landing Zone Components

# List of landing zone components The following is a list of components that are used in this sample deployment 1\. VPC with three subnets (private, protected, and public). The sample deployment uses a single availability zone but ideally one should use multi-AZ deployment 2\. An application server deployed in the private subnet (EC2 instance with NGINX) 3\. NAT gateway to allow the app server instances to access the internet without a public IP assignment 4\. Internet Gateway to allow access to and from the Internet 5\. Network load Balancer for exposing an application deployed in a private subnet 6\. Firewall in a public subnet and associated rules to control both ingress and egress traffic 7\. The routing component controls all traffic and forces all egress and ingress traffic to be inspected by the AWS firewall {% hint style="info" %} Note – Besides the model depicted in this sample deployment, you can refer to other potential models for securing your infrastructure using AWS Firewall. The following link provides a good summary of all the potential models. We have created templates for each of the models. You can reach out to use if you a need to use and/or deploy these templates using QMCLOUD. {% endhint %} # Deployment steps The following is a list of the deployment steps that are used in this sample deployment 1\. Define your credential using a stack profile (Example AWS Key, Secret, and the Region) 2\. Create a stack (unit of infrastructure) and select AWS as the cloud provider 3\. Compose your desired infrastructure using the stack canvas (Drag and Drop from the list of components organized by categories) 4\. Add all the components listed in this document. It may be relatively easier to compose using a modular approach. For example, in the first iteration you can compose only the VPC, subnets and the routing components. Alternately, you can break down the desired component into individual stacks as opposed to all-in-one stack 5\. Define the required properties for each of the components. This is where a template assists in reusability where you are required to define only the minimum properties from a full ist of properties that are pre-defined in a template 6\. Use the auto connections feature to let QMCLOUD connect all the required components thus defining the dependencies (Example a subnet needs to know which VPC it will be deployed into) 7\. Save, validate, and deploy the infrastructure Note: Refer to the next section for configuration details for each of the components. # VPC configuration details The following VPC configuration was used in the sample deployment CIDR Block - 172.21.0.0/19 Three subnets (private, DMZ and Firewall) in us-east-1c Private - 172.21.18.0/23 (EC2 Instance) DMZ - 172.21.30.0/23 (NAT GW and NLB) Firewall Subnet - 172.21.0.0/23 (Firewall) All traffic inbound and outbound is filtered via the firewall **Connections:** Connect each of the subnets to the VPC using the connector (Select the VpcId property end point on the subnet component represented by the red dot and connect to the VPC component represented by green end point on the Vpc shape). The following diagram depicts the VPC and Subnet components and the connection. ![](/files/DHF97XfvJUEpxpRCNGXG) # Routing configuration details The following routing configuration was used in the sample deployment In AWS the following components are required to programmatically create the routing infrastructure: 1. Route - The route defines the destination CIDR block. The destination gateway is either defined inline as a property or via connection to a gateway 2. Route Table - The route table is associated with the VPC 3. Route Table Association - The association component connects the route, route table and the appropriate subnets 4. NAT Gateway - NAT Gateway allows resources on the private subnet to access the Internet NAT and Internet gateway 5. EIP - Elastic IP associated with the NAT Gateway **Routes and Route Table** Besides the local routes for the VPC CIDR Blocks, the following routes are defined. 1. Private Subnet - 0.0.0.0/0 to NAT Gateway 2. Protected Subnet - 0.0.0.0/0 to VPCE-xxx (this is the VPC Endpoint for the firewall) 3. Public Subnet - 0.0.0.0 to Internet Gateway 4. IGW Route table - This is a special route table that's unique where the route table is defined by associating the IGW under Edge Associations (instead of a subnet). For forwarding all ingress traffic to the protected subnet, we add a route for 172.21.30.0/23 (the protected subnet CIDR block) and add the next hop as VPCE-xxx (this is the VPC Endpoint for the firewall) **In summary:** All egress traffic from the private subnet is forwarded to the NAT gateway and eventually to the firewall. All ingress traffic from the Internet that is passed through the IGW, is forwarded to the firewall for inspection. Once the firewall inspects the traffic, it forwards the traffic to the load balancer in the protected subnet in the sample deployment. **Connections:** The following diagram depicts the appropriate connections. QMCLOUD offers "Auto Connections" feature that connects most commonly used connections on the canvas automatically thus reducing the effort required by the end users.

Defining connections (Dependencies) for VPC, Subnet and Routing components

{% hint style="info" %} You will need to either use auto connection or manually connect each of the remaining subnets and the corresponding routing components. Note that the public subnet connects to the Internet Gateway as shown in the summary section diagram. {% endhint %} # Firewall configuration The following firewall configuration was used in the sample deployment In AWS the following components are required to programmatically create the firewall infrastructure: AWS Network Firewall - This represents the firewall that is deployed in AWS and is associated with a VPC. The firewall can be deployed in various models depending on the requirements. In this sample deployment, the firewall is deployed in a public subnet to inspect all ingress and egress traffic Firewall Policy - The policy is assigned to a firewall and contains the desired rules and behavior of the firewall. Rules are created as part of the rule groups. Firewall Rule Groups - Firewall rules are either stateless or stateful. Once the rule grops are created, they are associated with a policy. Details of the rules are beyond the scope of this document. **Connections:** The following diagram depicts the appropriate connections. QMCLOUD offers "Auto Connections" feature that connects most commonly used connections on the canvas automatically thus reducing the effort required by the end users.

Configuration and connection for AWS Firewall and its associated components

# Additional components configuration The following additional components were used as part of this sample deployment 1. Compute components include EC2 instance, security group, and security group rule. the EC2 instance is an Ubuntu server with a basic NGINX server 2. Network load balancer, listener and target group. The target group has the EC2 instance registered to serve the web requests 3. Internet Gateway and its associated routing components The configuration of each of these components is beyond the scope of this document. The deployment of the sample configuration is done via a single QMCLOUD stack and all the resources can be referenced in additional stack if required to extend the infrastructure. QMCLOUD generates the infrastructure code automatically and can be stored in a GitHub repository if required. QMCLOUD can be integrated using REST API's with various CI/CD tools for orchestration. The following diagram depicts the overall stack on the canvas, the configuration details (outputs from each of the components) and the code that is generated by QMCLOUD:

QMCLOUD stack on the canvas, configuration details and the associated auto generated code

This completes the walk through for this sample deployment. # Securing applications in AWS using Palo Alto firewall Deploy VM-Series firewall in AWS using QMCLOUD blueprint Continuing the theme of simplifying cloud deployments using No Code technologies, we have created a QMCLOUD blueprint that deploys an end-to-end AWS environment of spoke and inspection VPC's with various components including "Gateway Load Balancer" for high availability of the VM-Series firewall appliances.\ \ Even though Palo Alto makes it easy for initial configuration of the appliances using Panorama and Zero touch capabilities, the initial deployment of the AWS resources and the appliance is complex and requires considerable effort (either to develop code or to do it manually). Other options include the Terraform modules for the firewall appliance, but it lacks visualization capabilities and requires considerable effort to understand and customize.\ \ The blueprint shown below allows you to visualize using the canvas, modify and deploy the end-to-end configuration as described in the article referenced below in less than 15 minutes. In addition, QMCLOUD auto generates the required code.\ \
You can also customize the template and update the configuration as per your requirements using the canvas using QMCLOUD.\ \ Contact us at if you are looking to deploy third party firewall appliances in AWS or Azure. # Templates This section lists the various pre defined templates available with QMCLOUD. A template (or a blueprint) in QMCLOUD is a pre-defined set of cloud resources. The template consists of the following: 1. A set of cloud resources (Example - AWS Vpc and Subnet) 2. Pre-defined connections between appropriate cloud resources. Connections are represented using arrows on a canvas (Example - Subnet is defined as belonging to a Vpc using the VpcID property) 3. Minimum set of properties of each of the cloud resources The template is a json file that can be imported in QMCOUD and can be used to create a stack. {% hint style="info" %} Please contact support at "" for requesting templates. Please provide a short description of the template you are looking for. {% endhint %} # AWS Landing Zone AWS basic networking infrastructure The basic template consists of the following components: 1. Vpc 2. Subnets (3 Private and 3 Public) 3. Routing (Route table, Route table association, Route) 4. Internet gateway 5. NAT gateway and EIP The following diagram depicts the components in the template. Diagram - AWS Basic landing zone
# AWS EKS AWS basic EKS infrastructure The basic template consists of the following components: 1. Vpc 2. Subnets (2 Public) 3. Routing (Route table, Route table association, Route) 4. Internet gateway 5. IAM (Roles and Policies required for EKS) 6. EKS cluster with aws-cni and kube-proxy add-ons 7. A node group with one node The following diagram depicts the components in the template. Diagram - AWS basic EKS infrastructure
# Azure Web App Azure web app service The basic template consists of the following components: 1. Resource Group 2. Azure Web App 3. Azure App Service Plan