> ## Documentation Index
> Fetch the complete documentation index at: https://docs.aviatrix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deploy Aviatrix Controller through CSP Consoles

> This guide provides step-by-step instructions for manually launching the Aviatrix Controller in AWS, Azure, and GCP using their respective cloud consoles or CLI tools.

This guide provides step-by-step instructions for manually launching the
Aviatrix Controller in AWS, Azure, and GCP using their respective cloud consoles
or CLI tools.

* [AWS Deployment](#aws-deployment)
* [Azure Deployment](#azure-deployment)
* [GCP Deployment](#gcp-deployment)
* [Post-Deployment Setup](#post-deployment-tasks)

## Prerequisites

* An active AWS, Azure, or GCP account with the required permissions
* IAM roles and policies
* Security group or firewall rules allowing required ports

<a id="aws-deployment" />

## Deploy Aviatrix Controller in AWS Console

### Create IAM Role

1. Sign in to the **AWS IAM Console**.
2. Navigate to *Roles* → *Create Role*.
3. Select **EC2** as the trusted entity.
4. Attach the Aviatrix IAM Policy. See <a href={"/docs/enterprise/" +
   "10.1" + "/reference/general/iam-role"}>AWS IAM Policies</a>.

### Launch EC2 Instance from AMI

1. Go to the AWS EC2 Console.
2. Click *AMIs* on the left-side menu.
3. Search for `avx-controller-g5` from the *Public images* tab.
4. Select the latest image.
5. Click *Launch instance from AMI*.

### Configure Instance Details

Follow the steps below to configure the instance details:

1. Enter an instance name.
2. Choose an instance type (must be `t3.large` or larger).
3. Select or create a key pair. Download and store the `.pem` or `.ppk` file
   securely.
4. Network settings:
   1. Choose the appropriate VPC and subnet with a route to the Internet.
   2. Enable auto-assign Public IP.
   3. Create or select a security group allowing inbound traffic on ports 22
      and 443.
5. Storage configuration as needed.
6. Under *Advanced Details*:
   1. Set IAM Role to `aviatrix-role-ec2`.
7. Review and launch the instance. Wait until its status is `running`.

### (Optional) Associate Elastic IP with your Instance

It is recommended to associate an Elastic IP with your instance for a stable
public IP address.

1. Navigate to the **Elastic IPs** section in the EC2 Console.
2. Click *Allocate Elastic IP address*.
3. Select the instance and click *Associate Elastic IP address*.
4. Select the EC2 instance you just launched and click *Associate*.

<a id="azure-deployment" />

## Deploy Aviatrix Controller in Azure Portal

This section provides instructions for deploying the Aviatrix Controller in
Azure using the Azure Portal.

### Launch from Azure Marketplace

1. Sign in to the **Azure Portal**.
2. Click *Create a resource*.
3. Search for `Aviatrix Controller` and select **Aviatrix Cloud Network
   Controller**.
4. Click *Create > Aviatrix Controller G5*.

### Configure VM Settings

1. Choose an existing Resource Group or create a new one.
2. Enter a VM Name.
3. Choose a Region (such as, `East US`).
4. Choose an availability zone.
5. Choose a security type (such as, `Standard`).
6. Choose a VM size (must be `Standard_D2s_v3` or higher).
7. Select Authentication type and SSH key.
8. For the inbound port rules, allow:
   * HTTPS (443)
   * SSH (22)
9. Under *Networking*, choose Virtual Network, Subnet and Public IP.
   1. Ensure the subnet has a route to the internet (NAT Gateway or Internet
      Gateway).
   2. For the public IP, you can either create a new one or use an existing one.
   3. For the inbound port rules, ensure the following ports are allowed:
      * SSH (22)
      * HTTPS (443)
10. Click *Review + Create* to complete the deployment.

<a id="gcp-deployment" />

## Deploy Aviatrix Controller in GCP CLI

This section provides instructions for deploying the Aviatrix Controller in GCP
using the GCP CLI.

<Note>
  Due to recent changes in the Google Cloud Platform (GCP) portal, deploying the
  Aviatrix Controller through the portal UI is currently not supported. This
  section provides instructions for CLI-based deployment as an alternative.
</Note>

### Prerequisites

* A Google Cloud project with billing enabled
* IAM permissions (Compute Admin and Service Account Admin)
* An SSH key pair
* Network and firewall rules allowing access

### Install Google Cloud CLI

Make sure you have the Google Cloud SDK (gcloud CLI) installed on your local
machine.

* Official installation guide:
  [https://cloud.google.com/sdk/docs/install](https://cloud.google.com/sdk/docs/install)

To verify that the gcloud CLI has been installed, run the following command in
your terminal:

```bash theme={null}
gcloud --version
```

### Initialize Google Cloud CLI

After installing, authenticate and set your default project:

```bash theme={null}
gcloud init
```

This command will:

* Open a browser to authenticate your Google account.
* Let you choose your Google Cloud project.
* Optionally set default region/zone.

### Launch from Google Cloud Marketplace

1. Go to the Marketplace and search for `Aviatrix Cloud Network Controller`.
2. Select the **Aviatrix Cloud Network Controller**.
3. Click **Launch**.
4. Click the **Command Line** tab. This tab shows you *pre-filled gcloud
   commands* that you can run from your terminal to deploy the Aviatrix
   Controller VM manually.

### Reviewing the VM Image Path

Once you've launched from the Marketplace, copy the resource name of the VM
image under *Review VM images*. It will resemble this format:

```bash theme={null}
gcloud compute images list --project=mpi-aviatrix-public
```

### Preparing for Command-Line Deployment

### Deploy via gcloud CLI

Use this command to deploy a VM with the Aviatrix Controller image. Replace
`<instance-name>` with your actual values.

```bash theme={null}
gcloud compute instances create <instance-name> \
  --zone=us-central1-c \
  --machine-type=n2-standard-4 \
  --image=projects/mpi-aviatrix-public/global/images/avx-controller-g5-202606302056 \
```

Example:

```bash theme={null}
gcloud compute instances create avx-controller \
  --zone=us-central1-c \
  --machine-type=n2-standard-4 \
  --image=projects/mpi-aviatrix-public/global/images/avx-controller-g5-202606302056 \
```

### Create Firewall Rules

Open the required ports to access your VM.

#### Allow SSH (port 22)

Run the following command to create a firewall rule that allows SSH access,
where `<YOUR_PROJECT_ID>` is your Google Cloud project ID.

```bash theme={null}
gcloud compute firewall-rules create allow-ssh \
  --network=default \
  --allow=tcp:22 \
  --source-ranges=0.0.0.0/0 \
  --project=<YOUR_PROJECT_ID>
```

#### Allow HTTPS (port 443)

Run the following command to create a firewall rule that allows HTTPS access,
where `<YOUR_PROJECT_ID>` is your Google Cloud project ID.

```bash theme={null}
gcloud compute firewall-rules create allow-https \
  --network=default \
  --allow=tcp:443 \
  --source-ranges=0.0.0.0/0 \
  --project=<YOUR_PROJECT_ID>
```

#### Optional: Internal Traffic

Run the following command to allow internal traffic within your GCP network.
This is useful for communication between VMs in the same network, where
`<YOUR_PROJECT_ID>` is your Google Cloud project ID.

```bash theme={null}
gcloud compute firewall-rules create allow-internal \
  --network=default \
  --allow=tcp,udp,icmp \
  --source-ranges=10.128.0.0/9 \
  --project=<YOUR_PROJECT_ID>
```

### (Optional) Set Up the GCP Service Account

After deploying your Controller VM, create a Service Account for Aviatrix to
manage your GCP environment.

#### Create Service Account

You can use an existing Service Account or create a new one specifically for the
Aviatrix Controller. If you choose to create a new one, follow these steps:

1. Go to the **Google Cloud Console**.
2. Go to *IAM & Admin > Service Accounts* in the Cloud Console.
3. Click **+ CREATE SERVICE ACCOUNT**.
4. Fill in:
   * Service account name
   * Service Account ID
   * Description: Service Account for Aviatrix Controller
5. Click **CREATE AND CONTINUE**.

#### Assign Required Roles

Grant the following roles:

* Compute Admin
* Service Account User

Click **DONE** to finish.

#### Create and Download JSON Key

1. Click the service account you just created.
2. Go to the *Manage Keys* tab.
3. Click *ADD KEY > Create new key*.
4. Choose **JSON**.
5. Click **CREATE**.

This will download the JSON key file to your computer. Store it securely.

<a id="post-deployment-tasks" />

## Post-Deployment Setup

After deploying the Aviatrix Controller, you need to complete the initial setup
to configure it for your environment.

### Initial Setup of Aviatrix Controller

Follow these steps to complete the setup of your Aviatrix Controller after
deployment:

1. Enter the public IP of the instance in your browser to access the Controller
   UI.
2. Login the Controller UI using the default credentials:
   * Username: `admin`
   * Password: `<your private ip>`
3. Follow the setup wizard to change the Controller UI login password.
4. Enter email address for password recovery.
5. Enter your Customer ID.
6. Click **RUN** to complete the Initial Setup.

### Onboard Cloud Accounts

After the Controller is set up, you can onboard your cloud accounts to manage
them through the Aviatrix Controller. Follow the specific onboarding guides for
each cloud provider.

#### Onboard your AWS Account in Aviatrix Controller

After the instance is running, you need to onboard your AWS account in the
Aviatrix Controller. See <a href={"/docs/enterprise/" + "10.1" +
"/guides/controlplane/onboard-account-controller-aws"}>Onboard AWS Account</a>
for detailed instructions.

#### Onboard your Azure Account in Aviatrix Controller

After the VM is created, you need to onboard your Azure account in the Aviatrix
Controller. See <a href={"/docs/enterprise/" + "10.1" +
"/guides/controlplane/getting-started-guide-azure"}>Onboard Azure Account</a>
for detailed instructions.

#### Onboard your GCP Account in Aviatrix Controller

Access your Aviatrix Controller Web UI via its External IP:

`https://<Controller-External-IP>`

1. Go to **Cloud Accounts**.
2. Click **Add New Account**.
3. Select **GCP** as the Cloud Type.
4. Upload the **JSON Key File** you downloaded.
5. Name the account and save.

The Controller now has permissions to manage GCP resources in your project.

See <a href={"/docs/enterprise/" + "10.1" +
"/guides/platform-administration/gcp-account-onboarding"}>Onboard GCP
Account</a> for more detailed instructions.