CNE AWS Ready: Running Liferay on AWS GovCloud

Use the Liferay Cloud Native Experience (CNE) installer to provision a Liferay environment on AWS GovCloud (US). The installer creates the required infrastructure and deploys Liferay using Kubernetes and Helm.

Open the AWS Marketplace.
Search for Liferay DXP Cloud Native Installer for AWS GovCloud.
Subscribe to the product.

Launch the Installer Instance

In AWS Marketplace, navigate to Your AWS Marketplace Account → Manage your software subscriptions, and select the installer.
Click Launch new instance, then choose Launch from EC2 Console.
Configure the instance:
- Select the latest available version.
- Choose your target region.
- Set an instance name.
- Select an instance type (for example, t3.micro).
- Select or create a key pair.
Configure networking.

Use a VPC with access to AWS APIs, including AWS STS (sts.[region].amazonaws.com). Avoid private subnets without outbound access.
Select an IAM instance profile.

Attach a role with sufficient permissions for provisioning resources.

Note

Attach the AdministratorAccess policy during setup. Replace it with a least-privilege policy after identifying required permissions.

(Optional) Provide additional configuration using user data.

Use cloud-init to pass configuration files to the installer, such as a values.yaml file for the Liferay Helm chart.

Example:

#cloud-config
write_files:
- path: /opt/liferay/values.yaml
  content: |
    liferay-default:
      configmap:
        data:
          license.xml: |
            <!-- license contents -->

Launch the instance.

Connect to the Instance

Open the EC2 instance.
Click Connect and use EC2 Instance Connect.
Switch to the liferay user:
```
su liferay
```

Verify the Deployment

Check the Liferay rollout status:

cd ~/terraform/dependencies

kubectl rollout status statefulset/liferay-default \
   --namespace "$(terraform output -raw deployment_namespace)" \
   --timeout=1200s

Get the public ingress host name:

kubectl get ingress liferay-default \
   --namespace "$(terraform output -raw deployment_namespace)" \
   --output jsonpath='{.status.loadBalancer.ingress[0].hostname}'

Retrieve the admin password:

kubectl get secret liferay-default \
   --namespace liferay-system \
   --output jsonpath='{.data.LIFERAY_DEFAULT_PERIOD_ADMIN_PERIOD_PASSWORD}' \
   | base64 --decode