Hello all, I'm Josh - CTO of JuniperCDS @alexkg is CEO I'm having some trouble getting Medplum on AWS using CDK. I've looked at the docs and resources here: - https://docs.medplum.com/self_hosting/install-on-aws - https://github.com/medplum/medplum/tree/main/packages/infra I see that some AWS-owned cdk config samples are linked in Github But I was wondering if you had any working examples of deploying Medplum on AWS using CDK?

Hi @joshua2579 - thanks for taking a look. We have a few live deployments, including some teams who were able to do it entirely by themselves. CDK docs are a little lacking at the moment. I can clean up some example configs for you today

Awesome, thank you!

@cody any updates on the example?

Hi @alexkg - I made a push to document most of the CDK config settings, and included examples and prerequisite setup steps: https://docs.medplum.com/tutorials/self-hosting/install-on-aws

Wow! Thanks @cody We'll take a look but this is a lot more detailed 🙂

Hi @cody Thanks for the newly updated CDK config settings, they got me a lot of the way. However, I'm stuck on one bit. I'm getting an error regarding the CloudFront PublicKey:

12:34:11 PM | CREATE_FAILED        | AWS::CloudFront::PublicKey                      | StorageStoragePublicKeyF7600AA8
Resource handler returned message: "Invalid request provided: AWS::CloudFront::PublicKey" (RequestToken: 457ae00a-391b-
c4f3-43e6-d7f5e68fff6b, HandlerErrorCode: InvalidRequest)

I've created a private-publickey pair and added the publickey to a KeyGroup on CloudFront I've also updated the medplum.config.json in

medplum/packages/server/

with the RSA signing key that I had used to create the public key. I'm sure I'm missing something else. Any indication of where I should look next? Thanks. @alexkg

Hi @alexkg - Sorry about the delay. There is another part of the server config that needs more documentation. When running in AWS, the server loads config settings from AWS Parameter Store rather than medplum.config.json. So, the private key should be added to /medplum/${name}/signingKey, where ${name} is the name you used in the CDK config file. I'll try to update the docs more today. Let me know if you'd like to discuss: https://calendly.com/cody-ebberson

Hi @cody Thanks for the update. I'll take a look at it and wait for the documentation. I'll reach out if we need to discuss further.

@alexkg - Here's the PR with updated docs: https://github.com/medplum/medplum/pull/963 There are more manual steps than I'd like. Hopefully we'll get a chance to streamline this process in the near future.

Thanks! @joshua2579 will take a look tomorrow!

Thanks @cody , I think I have the server config figured out. Now I'm troubleshooting with AWS as I'm getting an 'Access Denied' error with CloudFront. Evidently our account is not 'verified'. I'll let you know if we encounter any new Medplum config-related issues. Thanks again!

oh, interesting. 12.4 is no longer enabled. auto minor-upgrade is enabled, so all of our systems are on 12.8. we can update

backend.ts

to use a more recent version: https://github.com/medplum/medplum/blob/main/packages/infra/src/backend.ts#L53 You could make the change in your local backend.ts. Also feel free to submit a PR.

Thanks! i'll look into it

Hi all ! Am stuck with this issue - the Cloudfront Public key is invalid. Please if anyone has resolved this can you post the solution here ?

Hi @sum07870 - did you use the infra

init

tool, or did you use the manual instructions to setup the key?

I was following the instructions in this document https://www.medplum.com/docs/self-hosting/config-settings