Mentingo AI-based white-label LMS for enterprise

LAUNCH

1. Launch the CloudFormation template in your preferred region. It is preconfigured and deploys as-is; provide input only for a custom domain, email, or optional integrations. Optionally set the Admin Email parameter.
2. Stack creation takes about 20-30 minutes (RDS and ElastiCache dominate).
3. When status is CREATE_COMPLETE, open the Outputs tab of the root stack.

FIRST LOGIN

4. Open the ApplicationUrl output in your browser.
5. The admin password is randomly generated per deployment and stored in AWS Secrets Manager (never fixed or shared). Retrieve it via the AdminPasswordSecretUrl output link ("Retrieve secret value") or the AdminPasswordCliCommand output.
6. Sign in with your admin email and the one-time password. The app requires you to set a new password before accessing the dashboard.

EMAIL (optional but recommended)

Email (invitations, password reset) needs an SMTP provider. Update the stack and set SmtpHost, SmtpPort, SmtpUser, SmtpPassword, SmtpEmailFrom from your provider (Amazon SES SMTP, SendGrid, Mailgun, etc.). Ports 587 (STARTTLS) and 465 (TLS) are supported.

HTTPS WITH YOUR DOMAIN (recommended for production)

1. Request/import an ACM certificate in the SAME region as the stack.
2. Update the stack: set DomainName and CertificateArn. If the domain is in Route53, set HostedZoneId to auto-create the DNS record; otherwise point a CNAME to the load balancer DNS name.
3. Auth cookies switch to secure mode automatically.

SENSITIVE DATA AND ENCRYPTION

All secrets (admin password, database credentials, JWT signing keys, master encryption key, SMTP and integration keys) are stored in AWS Secrets Manager and SSM Parameter Store, encrypted with KMS. Encryption at rest: RDS (KMS), S3 (SSE-AES256), ElastiCache (enabled). In transit: HTTPS to the load balancer (with a certificate), and TLS to ElastiCache. RDS is not publicly accessible.

KMS KEYS (created by the template)

• ACM key: general application encryption.
• Secrets Manager key: encrypts all Secrets Manager secrets.
• RDS key: encrypts database storage. Locations: KMS console > Customer managed keys, aliased under alias/<environment>/mentingo/*.

IAM ROLES (created by the template, least privilege)

• API/UI task roles: app access to its S3 bucket and Secrets Manager secrets.
• Task execution roles: pull images and inject secrets into ECS tasks.
• EC2 instance role: register instances with ECS. No AWS credentials are ever entered; all access uses these roles.

NETWORK

VPC with public subnets (load balancer) and private subnets (ECS, RDS, ElastiCache). Only the load balancer is internet-facing (ports 80/443). ECS tasks reach RDS, ElastiCache, and S3 privately. Security groups restrict traffic to these paths.

DATABASE, BACKUP, ROTATION

PostgreSQL master credentials: Secrets Manager (DbMasterSecretUrl output). RDS automated backups retain 7 days; restore via the RDS console (point-in-time or snapshot). To rotate generated secrets, update the value in Secrets Manager and restart the ECS service.

MONITORING

• ECS: console > Clusters > your cluster > Services; confirm running task count equals desired.
• Load balancer: EC2 console > Target Groups; confirm targets are "healthy" (health check path /api/healthcheck).
• Logs: CloudWatch Logs, groups prefixed with the stack name.

COST AND SERVICE QUOTAS

You pay for the underlying AWS resources (ECS on EC2, RDS, ElastiCache, load balancer, data transfer). Estimate with the AWS Pricing Calculator (https://calculator.aws ). Deployment stays within standard service quotas; manage or raise limits per https://docs.aws.amazon.com/general/latest/gr/aws_service_limits.html .

UPGRADES

New product versions provide an updated template referencing new container image tags. Update your stack with the new template; database contents and settings are preserved.