Hourglass Quality Manager

BEFORE YOU LAUNCH

1. Amazon SageMaker quotas (for defect prediction): in Service Quotas > Amazon SageMaker, request at least 1 for "ml.m5.xlarge for training job usage" and "ml.m5.large for endpoint usage" (or for the instance types you choose in the stack). New AWS accounts often start at 0.
2. Amazon Bedrock (for AI test generation): make sure the model mistral.mistral-large-3-675b-instruct is available to your account in the stack's region.
3. Permissions: the person launching the stack needs permission to use CloudFormation, EC2, IAM, S3, Secrets Manager, CloudWatch Logs and Systems Manager, plus RDS (database mode rds) or Data Lifecycle Manager (local database with snapshots). Acknowledge that the stack creates IAM resources.

IAM ROLES CREATED BY THE STACK No access keys are created or requested. The stack creates two least-privilege roles:

• Server role (EC2 instance profile): reads only this stack's secrets; reads and writes only this stack's S3 bucket; starts and manages SageMaker jobs and endpoints named hourglass-*; invokes the configured Bedrock model; checks your AWS Marketplace subscription with AWS License Manager; reads CodeCommit and CodePipeline/CodeBuild if you connect them; writes its CloudWatch log group; Session Manager access for administrators. With the local database it can also create, attach and snapshot only EBS volumes tagged with this stack's ID.
• SageMaker role: used only by training jobs and endpoints, with access to this stack's S3 bucket and its own logs.

LAUNCH

1. Choose a VPC and a subnet that can reach the internet (public subnet, or private subnet with a NAT gateway).
2. AllowedCidr: your office or VPN IP range, for example 203.0.113.0/24. Only this range can open the app.
3. Optional: DomainName and TlsEmail for a trusted HTTPS certificate. Without a domain, the app uses a self-signed certificate and your browser shows a warning.
4. DatabaseMode: rds (recommended for production) or local (lower cost).
5. Wait for CREATE_COMPLETE (about 5 minutes with local, 15 with RDS), then open AppUrl from the stack's Outputs.

FIRST SIGN-IN

1. Create the first account: it becomes the administrator. Do this right away, since the first person to open the app gets that role.
2. If the app shows Subscription required right after subscribing, click Check now.
3. Add people under Projects and accounts. Your plan sets the number of active users (Team 10, Business 50, Enterprise unlimited).

CONNECT YOUR TOOLS

1. VCS: connect GitHub, GitLab, Bitbucket or AWS CodeCommit with a read-only token, then add repositories and choose the branches to track.
2. Jira: connect with your site URL, your Atlassian email and an API token. Bug fixes are traced back to the commits that introduced them.
3. CI/CD: add Jenkins, GitHub Actions, GitLab CI, CircleCI, TeamCity, Azure Pipelines or AWS CodePipeline. Define Source Areas (file patterns per repository), then Job Mappings that say which test job runs when a change in an area crosses your risk threshold.
4. Settings > ML Models: click Train New Model once history has built up (at least 10 bug-introducing and 10 clean commits). Retrain monthly as more history accumulates.

UPGRADES AND OPERATIONS

• Upgrade by updating the stack with the new version from AWS Marketplace. Your data is kept.
• Logs: CloudWatch Logs group /hourglass/<stack name>. Shell access: EC2 > the instance > Connect > Session Manager.
• Deleting the stack keeps the S3 bucket, secrets, the RDS final snapshot and the local database volume so no data is lost; delete them by hand when no longer needed.

Support: support@hourglass-software.com