Fugue & GovCloud

Overview

Fugue provides the same continuous, scalable enforcement for managing your complex cloud workloads using GovCloud in AWS, specifically in the us-gov-west-1 region.

In general, Fugue operates within GovCloud using the same components, features, and services found throughout the other supported AWS regions. Some items to note:

  • In GovCloud, Fugue will support both Basic and Team Conductors
  • Running Fugue requires a separate AWS ID specific to GovCloud
  • A Fugue GovCloud Conductor may only manage compositions within GovCloud - cross-regionality is not supported

Information, instructions, and examples about the internals, configuration, and usage of Fugue are available throughout docs.fugue.co, and any specific differences in functionality and support for the operation of Fugue within GovCloud are noted here. For support, or to inquire about details not provided, reach out to us at support@fugue.co.

For details on the differences between the standard AWS regions and the GovCloud AWS regions, please refer to Amazon’s documentation about service-specific differences and general differences.

Service Coverage

Instance Types

Fugue provides support for all instance types defined by AWS for use in GovCloud with the following exceptions:

  • EC2.T2_xlarge
  • EC2.T2_2xlarge
  • EC2.R4_xlarge
  • EC2.R4_2xlarge
  • EC2.R4_4xlarge
  • EC2.R4_8xlarge
  • EC2.R4_16xlarge
  • EC2.I3_large
  • EC2.I3_xlarge
  • EC2.I3_2xlarge
  • EC2.I3_4xlarge
  • EC2.I3_8xlarge
  • EC2.I3_16xlarge
  • EC2.M1.medium
  • EC2.M1.large
  • EC2.M1.xlarge
  • EC2.C1.medium
  • EC2.C1.xlarge
  • EC2.CC2.8xlarge
  • EC2.M2.xlarge
  • EC2.M2.2xlarge
  • EC2.M2.4xlarge
  • EC2.I2.xlarge
  • EC2.I2.2xlarge
  • EC2.I2.4xlarge
  • EC2.I2.8xlarge
  • EC2.HS1.8xlarge
  • EC2.T1.micro

Specific Services

Fugue does not support the following AWS services in GovCloud:

  • Beanstalk
  • CloudHSM
  • CloudTrail
  • CloudWatch events and logs
  • CodeDeploy
  • Config
  • Direct Connect
  • Import
  • EC2 Systems Manager
  • Elastic MapReduce
  • Glacier
  • Key Management Service (KMS)
  • Redshift
  • Server Migration Service (SMS)
  • Simple Workflow Service (SWF)
  • Snowball
  • Trusted Advisor

Validations

In general, Fugue supports the same validations within GovCloud (specifically us-gov-west-1) with the following exceptions:

  • Spot instances are not supported (AutoScaling.LaunchConfiguration.)
  • ELB LoadBalancers may only listen on the following ports:
    • 25
    • 80
    • 443
    • 465
    • 587
    • 1024-65535
  • NatGateways are not supported
  • CloudFront is not supported
  • Route53 is not supported

Compositions in GovCloud

Using the Ludwig Compiler

When using the Ludwig Compiler (lwc) to compile a composition containing the GovCloud region type (AWS.Us-gov-west-1), you must first set the FUGUE_RUNTIME_AWS_PARTITION environment variable to aws-us-gov:

export FUGUE_RUNTIME_AWS_PARTITION=aws-us-gov

Note: This is only necessary when invoking lwc directly from the command line for the purpose of local compilation. It’s not necessary to change the partition for regular use of the Conductor through fugue commands; the Conductor sets the correct environment variable based on whether it’s located in GovCloud or public AWS regions.

Ludwig has two AWS partitions, Standard and GovCloud. A Conductor may only operate in a single partition. Setting the environment variable to aws-us-gov enables lwc to compile compositions destined for the GovCloud region.

Otherwise, if you compile a GovCloud composition while the environment variable is set to the Standard partition, lwc will return an error:

ludwig (evaluation error):
  "simple_vpc.lw" (line 11, column 11):
  Validations failed:

    11|   region: AWS.Us-gov-west-1,
                  ^^^^^^^^^^^^^^^^^

    - Invalid region: Us-gov-west-1 is not a valid region in the Standard partition
      (from Fugue.AWS.Region.regionIsValidForPartition)

To switch back to the Standard partition, set the environment variable to aws:

export FUGUE_RUNTIME_AWS_PARTITION=aws

Ludwig Validations

Ludwig validations exist in the Fugue.AWS library, not the Fugue.Core.AWS library. If you write a composition importing only the Fugue.Core.AWS library and attempt to use a service that does not exist in GovCloud, the validation will not be imported and you will not get an error message upon compilation stating that you can’t use that service in GovCloud. Instead, you’ll receive an error message after the Conductor fails to run the composition.

For this reason and others, we recommend using the Fugue.AWS library for your compositions, rather than Fugue.Core.AWS. See our explanation at Writing Ludwig.