Beacons is an app (or Product in AWS nomenclature) for data collaboration that is deployed in your own cloud or warehouse environment, delivering our ‘non-movement of data’ promise even before collaboration has taken place. AWS Beacons are deployed in your AWS customer account.

Pre-requisites

AWS Setup

Beacon Deployment

1. Create a AWS Cloud Vault in InfoSum

2. Beacons Marketplace Product Deployment in AWS

Next step

Additional information:

Setting up a Beacon for Destination Exports

Upgrading your Beacon deployment

Deleting your Beacon deployment

Operational Costs

Troubleshooting

Pre-requisites

You must have an InfoSum license and account prior to starting this process. If you do not have one, please reach out to your InfoSum contact or support@infosum.com to get started.

You must have your data in a supported format, which is customer-level data. AWS  can easily transform your data if needed to group the data by customer record. Please review these formatting guidelines and contact our team if you have any questions. 

You must have relevant experience and familiarity with AWS CloudFormation, AWS Marketplace and AWS Glue to ensure you fully understand how the InfoSum Beacon software interacts with your resources and runs within your AWS account once deployed.

AWS Setup

Each Beacon deployment is bound to one AWS Glue Database and one Cloud Vault.

• Each Cloud Vault can contain multiple published datasets in InfoSum 
• Each  Glue Database  can contain multiple tables and views

The region your Beacon is deployed into must map to the region you chose when creating your Cloudvault. We will cover this in the guide below.

You will also need to ensure that you have a Glue Database available that contains all your tables and views for collaboration. 

 If your tables are distributed across multiple Databases, you have two options:

1. Deploy two Beacons to two different CV: You will only be able to use the tables on these two Cloud Vaults independently, meaning you cannot publish a joint view of the data to the same Beacon. Please note there is a limit of 10 CVs per account. 
   1. This might be your preferred option if your data comes from different regions, teams, or departments/brands within your organization and cannot be co-located into the same Glue Database.
2. Replicate or move the table/view from one Database to the other: You will then be able to access all tables and views in one Cloud Vault and combine them to create a custom recordset to publish to one single Dataset.

Data formats supported

Currently only S3, Apache Iceberg, Delta Lake and Apache Hudi Glue Catalog tables are supported. Any other data sources will need to be exported to S3 and provided as S3 backed Glue Catalog tables.  You may see these unsupported table types in the InfoSum Cloud Vault UI, but you won’t be able to leverage them successfully.

Required Permissions

Avoid use of your AWS account root user for installation of Marketplace products.

The Beacon template builds the Beacon's environment from scratch (network, storage, database, compute, and the identities that run them), so the user installing the product requires broad permission to do this as a one-off operation. Once installed, all internal IAM resources used by the Beacon are locked down where possible, so that it may only interact with its own resources within its isolated network.

The user installing the Beacon must have access to the following managed policies: -

• https://docs.aws.amazon.com/aws-managed-policy/latest/reference/PowerUserAccess.html
• https://docs.aws.amazon.com/aws-managed-policy/latest/reference/IAMFullAccess.html

External Network Access

The InfoSum product needs outbound communication to the InfoSum platform, allowing you to perform queries and activate data with your Beacon

• AWS hosts (S3, KMS & MSK) API endpoints - Required for core Beacon functionality providing secure, cross-region support for coordination of your Beacon(s)
• Sentry - Application error reporting & performance monitoring to aid InfoSum in supporting you, should you run into any technical issues while operating your Beacon
• InfoSum address mapper (optional, only required if you wish to use the US address mapper)

(This step is optional) If you wish to activate data from your Beacon, you will need to provide details of the endpoints that are allowed. You do not need to do this if the activation takes place using your partner’s dataset or if you are only using an AWS Beacon S3 Destination. Please see this section for more information.

Beacon Deployment

There are two distinct tasks to create a AWS Beacon

1. Create a AWS Cloud Vault
2. Deploy the Beacon app/product and link to your Cloud Vault

1. Create a AWS Cloud Vault in InfoSum

The first thing you need to do is create a AWS Cloud Vault in InfoSum that is connected to your AWS account. The Cloud Vault won’t host any data; it will simply provide an interface to prepare your data for publishing to your AWS Beacons.

Log in to InfoSum, navigate to the data management section, and click on the Cloud Vault page. 

Then click on the ‘manage cloud vaults’ button on the top right-hand side, and then the ‘create new cloud vault’ button on that page. 

Then you will be asked to select your Cloud Vault provider where your Beacons will be hosted. IN this case please select AWS Cloud Vault

You will then be asked to give your Cloud Vault a name - this name will identify the data management space if you have multiple. 

You’ll also need to enter:

• Account Identifier: the Account ID of the AWS account you want to install the app in. Account identifier can be found in your AWS management console
• Amazon Region: Please select from the list the corresponding region that matches the AWS region you’ll be using for your Beacon installation

This will give you a license key that you will need to authenticate in the Beacons app/product.

Click on finish and connect Cloud Vault to complete this process.

2. Beacons Marketplace Product Deployment in AWS

Deploy InfoSum’s Beacons as a marketplace solution deployment into your AWS account. This will link your project with the virtual Cloud Vault on your InfoSum account to manage the collaboration operations.

As part of this process, you will point the InfoSum Product/App to the tables that you wish to use for collaboration. We recommend reviewing our formatting guidelines to ensure that your data can be easily normalised and published to a Beacon.

This process can be divided into two distinct phases: Launching the software and configuring the deployment.

Launching the software:

1. Find the InfoSum Beacons app/product in the AWS Marketplace (listing)
   
2. Click “View Purchase Options”:
   • If this is your first deployment, click the subscribe button at the bottom of the page and wait as per the notification
     • Subscribing to the app/product creates an agreement on the account. This doesn’t incur any cost directly, and it doesn’t install the product. It simply confirms that you would like to use this product. 
   • If this is not your first deployment, please click “Launch Your Software,” and this will start the install process for a new instance of the Beacons product.
3. Choose the latest version available in the Version dropdown box
4. Select the AWS account region you want to install the product/app in (must be the same as the one selected in the Cloud Vault creation stage)

Configuring the deployment:

1. Click “Launch with CloudFormation”. 
   
   CloudFormation is a service that helps you model and set up AWS resources.  InfoSum will provide a template describing all the AWS resources required and, via CloudFormation, present it to you for completion. More information about CloudFormation can be found here. 
   
   This process is really flexible in AWS, so please pay attention to the instructions below as the UI will show you multiple options.
    
2. Create stack - Please leave all the fields as preselected on this screen.
   1. Choose an existing template
   2. Amazon S3 URL, leaving the URL alone}
      Click Next

2. Specify stack details 
   1. Give your Stack a Name - this will be the name of the Beacons App/Product in your account
   2. InfoSum License Key: This is the Cloud Vault license key obtained from the InfoSum platform in the first step of the install process
   3. Glue Database Name: the name of the database where you want to deploy the app
   4. AMI configuration: Please DO NOT edit this field 
   5. Instance Configuration: -
      1. The recommended type is m7i.xlarge

      2. Certain AWS regions do not yet allow provisioning of m7i instances. For these cases, we enable use of m6i.xlarge instead, however it is your responsibility to choose the appropriate class, based on its support in the region you wish to use

         Refer to https://docs.aws.amazon.com/ec2/latest/instancetypes/ec2-instance-regions.html for further information on where m7i and m6i are supported 

3. Configure stack options - Please leave these options as default unless otherwise discussed with your InfoSum representative.
   Please check the acknowledgement at the bottom of the page.
   
    

4. Review and create - review the details and submit.

    

5. Stack deployment -  This will take several minutes. You can see the progress in the stack's events. It will have finished when the status changes to CREATE_COMPLETE.
    
6. Resource review - You may review all resources created by this Beacon deployment on the “Resources” tab under this Stack page.
    
7. You may also wish to confirm that your Beacon “Controller” instance has been successfully launched, and is passing status checks in the EC2 console:

You should now see that your AWS cloud vault on the InfoSum platform has a  "Healthy" status once the connection is established. Please allow for some time for this to complete.

Next step

Once the above steps have been completed successfully, you will find in your Cloud Vault a reference to any tables contained inside the database connected to the Beacons app and you will be able to complete the data preparation steps to start collaborating. 

Additional information

Setting up a Beacon for Destination Exports

Every Beacon install provisions an AWS Network Firewall in front of the subnet that hosts your Beacon instances. All outbound traffic is routed through this firewall before it can leave your AWS account.

By default, your Beacon’s outbound connectivity is restricted to the smallest possible set of networks and hosts required for the software to function. If you wish to export data to a third-party Destination using this Beacon, you must allow our software to communicate outside of the walls of your AWS account.

You don’t need to do this if you are only activating to a local Amazon Beacon S3 Destination. Please follow the instructions on this article to leverage this destination. 

The firewall is configured with a strict allowlist: anything not explicitly permitted is blocked. It is made up of two types of rule group:

• Baseline rule groups (managed by InfoSum): These cover the endpoints the Beacon software itself needs to reach to function. You must not edit these, otherwise it may impact the stability of your instance.
• User rule groups (managed by you). If you wish to push data to Destinations, this is where you will need to add your rules.

Adding Destinations to the Firewall Rule Groups

The rule group you need to edit depends on the type of destination you wish to activate to. 

<BeaconPrefix> is a portion of your Cloud Vault ID used as a prefix for various Beacon resources. For convenience, you can find this prefix, and links to the firewall groups in your Beacon CloudFormation stack outputs tab.

Beacon Prefix Output:

Direct links to your user-managed Firewall rule groups:

Edits you make here should be preserved across Beacon upgrades.

Step 1 - Open the rule group

• Sign in to the AWS Console in the same account and region where you installed the Beacon.
• Go to VPC → Network Firewall rule groups (under the “Network Firewall” section of the left-hand nav).
• In the filter, type your Beacon prefix + “-user”. You should see two rule groups whose names end in -user-domains and -user-cidrs.
• Alternatively, you can find a direct link to both your Domains and CIDRs rule groups in your Beacon Cloudformation Stack’s Output tab, as shown above
• Click the rule group that matches the type of destination you’re allowing (see the table above).

Step 2a - Add a domain (HTTP/HTTPS destinations only)

• Click on <BeaconPrefix>-user-domains, then click Edit under the Domains section..
• Under Domain list, click Add domain and enter the FQDN of the Destination, for example: 
  • api.example-destination.com - matches that exact hostname.
  •  .example-destination.com - leading dot acts as a wildcard, matching api.example-destination.com, www.example-destination.com, and any other subdomain
• The installation process will have added a placeholder domain name here. You may leave this in place, or remove it, as long as you retain at least one domain name in the rule group.
• The domain name you use here will vary depending on the type of destination you’re exporting to. Information on the networks used by a destination may need to be sourced from the service in question. E.g. Pubmatic would normally require you open up outbound connections to aud.pubmatic.com. If you’re unsure on what to use here, please contact InfoSum Support.
• Leave the Protocols set to HTTPS and HTTP and the Action as Allow.
• Click Save.

Traffic to the new destination should be permitted within a few seconds of saving. No Beacon restart is required.

Step 2b - Add a CIDR and port (SFTP or other non-HTTP destinations)

• In <BeaconPrefix>-user-cidrs, click Edit under the Rules section.
• Fill in the new rule details:

Protocol: TCP

Source: Any

Source port: Any

Destination: the IP range provided by the Destination service (e.g. 203.0.113.0/24, or 203.0.113.5/32 for a single host)

Destination port: the port (e.g. 22 for SFTP)

Action: Pass

• The IP(s) you allow here will often be servers under your management or administration. If you’re unsure on what to use here, please contact InfoSum Support.
• Click Add Rule, then verify that the rule is now listed in the Rules table at the bottom of the page. The network IP/range, port and pass rules should match, as shown in the screenshots below
• Click Save rule group

Traffic to the new IP(s) should be permitted within a few seconds of saving. No Beacon restart is required.

Verifying the change

Once saved, try triggering an export from the Cloud Vault to the newly-allowed endpoint by following the activation instructions for the relevant Destination. If the export succeeds, the firewall update succeeded. If it fails, you will need to check that: -

• The hostname or CIDR matches exactly what the Destination expects (some providers publish an IP range that must be allowed in full, or may comprise multiple IP ranges.
• Port 443 is set for HTTPS destinations, 80 for plain HTTP, or if you’re using a CIDR/IP rule, the port the SFTP/server listens on.
• The rule you added is in the correct rule group (domain vs. CIDR) depending on the type of traffic the Destination uses.

Upgrading your Beacon deployment

If you have received a notification that InfoSum have published a new version of the Beacon product, you can upgrade your installation following the below steps.

Firstly, you will need to locate the template URL For the new version of the Beacon product: -

• Navigate to your current Marketplace Subscription for InfoSum Beacons
• Click “Launch Cloudformation Stack”
• Make a note of the latest available version in the dropdown box. This will be the version you are going to update to. This is highlighted in the screenshot below.
• Choose this version in the dropdown box, then click “Launch with CloudFormation”
• Copy the URL contained within the “Amazon S3 URL” field on this page, as highlighted in the screenshots below. Make a note of this for the next step.

In the AWS console UI, navigate to CloudFormation Stacks and select the Stack that was created for your installation.

In the Update stack drop down, select “Make a direct update”.

1. Select “Replace existing template”. Paste in the URL you made a note of from the previous step and click Next.
2. You must update the “Controller AMI ID” parameter used for the update.
   • You will note the end of this parameter will contain the current version of your Beacon installation. e.g. if your Beacon was installed under version “2026-07.05”, the parameter will end with this version.
   • Replace the version with the version you are updating to. You will have made a note of this earlier in the process. E.g. As shown in the screenshot below, we are updating to version 2026-07.07. 
3. Everything else should be left the same.

Review and submit the update. This will recreate the resources necessary to update your Stack to the new version of the InfoSum Beacon product. This may take a number of minutes to complete.

If you encounter any errors during this process please reach out to your InfoSum representative.

Deleting your Beacon deployment

To delete your deployment you will need to remove all associated assets from both InfoSum and AWS infrastructure: 

1. Please start with the InfoSum platform:
   1. Delete all datasets belonging to the Cloud Vault
   2. Delete the Cloud Vault
2. Once completed, in the AWS UI: Delete the stack in the CloudFormation console

Troubleshooting

Cloud Vault does not become healthy

Symptom: The Cloud Vault associated with your Beacon App does not become healthy, even after waiting for an extended period (over 30 minutes)

Solution: -

• Confirm the license key you provided during installation  matches the one provided in the InfoSum platform interface for your Amazon CloudVault
• Confirm the glue database name you provided is correct, exists, and is located in the account and region you installed your Beacon into
• Otherwise, please contact your InfoSum representative or InfoSum Support via the details found below

Error encountered during Stack Install related to ControllerASG - CREATE_FAILED

Symptom: During deployment of the Cloudformation stack, the process reports an error for the ControllerASG resource citing “ The requested configuration is currently not supported.”

Solution: -

• It is likely the Beacon was provisioned to a region that does not support the instance type you chose during installation. See the section on “Instance configuration” above in the guide
• If you chose m7i.xlarge during install, try re-installing with m6i.xlarge instead. Or vice versa if you chose m6i.xlarge during installation

Error encountered during Stack install related to Quotas or Service Limits

Symptom: During deployment of the Cloudformation stack, the process reports an error related to AWS service limits, or quotas, along with a “CREATE_FAILED” or “ROLLBACK_COMPLETE” state reported under the “Resources” tab in the stack console.

Solution: -

• It is common to hit quota limits under an AWS account if you have default limits, or have deployed multiple Beacons into the same account
• In particular, the following quotas are susceptible to causing issues using the default values:
  • VPC -  VPCs per Region (default 5)
  • VPC - NAT gateways per Availability Zone (default 5)
  • EC2 - EC2-VPC Elastic IPs (default 5)
  • VPC - Network Firewalls (default 5)
• We recommend submitting a request via your AWS Service Quotas console to increase these limits regardless if you’re planning to install multiple Beacons into the same AWS account
• If the error you’ve received in Cloudformation is clearly unrelated to the above quotas, try submitting an increase for an appropriate quota
• If you encounter any issues identifying the cause, or require further support,  please contact your InfoSum representative or InfoSum Support via the details found below

The Beacon becomes unresponsive

Symptom: The Cloud Vault associated with your Beacon App becomes unresponsive and shows as unhealthy.

Solution: -

• Please contact your InfoSum representative or InfoSum Support via the details found below

For any other issue, please contact your InfoSum representative or InfoSum Support at: 

• Email: support@infosum.com 
• Support Request Form: https://support.infosum.com/hc/en-us/requests/new

And a member of our support staff will respond as soon as possible.

An update to your Beacon’s Cloudformation Stack Fails while Creating Changeset

Symptom: The update operation per the instructions above fails, referencing a ControllerAMI parameter constraint. The error is shown in the screenshot below:

Solution: -

• You will need to fix the ControllerAMI parameter used in your UI while creating the update to your Stack. By default, this parameter will be set to the one used for the existing version of your Beacon. 
• The suffix for this parameter should match the version you’re attempting to update to.
• For example, if you’re currently on version 2026-07.05, and the new version is 2026-07.07, you should update the parameter as shown below. Then attempt the update again.