AWS Foundation Technical Review

Introduction

>INT-001>

Overview flexAIcloud

flexAIcloud - flexible Audio Infrastructure for Cloud is a software-defined platform that lets you seamlessly integrate audio processing, codecs, and metadata processors via licenses. flexAIcloud is a tailor-made audio solution for broadcast (radio, television, streaming and more) offering unmatched versatility and precision in audio functions and modification. Instead of conventional physical hardware, flexAIcloud can be operated as an instance in the AWS cloud, allowing sound engineers to access the console from any device with a modern browser.

Highlightend the features of flexAIcloud:

• run on AWS (tested, debugged and approved))

• Dolby® ED2 Encoder/Decoder

• Audio-over-IP: Livewire+, AES67, SMPTE ST2110-30

• Voice Over Mixer

• FM Conditioner

• Dolby® E Encoder/Decoder

• flexAI Automixer - STEREO, 5.1 SURROUND

• Program Processing Channel Strip - STEREO, 5.1 SURROUND

An overview and more details about the feature set visit https://junger-audio.com/en/products/flexai#flexai-software

Use Cases

Use cases for flexAIcloud include:

• Providing a virtual mixing console for a distributed remote workforce.

• Expanding existing studio capabilities and capacities.

• Creating temporary studio locations.

• Creating disaster recovery studios in the cloud.

• Facilitating remote broadcasts including sports and live event coverage.

• Allowing multiple users to share the same mixer simultaneously.

<INT-001<

Knowledge and Requirements

>PRQ-002>

Knowledge

Knowledge and experience in the following areas are necessary to complete the deployment process.

• AWS

  • Experience with AWS EC2

  • Knowledge in AWS VPC (including Security Groups, Elastic IPs, etc.)

  • AWS Route 53 (optionally used as DNS host)

  • Understanding standard AWS infrastructure and knowledge in best practices

• Networking

  • Understanding of basic network skills and common network terminology

• Operating System

  • Experience with Debian-based Linux distribution (such as Debian 12 Bookworm)

  • Usage of command line operation

<PRQ-002<

>PRQ-001>

>PRQ-003>

>INT-002>

Prerequisites and Requirements

To deploy, configure, and use flexAIcloud, the following services, software and solutions are required to meet the requirements. Optional and billable components or services are marked. >INT-004> Customers should plan two and a half hours (up to 150 minutes) for a typical installation. <INT-004< See the Deployment section for further configuration details.

>CST-001>

• AWS

  • AWS Account

  • VPC

    • Subnet (public)

    • Internet Gateway associated with the subnet

    • Security group with specific ports allowed

  • EC2

    • EC2 instance (c6i.xlarge instance or larger) - billable service

      • 8GB RAM

      • 4 vCPU

      • 32 GB Storage as gp3 storage type

      • Debian 12 Bookworm as OS and the flexAI Software from provided AMI

        • flexAIcloud license

    • Public IP address- billable service - or optional: an Elastic IP address - billable service

  • Transit Gateway - billable service

  • optional: Amazon Route 53 - billable service - or other DNS Manager

• optional: custom SSL certificate signed by public or company CA

• End User Device with modern browser

<CST-001<

<INT-002<

<PRQ-003<

<PRQ-001<

Deployment

>INT-003>

Basic Information

flexAIcloud is the cloud-based version of the innovative audio processing system, flexAI. A typical installation of  flexAIcloud is shown in the Architecture Diagram section.

Amazon Machine Images (AMIs) are used to create EC2 instances, which are then deployed in the customer's AWS account. These AMIs are provided at regular intervals. In order to use flexAIcloud with all its features, a valid licence is required. This licence will be sent to the customer's contact address. After importing, the licence is regularly checked by the flexAI license sub system against an instance of the cloud based License Server, which is available at https://wibu.cloud . For this purpose, the flexAIcloud instance requires a permanent internet connection. This internet connection is also required to access the flexAIcloud user interface. The IP address and Internet gateway are required for this Internet connection. The public IP address is randomly assigned from the AWS pool when the EC2 instance is started and is only available as long as the EC2 instance is running. If you prefer an IP address that is permanently assigned to your AWS account until you delete it, an Elastic IP address could be a reasonable option.

>SIZ-001>

The minimum AWS EC2 Instance type is the c6i.xlarge. Depending on the workload, it is recommended to use a larger EC2 instance type.

The following table shows the maximum capabilities of flexAI running on different EC2 instances. The numbers are standard TV audio processing channel strips including EQ, Dynamics, automatic Fail Over, Level Magic (Loudness Processing) and True Peak Limiter. It includes 1 ms stereo input and output streams per processing channel Strip, ST 2022-7 enabled.

<SIZ-001<

>DAS-001>

Currently, flexAIcloud can only be scaled vertically, which increases the systems performance by adding additional resources, such as CPUs or memory. Horizontal scaling by adding additional instances is not supported. For this reason, only one Availability Zone is necessary for the VPC to run flexAIcloud.

<DAS-001<

flexAIcloud is running in the customer’s AWS account. AWS is responsible for the security ‘of’ the cloud, the customer is responsible for the security ‘in’ the cloud. For details, check the AWS whitepaper on the shared responsibility model (https://docs.aws.amazon.com/whitepapers/latest/aws-risk-and-compliance/shared-responsibility-model.html).

Jünger Audio products, such as flexAIcloud, are distributed exclusively through the Telos Alliance sales partner. The Telos Alliance also provides the online step-by-step instructions and documentation, as well as support for flexAIcloud. (for more information see the Support section)

<INT-003<

>INT-005>

Supported AWS Regions and Amazon Machine Images (AMI)

Additional AWS regions will be added as needed.

<INT-005<

>INT-002>

Typical Deployment

>ARCH-001>

>ARCH-002>

>ARCH-003>

>ARCH-004>

Architecture Diagram

The following diagram shows the the used AWS Cloud service operating in the context of a typical deployment, with a cloud based License Server, including integration points, VPC and public subnet.

<ARCH-001<

<ARCH-002<

<ARCH-003<

<ARCH-004<

>DSEC-010>

AWS - VPC

Create VPC:

• Open the Amazon EC2 console under https://console.aws.amazon.com/vpc . Select the AWS Region where the AMI resides, see table above in section Deployment Requirements.

• In the navigation pane, choose Virtual private cloud > Your VPCs

• Create a new VPC

• Configure VPC with following recommendations:

  • Resources to create: VPC and more

  • Name tag: flexAI

  • IPv4 CDIR block:

    • Enter a IPv4 CIDR block, for example 10.0.0.0/24

  • IPv6 CIDR block: No IPv6 CIDR block

  • Number of Availability Zones (AZs): 1

  • Number of public subnets: 1

  • Number of private subnets: none

  • NAT gateways: none

  • VPC endpoints: none

  • Leave all the other configuration on their defaults

  • Click Create VPC

AWS - Security Groups

Create Security Group:

• Open the Amazon EC2 console under https://console.aws.amazon.com/ec2/ . Select the AWS Region where the AMI resides, see table above in section Deployment Requirements.

• In the navigation pane, choose Network & Security > Security Groups

• From the Security Groups dashboard click Create security group

• Security group name: flexai-public-sg

• Description: SSH Access and required TCP and UDP ports

• VPC: <flexAIcloud VPC you created in previous step>

• Inbound Rules:

  • Add Rule (to access the system via SSH):

    • Type: SSH

    • Protocol: TCP

    • Port: 22

    • Source: specific public IP(s) that require ssh access

    • Description: SSH Access

  • Add Rule (to access the flexAIcloud UI):

    • Type: HTTPS

    • Protocol: TCP

    • Port: 443

    • Source: Anywhere-IPv4, Anywhere-IPv6 or custom definition of specific public IP(s) that require HTTPS access

    • Description: HTTPS Access

  • Add Rule (optional):

    • Type: All ICMP - IPv4

    • Protocol: ICMP

    • Port: All

    • Source: Anywhere-IPv4, Anywhere-IPv6 or custom definition of specific public IP(s) that require HTTPS access

    • Description: ICMP Access

• Outbound Rules:

  • Add Rule (necessary connection of the flexAI license sub system to the cloud based License Server instance):

    • Type: HTTPS

    • Protocol: TCP

    • Port: 443

    • Destination: Anywhere-IPv4

    • Description: HTTPS Access IPv4

  • Add Rule (necessary connection of the flexAI license sub system to the cloud based License Server instance):

    • Type: HTTPS

    • Protocol: TCP

    • Port: 443

    • Destination: Anywhere-IPv6

    • Description: HTTPS Access IPv6

AWS - EC2

Create Key Pair:

SSH is used to connect to the flexAIcloud EC2 instance for maintenance purposes. SSH login with username and password is disabled on the EC2 instance. It is only possible to log in via SSH with public keys. To establish this connection, you will need the SSH keys. The SSH key pair is generated and stored by the customer through the AWS EC2 console. The public key is provided to AWS and automatically installed on the flexAIcloud EC2 instance (mapped to the Linux user named ‘admin’ by adding the public key to /home/admin/.ssh/authorized_keys) during the deployment process, while the private key is downloaded once during creation and must be securely managed by the customer. For details check https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html

• Open the Amazon EC2 console under https://console.aws.amazon.com/ec2/ . Select the AWS Region where the AMI resides, see table above in section Deployment Requirements.

• In the navigation pane, choose Network & Security > Key Pairs.

• Create a new keypair or upload an existing keypair

  • Create:

    • From the Key Pair dashboard click Create key pair

    • Name: enter key pair name

    • Key pair type: choose between RSA and ED25519

    • Private key pair file format: choose between .pem and .ppk

    • Tag: add optional tag

  • Import:

    • From the Key Pair dashboard click Actions > Import key pair

    • Import an existing RSA or ED25519 key pair file

Create EC2 Instance from AMI:

• Open the Amazon EC2 console under https://console.aws.amazon.com/ec2/ . Select the AWS Region where the AMI resides, see table above in section Deployment Requirements.

• In the navigation pane, choose Image > AMIs.

• Select the target Private Images, search for the AMI ID, and then select the AMI.

  • To filter results, use the filter search bar to enter the AMI ID from the values above.

• Choose Launch instance from AMI.

• Under Names and tags enter a name for the instance, like flexAIcloud

• Under Instance type, choose instance type c6i.xlarge

• Under Key pair (login), for Key pair name, choose a key pair created above

• Under Network settings, choose Edit, and then select your virtual private cloud (VPC), public subnet, and security group you created above. Set Auto-assign public IP to enable

• Under Configure storage, configure one 32 GiB and gp3 as root volume.

• (Optional) Under Advanced details, choose options such as IAM instance profile to attach an AWS Identity and Access Management (IAM) role to the instance.

• Under Summary, choose Launch instance.

• To check the status of your instance, choose Instances in the navigation bar. Or, select the instance ID.

Internet Gateway

Create Internet Gateway:

• Open the Amazon VPC console at https://console.aws.amazon.com/vpc/

• In the navigation pane, choose Internet gateways

• Choose Create internet gateway

• (Optional) Enter a name for your internet gateway

• (Optional) To add a tag, choose Add new tag and enter the tag key and value

• Choose Create internet gateway

• (Optional) To attach the internet gateway to a VPC now, choose Attach to a VPC from the banner at the top of the screen, select an available VPC, and then choose Attach internet gateway. Otherwise attach the internet gateway to a VPC described in the next section.

Attach Internet Gateway to VPC:

• Open the Amazon VPC console at https://console.aws.amazon.com/vpc/

• In the navigation pane, choose Internet gateways

• Select the check box for the internet gateway

• To attach it, choose Actions, Attach to VPC, select an available VPC, and choose Attach internet gateway

Configure subnet route table:

• Open the Amazon VPC console at https://console.aws.amazon.com/vpc/

• In the navigation pane, choose Route tables

• Select the route table for the subnet. By default, a subnet uses the main route table for the VPC. Alternatively, you can create a route table and then associate the subnet with the new route table

• On the Routes tab, choose Edit routes and then choose Add route

• Enter 0.0.0.0/0 for Destination and select the Internet Gateway for Target

• Choose Save changes.

<DSEC-010<

Transit Gateway

The Transit Gateway is needed when using flexAIcloud with an audio multicast stream.

AWS supports sending audio multicast streams between compute resources by way of a Transit Gateway. This deployment guide assumes that you already have audio multicast streams in your AWS infrastructure under a multicast-enabled Transit Gateway.

If you have not configured a transit gateway, please start by reading AWS Transit Gateway Documentation (https://docs.aws.amazon.com/vpc/latest/tgw/create-tgw.html). We also highly recommend reviewing the section covering Multicast on transit gateways.

Follow AWS step-by-step documentation on integrating external multicast services with AWS to attach your transit gateway to the VPC you created in a previous section. Below is an overview of the required steps outlined in Amazon documentation.

• Create transit gateway with multicast support enabled

• Create transit gateway attachment - mapping it to the VPC you created in a previous section

• Create transit gateway multicast domain

• Create multicast domain associations

Amazon Route 53

If you want to use your custom domain (e.g. domain.com) to access the flexAIcloud instance via the subdomain (e.g. flexai.domain.com) instead of the IP address, you can optionally use Amazon Route 53 as your DNS manager.

To configure Amazon Route 53 follow the AWS documentation

• Register a new domain - https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/registrar.html

• Create a public hosted zone - https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/AboutHZWorkingWith.html

• Create the subdomain with an A record for the flexAIcloud instance - https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/rrsets-working-with.html

Using flexAI

Connect to the user interface of flexAIcloud by entering the URL below in a web browser, replacing flexai.domain.com with the domain you assigned to the flexAIcloud instance.

During installation, flexAIcloud creates a self-signed SSL certificate for the HTTPS connection. The first time you connect via HTTPS, your browser will display a warning about the self-signed SSL certificate. You can ignore this warning and continue to open the flexAIcloud UI. It is recommended that you apply a custom SSL certificate signed by a public or company CA, as described in section SSL. With a valid custom SSL certificate signed by a public or company CA, no warnings related to self-signed SSL will be shown in your browser.

You should see the flexAIcloud user interface appear in your browser, indicating that the server and certificate are set up correctly.

<INT-002<

License

>CST-002>

Cost Model and Licenses Costs

flexAIcloud provides a flexible cost model based on its scalability by licenses. It consists of a base license, the flexAI core, which allows flexAIcloud to run and offers basic features in terms of control.

To allow any audio processing, the license flexAI engine is mandatory and allows for simple audio processing, such as audio switching and format detector. Any additional use-case specific audio processing can be purchased separately according to the specific needs, such as “Audio Processing Channel Strips” and Codec Encoders and Decoders. At any time, processing capabilities can be upgraded by purchasing additional licenses.

<CST-002<

>RM-003>

Add / Renew License

Additional to the information under https://docs.telosalliance.com/docs/flexai-licensing the license file will be send digitally to the customers contact after purchase.

To upload the new license open the flexAI UI, go to Licensing page (1), choose “UPLOAD LICENSE UPDATE FILE” (2) and select or drag & drop the provided *.wbc file (3) and start the upload.

<RM-003<

Support

>SUP-001>

Contacting Customer Support

To receive support for flexAIcloud visit https://www.telosalliance.com/support and fill out the the web-based support request form.

At the support page you find additional information on warranty, product registration, the download center and a searchable self-help knowledge base (including FAWs, videos, release notes and more).

<SUP-001<

>SUP-002>

>SUP-003>

SLA and Support Tiers

The differences about the basic and enhanced support tiers see the program guide for TelosCare PLUS for details under https://success.telosalliance.com/teloscareplus .

<SUP-003<

<SUP-002<

Maintenance and Configuration

SSL

https://docs.telosalliance.com/docs/certificates

By default flexAIcloud provides a self-created and self-signed SSL certificate. For productive usage, a SSL certificate signed by a public, accepted certificate authority is recommended.

To upload a new SSL certificate open the flexAI UI, go to Certificates (1), choose “IMPORT FILE(S)” (2) and select or drag & drop the new SSL certificate and start the upload.

Rotate the SSL certificate before the current one expires to ensure that you have a valid SSL certificate while opening the flexAI UI.

AWS

>RM-004>

Monitor the AWS service quotas (https://docs.aws.amazon.com/awssupport/latest/user/service-limits.html), too and If you expect to exceed a service limit, request an increase directly.

<RM-004<

>DSEC-009>

flexAIcloud does not use the Amazon Simple Storage Service (Amazon S3) server-side encryption, Amazon Elastic Block Store (Amazon EBS) encryption, Linux Unified Key Setup (LUKS)) or other data encryption.

<DSEC-009<

>DSEC-007>

No  secrets or credentials are used or stored in the AWS Secrets Manager.

<DSEC-007<

>DSEC-004>

flexAIcloud do not use any public resources like Amazon S3 buckets.

<DSEC-004<

>DSEC-011>

The Instance Metadata Service is not used by flexAIcloud, so Instance Metadata Service Version 1 (IMDSv1) can be disabled.

<DSEC-011<

>DSEC-008>

flexAIcloud does not store sensitive data; it only processes audio data in real time.

<DSEC-008<

>DSEC-006>

>RM-001>

Except for SSL and SSH no other system credentials or cryptographic keys are used. To rotate SSL or SSH keys check the SSL section or the Key Pairs section.

<RM-001<

<DSEC-006<

>DSEC-002>

Account

To minimize the risk of misconfigurations or security concerns all configurations in the AWS console should be done with member accounts with only necessary permissions. Do not use an AWS account with root privileges.

<DSEC-002<

>DSEC-003>

>DSEC-005>

IAM Roles

The AWS user or the IAM role should have the suffizient permissions to configure and deploy the following resources in the specific region and AZ:

• VPC - create and manage VPC and VPC related configurations

• EC2 - create and manage EC2 and EC2 related configurations

• Key Pairs - create and manage key pairs

<DSEC-003<

<DSEC-005<

>BAR-001>

Backup and Restore

To Backup and Restore use the documentation under https://docs.telosalliance.com/docs/backup-restore

<BAR-001<

>EMER-002>

Desaster Recovery

Disaster recovery involves restoring the system to a usable state after the application or the entire system is no longer available.

Depending on the state of the system, it is advisable to first back up the current state and restore a backup state that is still functioning. If the system no longer starts, the corresponding EC2 instance can be recreated and set up using the documentation. A functioning backup is then restored.

For details in the Backup and Restore process check the documentation under https://docs.telosalliance.com/docs/backup-restore

<EMER-002<

>RM-002>

Update/Upgrade

To update the already running system please use this update/upgrade documentation under https://docs.telosalliance.com/docs/update .

<RM-002<

>EMER-001>

Fault Conditions

To identify a system error, the first step is to check the system status and correct the corresponding errors, see details under https://docs.telosalliance.com/docs/info .

If you encounter problems with the audio stream check the audio source and the multicast streams.

<EMER-001<

>DAS-004>

>HLCH-001>

Testing and Troubleshooting

flexAIcloud offers a comprehensive System Status, allowing for detailed information on the system’s health status, showing the causes for Warnings and Errors .

A system Logging shows detailed information and all events happening on the system. It also allows for filtering for the severity and for the Apps causing the log entries. Additional information are available under https://docs.telosalliance.com/docs/info

For troubleshooting the Audio Interfaces, each Audio over IP receiver features a status of the respective stream. It helps finding causes for issues such as, for example, synchronization offsets or late or lost packages.

For advanced troubleshooting, flexAIcloud can create a diagnostics file which can be opened by the service and support team, containing the status, full configuration and logs of the current system.

<DAS-004<

<HLCH-001<