Cloud prerequisites for AWS and Azure
Before you provision cloud infrastructure for NBS 7, verify that your cloud environment, workstation tools, and network access meet the requirements on this page. These requirements apply to both AWS and Azure deployments. Where the two providers differ, each requirement lists the AWS and Azure equivalents.
Start with the Prerequisites for NBS 7 deployment, then verify the cloud requirements on this page.
On this page
- Cloud environment requirements
- Database and Windows Server requirements
- Management workstation setup
- Network access requirements
- Security requirements
- Next steps
Cloud environment requirements
Your cloud environment must meet the following requirements:
- An existing AWS account or Azure subscription that contains your NBS 6 instance.
- A configured Domain Name System (DNS) routing infrastructure.
- Permissions to create the following resources:
- AWS: security groups and AWS Identity and Access Management (IAM) roles
- Azure: Network Security Groups (NSGs) and Azure Role-Based Access Control (RBAC) role assignments
- Access to store Terraform state files in an S3 bucket (AWS) or a storage account (Azure).
Database and Windows Server requirements
Your existing NBS 6 environment provides the database server that NBS 7 reuses. Confirm that your existing server meets the following requirements. The compute, storage, and container resources for NBS 7 do not exist yet. Terraform creates them in Provision cloud environment.
| Software | Supported versions |
|---|---|
| NBS Classic | See Supported NBS versions |
| Microsoft Windows Server | Windows Server 2022 - preferred Windows Server 2025 |
| Microsoft SQL Server | SQL Server 2022 (16.x) - preferred SQL Server 2025 (17.x) |
Management workstation setup
To configure, deploy, and maintain NBS 7, you need a local workstation or a cloud-hosted shell such as AWS CloudShell or Azure Cloud Shell. Install the following tools on that workstation. The table lists the minimum supported version and the install instructions for each tool:
| Tool | Minimum version | Install |
|---|---|---|
| Cloud provider CLI | Latest AWS CLI or Azure CLI | AWS: AWS CLI; set up credentials with the AWS CLI credential configuration guide. Azure: Azure CLI, plus kubelogin, which kubectl requires for Azure authentication. |
| Terraform CLI | 1.15.6 | Terraform CLI |
| Helm CLI | 3.0 | Helm CLI |
| kubectl | 1.25 | kubectl |
| Docker | Latest | Docker |
Network access requirements
NBS 7 infrastructure and microservices are deployed into a new VPC (AWS) or VNet (Azure). The Terraform code in Provision cloud environment creates this network.
Confirm that network access is available from the NBS 7 components to the classic NBS 6 components, including the database server. The NBS 6 database must allow access from the NBS 7 VPC or VNet address space. Use a private route for this network access rather than a publicly accessible connection.
Security requirements
End-user authentication
NBS 7 supports end-user authentication by integrating with a standards-based Single Sign-On (SSO) system. It is designed to be deployed as a protected endpoint within your existing SSO ecosystem, and it can be configured to work with standards-compliant identity providers such as Okta and Active Directory.
This approach is similar to NBS 6, which does not authenticate users. Instead, NBS 6 delegates authentication to a security proxy that each STLT provides.
NBS 7 requires a working NBS 6 instance, so it assumes that a user authentication mechanism is already in place. NBS 7 works alongside the existing authentication mechanism. No additional steps are needed to authenticate users for NBS 7.
Next steps
- Complete the general Prerequisites if you have not already.
- Continue with Provision cloud environment.
- Contact nbs@cdc.gov if you have questions about AWS or Azure planning.