anchor.diff:  
   From the left menu of the VPC Dashboard select *Subnets*. This shows a list of your subnets. By default AWS creates one subnet for each Availability Zone in your region. You may create your own subnets, as long as you give each a CIDR block representing a unique subset of your VPC, and assign each to a specific availability zone. 
   
  -
  -
  -
  -
  -
  -The CloudFormation template will also create individual security groups for the various components:
  -
  -* LB Security group: Opens ingress `9090`  and `80`, and everything for egress.
  -* KB Security group: Opens ingress `8080`, and everything for egress.
  -* RDS Security group: Opens ingress `3306`, and everything for egress.
  -
  -
  -**Pre-requisites:** The CloudFormation template will require the following:
  -
  -* A valid VPC
  -* A VPC Internet Gateway configured to access all the outside world
  -* Valid subnets for the VPC as described above
  -
  -**Example:** Given a VPC with a CIDR of `192.168.0.0/16`
  -
  -An example of a valid routing table for would be 
  -
  -|===
  -|Destination |Target
  -
  -|192.168.0.0/16
  -|local
  -
  -|0.0.0.0/0
  -|igw-08bbaa2909129b953
  -|===
  -
  -
  -Regarding the subnets, the following configuration would work:
  -
  -* Kill Bill server and KAUI server instances subnets: `192.168.64.0/18` (zone `1e`) and `192.168.192.0/18` (zone `1b`)
  -* RDS subnets: `192.168.128.0/18` (zone `1e`) and `192.168.0.0/18` (zone `1b`)
  -
  -== CloudWatch Integration
  +=== Setup a Key Pair
  +
  +The Kill Bill CloudFormation stack requires a key pair. The key pair provides the credentials you will need to login to your EC2 instances. If you already have a key pair, you are all set. Otherwise you will need to create one.
  +
  +To create a key pair, from the EC2 console scroll down to *Networks & Security / Key Pairs*. Select *Create Key Pair* and follow the instructions. For details about key pairs, see the https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html[AWS documentation]. Important: You *must* save the private key that will be generated in this step. If you lose this key, you will *not* be able to login to your instances.
  +
  +
  +=== Configure and Launch
  +
  +The setup process starts at the AWS Marketplace using our +++<a href="https://aws.amazon.com/marketplace/pp/prodview-nochv5omslmds?ref=_ptnr_doc_" onclick="getOutboundLink('https://aws.amazon.com/marketplace/pp/prodview-nochv5omslmds?ref=_ptnr_doc_'); return false;">official CloudFormation template.</a>+++ Go to this page, then click *Continue to Subscribe*.
  +
  +image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/img/aws/cf-subscribe.png[align=center]
  +
  +THe next page gives the AWS Terms and Conditions. You must accept these conditions if asked, then click *Continue to Configuration*. This will take you to the page titled *Configure This Software*:
  +
  +image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/img/aws/cf-configure.png[align=center]
  +
  +There is nothing to change on this page. Click *Continue to Launch*. THe next page is titled *Lauch this Software*. There is nothing to do here either. Click *Launch*.
  +
  +The next page is designated *Step 1: Specify Template* and titled *Create stack*:
  +
  +image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/img/aws/cf-step1.png[align=center]
  +
  +Once again everything is filled in for you. Click *Next*. This brings up the *Stack Details* page (your complete configuration is called a stack):
  +
  +image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/img/aws/cf-details.png[align=center]
  +
  +*Now* you have some work to do! This page requires that a number of configuration parameters be filled in. All of these are important, and many are critical.
  +
  +First, you need to provide a name for your stack. Any name will do, as long as it meets the stated rules. Then you will need to carefully set a series of parameters:
  +
  +* *DBClass:* the database instance type to use for RDS. This normally should not be changed.
  +* *DBName:* the database name for Kill Bill. This is preset to *killbill*. Do not change it.
  +* *DBUser:* database admin username. The username you choose for the database administrator.
  +* *DBPassword:* database admin password. The password you choose for the database administrator. This must include at least one letter, at least one digit, and no other character types.
  +* *EnableCloudWatchMetrics:* whether to enable metrics in CloudWatch. This is strongly recommended for production.
  +* *EnvType:* the purpose of this configuration: test, dev (development), or prod (production). There is no difference in the stack being created but this value will be sent to CloudWatch as a dimension.
  +* *HTTPLocation:* the IP address range allowed to access the load balancer, in the form of a CIDR block. You can use 0.0.0.0/0 initially and adjust access later on.
  +* *InstanceType:* the EC2 instance type to use for Kill Bill. This normally should not be changed.
  +* *KBAdminPassword:* the password to be used for the default `root` user which has all permissions. By default this is set to `password`. Please change it! The requirements are the same as for *DBPassword*.
  +* *KauiDBName:* database name for Kaui. This is preset to *Kaui*. Do not change it.
  +* *KauiServerCapacity:* the initial number of Kaui instances in the Auto Scaling group. We recommend using the default value, `2`.
  +* *KeyName:* name of an existing EC2 KeyPair to enable SSH access to the instances. If you don't have one, see XXXXX.
  +* *KillBillServerCapacity:* the initial number of Kill Bill instances in the Auto Scaling group. Again we recommend the default value of `2`.
  +* *RDSSubnets:* the subnets to use for the RDS instance. Select two or more from your subnets, which must be in two or more availability zones.
  +* *Subnets:* the subnets to use for the KB and KAUi instances. Also two or more from your subnets in two or more availability zones. May or may not be the same as the RDS subnets.
  +* *VpcId:* the VPC to use for the installation, which you identified earlier.
  +
  +When all of these are set, click *Next* to go to *Configure Stack Options*. Now take a break. There is nothing to do here. Then click *Next*.
  +
  +The final page gives you a chance to review. If everything seems OK, read and check any warnings at the bottom, then click *Create Stack*. you are off!
  +
  +image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/img/aws/cf-creating.png[align=center]
  +
  +If there are any errors, you will see a message and the Create will not begin. You will need to go back and fix the errors. Common errors may include using an invalid password form (which may gove a misleading message), or not choosing subnets in at least two availability zones.
  +
  +Otherwise, you will see that your stack is being created, and its status (shown in blue) will be *CREATE_IN_PROGRESS*. You may also check the *Resources* tab to see the many resources that are being created to make up the complete stack.
  +
  +If the create succeeds, the status will eventually change to CREATE_COMPLETE (shown in green). This may take a fairly long time.
  +
  +
  +
  +
  +== CloudWatch
   
   Our AMIs come pre-configured with CloudWatch integration to allow for better diagnostics. Below is a screenshot of the metrics that come for free:
   
  
positive.code: image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/img/aws/cloudwatch.png[align=center]
  
  
  In order to have business metrics, we also allow to install additional plugins suchs as our free https://github.com/killbill/killbill-analytics-plugin[Analytics plugin]. This provides a subscription billing management solution as feature-rich as popular SaaS platforms, but that you can control. Below is a screenshot of such business metrics:
  
  
  image:https://github.com/killbill/killbill-docs/raw/v3/userguide/assets/img/aws/analytics.png[align=center]
  
negative.code: 
  For installation support along the way, reach out to `support@killbill.io`.
  
  
  == Using HTTPS TO BE REVISED
  
  You can configure the load balancer to accept SSL connections.
  
  