AWS
Quick answer
On AWS, run IdentityIQ on EC2 or EKS with an RDS database behind an Application Load Balancer, using IAM and security groups for access.
Key takeaways
- Prerequisites for AWS
- Step-by-step install path
- Common pitfalls and fixes
- Verification after install
Deploying IdentityIQ on AWS typically means running the application on EC2 instances or an EKS cluster, backed by an Amazon RDS database, fronted by an Application Load Balancer, with credentials in Secrets Manager and access controlled by IAM and security groups. AWS provides the managed building blocks; your job is to wire them together following least privilege.
Reference architecture
- Compute: EC2 instances (or EKS pods) running Tomcat + the IdentityIQ WAR.
- Database: Amazon RDS (SQL Server or Oracle) for managed backups, patching and high availability.
- Load balancing: an Application Load Balancer distributing UI/REST traffic across nodes.
- Secrets: AWS Secrets Manager for database and integration credentials.
Step by step
- 1. Provision compute, EC2 or EKS, sized for your UI and task workloads.
- 2. Stand up RDS and run the IdentityIQ DDL to build the schema.
- 3. Configure the datasource to point at the RDS endpoint, pulling credentials from Secrets Manager.
- 4. Front with an ALB and health checks.
- 5. Lock down networking with security groups (least-open ports) and least-privilege IAM roles for the instances.
- 6. Deploy and verify the WAR, then run a test aggregation.
AWS best practice
- Use RDS Multi-AZ for database high availability.
- Store all secrets in Secrets Manager, never in config files or AMIs.
- Apply least-privilege IAM and tight security groups.
- Spread nodes across availability zones behind the ALB.
Common pitfalls
- Credentials in AMIs or config instead of Secrets Manager.
- Over-permissive security groups exposing the database.
- Single-AZ RDS undermining availability.
Want to learn this properly?
Our live, instructor-led SailPoint Training covers this hands-on, with real projects and a certification path.
Check your understanding
What are the prerequisites for AWS?
- A. The application and app-server logs, which usually point to database, Java or permission issues.
- B. Confirm the app server starts, the schema is present, and login works.
- C. A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
Show answer
C. A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
How do you verify the install?
- A. A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
- B. Confirm the app server starts, the schema is present, and login works.
- C. The application and app-server logs, which usually point to database, Java or permission issues.
Show answer
B. Confirm the app server starts, the schema is present, and login works.
Confirm the app server starts, the schema is present, and login works.
Where do you look first on failure?
- A. A supported Java runtime, a reachable database, and the IdentityIQ files with correct permissions.
- B. The application and app-server logs, which usually point to database, Java or permission issues.
- C. Confirm the app server starts, the schema is present, and login works.
Show answer
B. The application and app-server logs, which usually point to database, Java or permission issues.
The application and app-server logs, which usually point to database, Java or permission issues.