Quickstart

This walkthrough takes a new organization from signup to a deployed Secure Bucket with an exported evidence package. Plan for about fifteen minutes, most of it waiting for the apply.

You need an AWS account where you can create IAM roles (the CloudFormation stack needs CAPABILITY_NAMED_IAM) and an email address for the first user. The first user of an organization is an Organization Admin.

1. Sign up and create a tenant

1. Sign up with email and password, name your organization, and create its first tenant. A tenant is one client or one environment.
2. You land at organization scope. Use the scope switcher in the top bar to enter the tenant.

2. Register and connect the AWS account

1. Open Accounts and select Add AWS account. Give it a name and the 12-digit AWS account ID.
2. Select Connect on the account’s row. Confirm the region and choose whether to include billing data (read-only Cost Explorer access for the Billing report), then select Create connection.
3. Launch the CloudFormation quick-create link. It opens the AWS console with the stack prefilled: two scoped IAM roles (read-only discovery, scoped deployment) plus the evidence and state buckets. Create the stack.
4. Back in StackTakt, select Validate connection. Five checks run; each reports passed or failed with the fix. The connection turns Healthy when every check passes.

If validation fails, the ledger names the failing check. Fix it (usually the stack has not finished creating) and validate again. Details are in Connect your AWS account.

3. Run discovery

1. From the connection’s success screen, select Run discovery (also reachable under Assets).
2. Discovery inventories the account: IAM roles and users, VPCs, subnets, security groups, S3 buckets, Transfer Family servers, RDS instances, and DynamoDB tables. It runs on demand, finishes in the request, and writes the snapshot the Assets section shows.

4. Deploy the Secure Bucket

1. Open Blueprints and select Deploy on the Secure Bucket card.
2. Pick a data classification, enter a bucket label, and optionally set a noncurrent-version expiry. Select Create deployment plan.
3. StackTakt queues an OpenTofu plan. Nothing is created in AWS until you approve. When the plan lands, the deployment page lists every resource with its action.
4. Review the planned resources, then select Approve & apply and confirm. The apply runs server-side and takes a few minutes; the page updates as it settles.

If the plan or apply fails, the OpenTofu logs on the deployment page carry the error. A failed apply preserves state; you can destroy the deployment to remove anything the failed run created.

5. Export the evidence package

1. When the deployment reads Applied, open View evidence.
2. Evidence was captured automatically at apply: one named read-only AWS call per resource configuration, each tied to the HIPAA Security Rule citations it demonstrates.
3. Select Download PDF for the auditor-facing export. The package states what the infrastructure demonstrates; it does not assert a compliance status.

Where to go next

• Deploy a blueprint for the full deploy lifecycle, including revise and destroy.
• How control mapping works for what the compliance view is telling you.