Prepare your environment

This page walks you through setting up your system before you install the Access Decision Service (ADS).

Set up the Axiomatics AWS CLI account

ADS artifacts are distributed through Amazon S3 via the AWS CLI. If you have not installed the AWS CLI yet:

1. Follow the AWS CLI Installation GuideOpens in a new tab.
2. Run aws configure and enter the Access key ID and Secret access key that Axiomatics provided. See the AWS quick configuration guideOpens in a new tab for details.

Download the installation files

Once your AWS CLI account is ready, download the ADS installation files. ADS is a Java application that you can deploy in two ways:

• JAR: a single .jar file containing everything needed for a JAR-based deployment.
• Kubernetes: a .zip distribution file with a preconfigured Helm chart and supporting files.

Run the command that matches your deployment target:

• JAR
• Kubernetes

aws s3api get-object \
  --bucket axiomatics-customer-artifacts \
  --key releases/com/axiomatics/access-decision-service/26.2.1/access-decision-service-26.2.1.jar \
  access-decision-service-26.2.1.jar

This command saves the .jar file to your current directory.

aws s3api get-object \
  --bucket axiomatics-customer-artifacts \
  --key releases/com/axiomatics/access-decision-service/26.2.1-0/access-decision-service-26.2.1-0.zip \
  access-decision-service-26.2.1-0.zip

Extract the .zip file to the directory from which you plan to run ADS.

Verify the image signature (Kubernetes only)

ADS Kubernetes images are signed using Sigstore CosignOpens in a new tab. Follow these steps to verify the integrity and authenticity of the downloaded image:

1. Download and install Cosign from the official GitHub repositoryOpens in a new tab.

2. Request the public key (*.pub) from Axiomatics Customer SupportOpens in a new tab.

3. Log in to the Axiomatics Amazon ECR (Elastic Container Registry):

   aws ecr get-login-password --region eu-central-1 | \
     docker login --username AWS --password-stdin \
     748131003707.dkr.ecr.eu-central-1.amazonaws.com

4. Verify the image signature, replacing <public_key_filename> and <hash> with the values from Axiomatics:

   caution

   Replace <public_key_filename> and <hash> before you run this command.

   cosign verify --key <public_key_filename>.pub \
     748131003707.dkr.ecr.eu-central-1.amazonaws.com/axiomatics/access-decision-service/@sha256:<hash>

5. Cosign prints output similar to the following when verification succeeds:

   Verification for ...@sha256:... --
   The following checks were performed on each of these signatures:
     - The cosign claims were validated
     - Verified OK

Next steps

• Quickstart: JAR deployment: run ADS from the JAR file in under 10 minutes
• Quickstart: Kubernetes deployment: deploy ADS on Kubernetes with Helm in under 10 minutes