Getting Started

Prerequisites

An AWS account with console access. No special setup, no CDK bootstrap, no pre-existing infrastructure. STELR's template uses BootstraplessSynthesizer — the only thing the deploying IAM principal needs is permission to create the resources the stack touches (KMS, Lambda, DynamoDB, S3, Step Functions, API Gateway, EventBridge, SQS, SNS, IAM roles). If your account enforces permission boundaries, see the required IAM policy.

Subscribe on AWS Marketplace

Go to the STELR listing and click Continue to Subscribe. Accept the terms. Marketplace triggers automatic provisioning on STELR's side — no separate form or signup.

Pre-flight: create two SSM parameters

Do this before deploying the stack

The stack deploys a Lambda (stelr-key-registrar-customer) that you invoke once after deployment. It reads these two SSM parameters to register your signing key with STELR's registry and seed your API credentials into your stack's DynamoDB table. Create them in the same region you'll deploy to — both values are in the onboarding email from Step 2.

# Registry JWT — authenticates the key registration with STELR
aws ssm put-parameter \
  --name /stelr/registry/attestation-token \
  --value "<Registry JWT from your STELR onboarding email>" \
  --type SecureString \
  --region us-east-1 \
  --profile <YOUR-AWS-PROFILE>

# API key — used in the X-API-Key header on every call
aws ssm put-parameter \
  --name /stelr/api-key \
  --value "<API key from your STELR onboarding email>" \
  --type SecureString \
  --region us-east-1 \
  --profile <YOUR-AWS-PROFILE>

Launch the CloudFormation stack

From the STELR listing on AWS Marketplace, click Launch. The deployment form shows one field under STELR Configuration: STELR Customer ID (from onboarding email). Paste the UUID from your email. That is the only value you supply.

Click Launch CloudFormation. The stack deploys approximately 96 resources — all inside your own AWS account. Nothing is created in STELR's account.

{
  "Version": "2012-10-17",
  "Statement": [
    { "Sid": "CloudFormation", "Effect": "Allow",
      "Action": ["cloudformation:CreateStack","cloudformation:DeleteStack",
        "cloudformation:DescribeStacks","cloudformation:DescribeStackEvents",
        "cloudformation:DescribeStackResource","cloudformation:DescribeStackResources",
        "cloudformation:GetTemplate","cloudformation:ValidateTemplate",
        "cloudformation:UpdateStack"],
      "Resource": "*" },
    { "Sid": "IAM", "Effect": "Allow",
      "Action": ["iam:CreateRole","iam:DeleteRole","iam:GetRole",
        "iam:PutRolePolicy","iam:DeleteRolePolicy","iam:GetRolePolicy",
        "iam:AttachRolePolicy","iam:DetachRolePolicy",
        "iam:ListAttachedRolePolicies","iam:ListRolePolicies","iam:PassRole",
        "iam:CreatePolicy","iam:DeletePolicy","iam:GetPolicy",
        "iam:CreatePolicyVersion","iam:DeletePolicyVersion","iam:ListPolicyVersions",
        "iam:TagRole","iam:UntagRole","iam:TagPolicy","iam:UntagPolicy"],
      "Resource": "*" },
    { "Sid": "KMS", "Effect": "Allow",
      "Action": ["kms:CreateKey","kms:DescribeKey","kms:GetKeyPolicy","kms:PutKeyPolicy",
        "kms:EnableKeyRotation","kms:GetKeyRotationStatus",
        "kms:ScheduleKeyDeletion","kms:CancelKeyDeletion",
        "kms:CreateAlias","kms:DeleteAlias","kms:UpdateAlias","kms:ListAliases",
        "kms:TagResource","kms:UntagResource","kms:ListResourceTags"],
      "Resource": "*" },
    { "Sid": "S3", "Effect": "Allow",
      "Action": ["s3:CreateBucket","s3:DeleteBucket","s3:GetBucketLocation",
        "s3:PutBucketPolicy","s3:GetBucketPolicy","s3:DeleteBucketPolicy",
        "s3:PutBucketVersioning","s3:GetBucketVersioning",
        "s3:PutEncryptionConfiguration","s3:GetEncryptionConfiguration",
        "s3:PutObjectLockConfiguration","s3:GetObjectLockConfiguration",
        "s3:PutLifecycleConfiguration","s3:GetLifecycleConfiguration",
        "s3:PutBucketPublicAccessBlock","s3:GetBucketPublicAccessBlock",
        "s3:PutBucketTagging","s3:GetObject"],
      "Resource": "*" },
    { "Sid": "DynamoDB", "Effect": "Allow",
      "Action": ["dynamodb:CreateTable","dynamodb:DeleteTable",
        "dynamodb:DescribeTable","dynamodb:UpdateTable",
        "dynamodb:UpdateTimeToLive","dynamodb:DescribeTimeToLive",
        "dynamodb:DescribeContinuousBackups","dynamodb:UpdateContinuousBackups",
        "dynamodb:TagResource","dynamodb:UntagResource"],
      "Resource": "*" },
    { "Sid": "Lambda", "Effect": "Allow",
      "Action": ["lambda:CreateFunction","lambda:DeleteFunction",
        "lambda:GetFunction","lambda:GetFunctionConfiguration",
        "lambda:UpdateFunctionCode","lambda:UpdateFunctionConfiguration",
        "lambda:AddPermission","lambda:RemovePermission",
        "lambda:CreateEventSourceMapping","lambda:DeleteEventSourceMapping",
        "lambda:GetEventSourceMapping","lambda:UpdateEventSourceMapping",
        "lambda:PublishLayerVersion","lambda:DeleteLayerVersion",
        "lambda:GetLayerVersion","lambda:AddLayerVersionPermission",
        "lambda:RemoveLayerVersionPermission",
        "lambda:TagResource","lambda:UntagResource"],
      "Resource": "*" },
    { "Sid": "StepFunctions", "Effect": "Allow",
      "Action": ["states:CreateStateMachine","states:DeleteStateMachine",
        "states:DescribeStateMachine","states:UpdateStateMachine",
        "states:TagResource","states:UntagResource"],
      "Resource": "*" },
    { "Sid": "ApiGateway", "Effect": "Allow",
      "Action": ["apigateway:POST","apigateway:GET","apigateway:PUT",
        "apigateway:DELETE","apigateway:PATCH"],
      "Resource": "*" },
    { "Sid": "EventBridgeSNSSQS", "Effect": "Allow",
      "Action": ["events:CreateEventBus","events:DeleteEventBus","events:DescribeEventBus",
        "events:PutRule","events:DeleteRule","events:DescribeRule",
        "events:PutTargets","events:RemoveTargets","events:ListTargetsByRule",
        "events:TagResource","events:UntagResource",
        "sns:CreateTopic","sns:DeleteTopic","sns:GetTopicAttributes",
        "sns:SetTopicAttributes","sns:AddPermission","sns:RemovePermission",
        "sns:TagResource","sns:UntagResource",
        "sqs:CreateQueue","sqs:DeleteQueue","sqs:GetQueueUrl",
        "sqs:GetQueueAttributes","sqs:SetQueueAttributes",
        "sqs:TagQueue","sqs:UntagQueue"],
      "Resource": "*" },
    { "Sid": "CloudWatchLogs", "Effect": "Allow",
      "Action": ["logs:CreateLogGroup","logs:DeleteLogGroup",
        "logs:PutRetentionPolicy","logs:DescribeLogGroups",
        "logs:TagLogGroup","logs:UntagLogGroup",
        "logs:CreateLogDelivery","logs:DeleteLogDelivery",
        "logs:PutResourcePolicy","logs:DescribeResourcePolicies"],
      "Resource": "*" }
  ]
}

Find your endpoint — CloudFormation Outputs tab

After CREATE_COMPLETE, open the stack in the CloudFormation console and click the Outputs tab. Your stack produces eight outputs:

Copy the ApiEndpoint value — you'll use it in Step 7.

Register your signing key

Manual step — required once

The stack deploys the key registrar Lambda but does not invoke it automatically. Run this once after the stack reaches CREATE_COMPLETE. It retrieves your KMS public key, registers it with STELR's registry, and seeds your API key into your stack's DynamoDB table.

aws lambda invoke \
  --function-name stelr-key-registrar-customer \
  --region <YOUR-DEPLOYMENT-REGION> \
  --profile <YOUR-AWS-PROFILE> \
  response.json

{"StatusCode": 200, "FunctionError": "Unhandled", "ExecutedVersion": "$LATEST"}

aws logs filter-log-events \
  --log-group-name /aws/lambda/stelr-key-registrar-customer \
  --filter-pattern "key_registered" \
  --region <YOUR-DEPLOYMENT-REGION> \
  --profile <YOUR-AWS-PROFILE> | jq '.events[].message | fromjson | {message, key_id}'

Prove it works — sign a generation, then verify it

Set two variables from your CloudFormation Outputs. The ApiEndpoint value includes a trailing slash — the ${STELR_API%/} syntax strips it.

# From CloudFormation Outputs tab
STELR_API="https://<YOUR-API-ID>.execute-api.<REGION>.amazonaws.com/customer"
STELR_KEY="<YOUR-API-KEY>"

POST /generate — invoke Bedrock and sign the output

RESPONSE=$(curl -s -X POST "${STELR_API%/}/generate" \
  -H "X-API-Key: $STELR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"prompt": "Reply in one sentence confirming STELR is running.", "max_tokens": 64}')

echo "$RESPONSE" | jq '{content_id, output, signature_id, signed_at}'

HTTP 201 — successful response shape:

{
  "content_id":   "f4a91b2c-3d5e-4f78-9a01-b2c3d4e5f678",
  "output":       "STELR is running and your AI output has been cryptographically signed.",
  "model_id":     "us.anthropic.claude-haiku-4-5-20251001-v1:0",
  "provider":     "bedrock",
  "signature_id": "f4a91b2c-3d5e-4f78-9a01-b2c3d4e5f678",
  "signature":    "eyJhbGciOiJSUzI1NiJ9...",
  "output_hash":  "a3b4c5d6e7f8...",
  "signed_at":    "2026-09-30T14:23:11.042Z",
  "s3_key":       "tenant/f4a91b2c.../ledger.json",
  "chain_position": 1,
  "correlation_id": "c1d2e3f4-..."
}

content_id and signature_id are the same UUID for synchronous generation — use either to verify.

POST /verify/{content_id} — verify the signature against the output

# Extract the values from the generate response
CONTENT_ID=$(echo "$RESPONSE" | jq -r .signature_id)

curl -s -X POST "${STELR_API%/}/verify/$CONTENT_ID" \
  -H "X-API-Key: $STELR_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"content\": $(echo "$RESPONSE" | jq '.output')}" \
  | jq '{valid, found, tampered, signed_at, verified_at}'

HTTP 200 — successful verification:

{
  "valid":       true,
  "found":       true,
  "tampered":    false,
  "signed_at":   "2026-09-30T14:23:11.042Z",
  "verified_at": "2026-09-30T14:23:17.389Z"
}

Full API surface