Required AWS Services

This page catalogs every AWS service required for an AosCloud deployment. Use it to prepare your AWS account, request service quota increases, and understand which services are mandatory versus optional before beginning infrastructure provisioning.

Service Catalog

The following table lists every AWS service required for an AosCloud deployment. Services are grouped by function and marked as mandatory or optional.

Service	Purpose	Status	Category
Amazon EKS	Managed Kubernetes cluster with node groups	Mandatory	Compute
EC2 (Node Groups)	EKS worker nodes (managed via EKS launch templates)	Mandatory	Compute
Amazon VPC	Single-VPC network isolation for all resources	Mandatory	Networking
VPC Subnets	Subnet layout across availability zones	Mandatory	Networking
VPC Endpoints	Private connectivity to AWS services (12 endpoints)	Mandatory	Networking
Security Groups	Network access control between resource tiers	Mandatory	Networking
Subnet Groups	Grouped subnets for managed database services	Mandatory	Networking
Amazon CloudFront	CDN for S3-hosted Deployable Items and static assets	Mandatory	Networking
AWS WAFv2	Web application firewall for CloudFront (IP reputation, common rules, bad inputs)	Mandatory	Networking
Application Load Balancer	Public ingress to EKS via AWS Load Balancer Controller	Mandatory	Networking
Aurora PostgreSQL	Primary relational data store (cluster mode)	Mandatory	Database
Amazon DocumentDB	MongoDB-compatible alert data storage	Mandatory	Database
Amazon ElastiCache (Redis)	Caching, session management, and pub/sub messaging	Mandatory	Database
Amazon S3	Aos artifact storage, logs, backups, Helm charts	Mandatory	Storage
Amazon EFS	Persistent storage for InfluxDB metrics (mounted into EKS pods)	Mandatory	Storage
Amazon ECR	Container registry for all microservice images and external dependencies	Mandatory	Storage
AWS KMS	Customer-managed encryption keys for data at rest	Mandatory	Security
AWS Secrets Manager	Application credentials, certificates, and configuration	Mandatory	Security
IAM Roles	EKS Pod Identity or IRSA service accounts, admin roles	Mandatory	Security
AWS Backup	Daily backup vault for S3, DocumentDB, PostgreSQL, EBS volumes	Mandatory	Security
Amazon SES	Transactional email (registration, sign-in links, notifications)	Mandatory	Messaging
Amazon CloudWatch Logs	EKS container insights, FluentBit log forwarding	Mandatory	Monitoring
AWS CloudTrail	API audit logging for S3 and ECR calls	Optional	Monitoring
AWS Resource Groups	Logical grouping of tagged resources for management	Mandatory	Management

Compute

Amazon EKS

The core compute platform. A managed Kubernetes cluster runs all AosCloud microservices as containerized workloads.

• Node groups: Managed node groups with configurable instance types and auto-scaling
• Addons: EBS CSI driver, CoreDNS, kube-proxy, VPC CNI (deployed as EKS-managed addons)
• Pod Identity / IRSA: EKS Pod Identity (modern) or IRSA via OIDC provider (legacy) grants pods access to AWS services through IAM role associations
• Launch template: Custom launch template with 50 GB EBS volumes

Networking

VPC Architecture

AosCloud deploys into a single VPC with a default CIDR of 10.231.0.0/16. The VPC hosts all compute, database, and storage resources.

• Key resources: Internet gateway, default route table, default security group, default network ACL

VPC Endpoints (Private Link)

Twelve VPC endpoints provide private connectivity to AWS services without traversing the public internet:

Endpoint	Service
EC2	Instance metadata and management
ECR API	Container registry API calls
ECR DKR	Container image pull (Docker)
CloudWatch Logs	Log forwarding
STS	Security token service (IRSA)
Elastic Load Balancing	Load balancer management
Auto Scaling	Node group scaling
Secrets Manager	Secret retrieval
RDS	Database management
S3	Object storage (gateway endpoint)
ElastiCache	Redis cluster management
SES SMTP	Email sending

CloudFront + WAFv2

A CloudFront distribution serves S3-hosted Deployable Items (services, layers, components) and static assets with WAFv2 protection:

• WAF rules: IP Reputation List, Common Rule Set, Known Bad Inputs Rule Set (all AWS-managed)
• Origin: S3 backend bucket with OAC (Origin Access Control)
• Logging: Access logs written to infrastructure S3 bucket

Database

Aurora PostgreSQL (Cluster Mode)

The primary relational data store for AosCloud. Provisioned as an Aurora PostgreSQL cluster (not standalone RDS) with the following characteristics:

• Cluster mode: Multi-AZ writer with read replicas (Aurora cluster, not single-instance RDS)
• Encryption: KMS customer-managed key for encryption at rest
• Subnet group: Distributed across 3 availability zones
• Backup: 7-day automated snapshots plus AWS Backup daily continuous backup

Important

AosCloud requires Aurora PostgreSQL in cluster mode, not standalone Amazon RDS for PostgreSQL. Using a standalone RDS instance is not supported.

Amazon DocumentDB

MongoDB-compatible document database used for alert data storage. DocumentDB provides MongoDB wire-protocol compatibility while running as a fully managed AWS service.

• Port: 27017
• Encryption: KMS customer-managed key
• Authentication: SCRAM-SHA-256 with TLS enabled
• Replica set: rs0 with secondary-preferred read preference
• Subnet group: Distributed across 3 availability zones

Amazon ElastiCache (Redis)

Redis 6.x or later in-transit-encrypted cluster providing:

• Caching: Application-level caching for API and backend services
• Session management: Distributed session storage for WebSocket and API services
• Pub/sub: Inter-service messaging for real-time events
• RabbitMQ metrics: Dedicated Redis database (DB 5) for queue metrics

Single-AZ deployment with password authentication (AUTH token).

Storage

Amazon S3

Two primary S3 buckets serve different roles:

Bucket	Purpose	KMS Key	Lifecycle Rules
{name}-backend	Deployable Items, application artifacts, media files	Primary KMS key	None (CloudFront origin)
{name}-infra	Helm charts, InfluxDB backups, logs	Infrastructure KMS key	7-day backup cleanup, 14-day Helm chart versioning

Both buckets enforce SSE-KMS encryption, versioning, and restricted access policies.

Amazon EFS

Elastic File System provides persistent storage for InfluxDB time-series metrics data. Mounted into EKS pods via the EFS CSI driver:

• Access point: /influxdb2 with UID/GID 1000 and 775 permissions
• Mount targets: Deployed to all EKS pod subnets
• Encryption: KMS infrastructure key
• Security group: EKS default security group

Amazon ECR

Elastic Container Registry hosts all container images:

• AOS service repos (12): alert-handler, api, auth, data-migration, message-handler, management, nginx, service-discovery, unit-monitoring, units-queues-management, websocket-api, unit-message-handler
• External dependency repos (20+): Istio components, cert-manager, Prometheus, Fluent Bit, CSI drivers, metrics-server, AWS Load Balancer Controller, InfluxDB, etc.
• Helm chart OCI repo: OCI-format Helm chart storage

All repos enforce VPC-subnet pull restrictions and IAM-based access policies.

Security

AWS KMS

Two customer-managed KMS keys provide encryption at rest:

Key	Purpose	Encrypted Resources
Primary ({name})	Application data encryption	S3 backend, Aurora PostgreSQL, DocumentDB, Secrets Manager
Infrastructure ({name}-infra)	Infrastructure data encryption	S3 infrastructure bucket, EFS

Both keys use custom key policies granting access to admin ARNs, IRSA service account roles, and the backup service.

AWS Secrets Manager

All application credentials, certificates, and configuration are stored in Secrets Manager. Multiple secret paths organize credentials by function:

Secret Path	Contents
{project}-{env}-appcfg	Application configuration (endpoints, regions, feature flags)
{project}-{env}-appsec	Application secrets (Redis passwords, Django keys, certificates)
{project}-{env}-dbcfg	Database configuration (host, port, database name)
{project}-{env}-dbsec	Database secrets (credentials, connection strings)
{project}-{env}-taskcfg	Task service configuration
{project}-{env}-tasksec	Task service secrets
{project}-{env}-mhcfg	Message handler configuration
{project}-{env}-mhsec	Message handler secrets
{project}-{env}-sdcfg	Service discovery configuration
{project}-{env}-sdsec	Service discovery secrets
{project}-{env}-base	Shared infrastructure secrets (all service endpoints, admin credentials)
{project}-{env}-ingress	TLS certificates for Istio ingress gateway
{project}-{env}-landing	Landing page configuration
{project}-{env}-data-services	Alert handler and InfluxDB configuration

AWS Backup

A centralized backup vault with daily backup rules protects stateful resources:

• Schedule: Daily at 12:00 UTC
• Retention: 14 days with continuous backup enabled
• Protected resources: S3 backend bucket, DocumentDB cluster, Aurora PostgreSQL cluster, EKS EBS volumes (tagged)
• Encryption: KMS-encrypted vault

Messaging

Amazon SES

Amazon Simple Email Service provides transactional email for:

• User registration: Sign-up confirmation emails with sign-in tokens and information
• Notifications: System alerts and administrative notifications
• Certificates reissuing: Secure certificates recovery or renew flows

Configured via SMTP interface (email-smtp.<region>.amazonaws.com). The SES SMTP VPC endpoint ensures email sending remains within the AWS network.

Monitoring

Amazon CloudWatch Logs

Log groups provisioned for:

• EKS Container Insights: Four log groups (performance, application, host, dataplane)
• Fluent Bit: Application log forwarding from EKS pods

Log retention is configurable (default: 90 days).

AWS CloudTrail (Optional)

Audit logging for API calls against S3 and ECR resources. Currently disabled but the configuration remains available.

Management

AWS Resource Groups organize all provisioned resources by tagging convention:

• Base group: All core infrastructure (group-name: base)

Tags include environment, project, and group-name for filtering in the AWS Console.

Multi-Region Considerations

AosCloud requires resources in two AWS regions for a complete deployment:

Region	Resources	Reason
Primary (e.g., eu-central-1)	All infrastructure (VPC, EKS, databases, S3, etc.)	Main deployment region
us-east-1	WAFv2 Web ACL, ACM certificate (if used)	CloudFront global resources must reside in us-east-1

The WAFv2 Web ACL requires scope = "CLOUDFRONT" which must be in the us-east-1 region regardless of where the CloudFront distribution is configured.

note

If you use ACM certificates for CloudFront custom domains, those certificates must also be provisioned in us-east-1.

Service Quotas

The following service quotas may need increases for production deployments:

Service	Quota	Default	Recommended
VPC	VPC endpoints per VPC	20	20 (12 used)
EKS	Clusters per region	100	Sufficient
EKS	Managed node groups per cluster	30	Sufficient
EC2	Running on-demand instances	Varies by type	Review based on EKS instance type
ECR	Repositories per region	10,000	Sufficient (35+ repos created)
S3	Buckets per account	100	Sufficient
Secrets Manager	Secrets per region	500,000	Sufficient (15+ secrets)
EFS	File systems per account	1,000	Sufficient
ElastiCache	Nodes per region	300	Sufficient
DocumentDB	Clusters per region	40	Sufficient
Aurora	DB clusters per region	40	Sufficient
CloudFront	Distributions per account	200	Sufficient
WAFv2	Web ACLs per region	100	Sufficient
KMS	CMKs per region	100	Sufficient (2 keys)
SES	Sending rate	Varies	Review based on expected user registrations

tip

Request quota increases before provisioning infrastructure. A failed provisioning mid-way due to quota limits requires manual cleanup. Pay particular attention to EC2 instance limits matching your chosen EKS instance type and scaling configuration.

Related Documentation

• Infrastructure Overview — reading order guide and deployment model overview
• IAM Roles and Policies — IRSA configuration and role details
• Networking Prerequisites — VPC, subnets, security groups, and endpoints in detail