This page lists what the CloudFormation stack and the Installation Wizard create in your AWS account, where the platform stores data, and which parts are reachable from the internet.

Regions

The platform deploys in every commercial AWS Region — North America, Europe, Asia Pacific, Middle East and Africa, and South America. AWS GovCloud and the China Regions are not supported.

Resources created

AreaAWS serviceWhat is createdPurpose
InstallerAmazon EC2Instance for the Installation Wizard, with launch template, Auto Scaling group and Elastic IP as neededHosts the Installation Wizard and Cost Control page
NetworkAmazon VPCVPC, public and private subnets across Availability Zones, route tables, internet gateway, NAT gateway, security groups, NACLs, DHCP optionsIsolated network for the platform
IdentityAWS IAMRoles, instance profiles, managed policies, OIDC provider; IAM users such as TerraformPermissionIAMUser with access keys used during installationProvisioning and runtime permissions for EKS, RDS, S3, KMS and other services
ComputeAmazon EKSCluster, node groups, add-ons (VPC CNI, CSI)Runs the platform's containerised components
DatabaseAmazon RDS (PostgreSQL)DB instance, subnet and parameter groups, security groupStructured application data
CacheAmazon ElastiCache (Redis)Redis cluster, subnet group, security groupCaching and session storage
MessagingAmazon MSKKafka cluster, security groupEvent and message backbone
Search and logsAmazon OpenSearch ServiceDomain, security groupLog collection, indexing and analytics
StorageAmazon S3Buckets with ACLs, CORS and ownership controlsAssets, reports, logs and backups
TrafficElastic Load BalancingApplication Load Balancer, target groupsRoutes HTTPS traffic to services
CertificatesAWS Certificate ManagerCertificate for the platform domainTLS for HTTPS
EncryptionAWS KMSCustomer-managed keys and aliasesEncryption at rest
ParametersAWS Systems ManagerSSM parameters (for example, the AMI)Installation configuration
MonitoringAmazon CloudWatchLog groups, metrics and alarmsMonitoring, alerting and log retention
NotificationsAmazon SNS / SESConfigured through the platform, not the stackEmail and SMS sending
DNSAmazon Route 53 (optional)Hosted zone and records, if you use Route 53Custom domain

Every resource is named with the ResourcePrefix chosen at stack creation, and IAM resources also carry the stack name and stack ID for traceability.

Data locations and encryption

DataStored inNetwork placementEncryption
Application dataAmazon RDS (PostgreSQL)Private subnetAt rest with KMS; in transit with TLS
Uploaded assets, media, reports, backupsAmazon S3Private, except specific public objectsAt rest with KMS; in transit with TLS
Logs and analyticsAmazon OpenSearch ServicePrivate subnetIn transit with TLS
Cache and sessionsAmazon ElastiCache (Redis)Private subnetAt rest with KMS; in transit with TLS
Events and messagesAmazon MSKPrivate subnetAt rest with KMS; in transit with TLS
Node volumesAmazon EBSPrivate subnetAt rest with KMS
SecretsRestricted configuration filesPrivate; not AWS Secrets ManagerPer the file store

Public access points

ResourceExposure
Application Load BalancerPublic; the only entry point for the platform domain, normally routed through Route 53 or your DNS provider
Specific S3 objectsPublic, intentionally, for assets served to browsers and displays
Installation Wizard EC2 instanceReachable at the EC2InstancePublicURL stack output during installation
Everything elsePrivate subnets only

Instance metadata (IMDS)

SettingDefaultDescription
IMDSv2 on EKS worker nodesEnforcedWorker nodes require IMDSv2 tokens
IMDSv2 on EC2 instancesOptionalCan be enforced through stack configuration