# AWS deployment: resources provisioned

> The AWS resources the CloudFormation stack and installer create, where data is stored and encrypted, and which endpoints are public.

Reference · Platform Installation › AWS deployment reference · Last updated 15 September 2026

URL: https://personalisationhub.com/support-centre/platform-installation/aws-deployment-resources-provisioned/

This page lists what the CloudFormation stack and the Installation Wizard create in your AWS account, where the platform stores data, and which parts are reachable from the internet.

## Regions

The platform deploys in every commercial AWS Region — North America, Europe, Asia Pacific, Middle East and Africa, and South America. AWS GovCloud and the China Regions are not supported.

## Resources created

| Area | AWS service | What is created | Purpose |
| --- | --- | --- | --- |
| Installer | Amazon EC2 | Instance for the Installation Wizard, with launch template, Auto Scaling group and Elastic IP as needed | Hosts the Installation Wizard and Cost Control page |
| Network | Amazon VPC | VPC, public and private subnets across Availability Zones, route tables, internet gateway, NAT gateway, security groups, NACLs, DHCP options | Isolated network for the platform |
| Identity | AWS IAM | Roles, instance profiles, managed policies, OIDC provider; IAM users such as `TerraformPermissionIAMUser` with access keys used during installation | Provisioning and runtime permissions for EKS, RDS, S3, KMS and other services |
| Compute | Amazon EKS | Cluster, node groups, add-ons (VPC CNI, CSI) | Runs the platform's containerised components |
| Database | Amazon RDS (PostgreSQL) | DB instance, subnet and parameter groups, security group | Structured application data |
| Cache | Amazon ElastiCache (Redis) | Redis cluster, subnet group, security group | Caching and session storage |
| Messaging | Amazon MSK | Kafka cluster, security group | Event and message backbone |
| Search and logs | Amazon OpenSearch Service | Domain, security group | Log collection, indexing and analytics |
| Storage | Amazon S3 | Buckets with ACLs, CORS and ownership controls | Assets, reports, logs and backups |
| Traffic | Elastic Load Balancing | Application Load Balancer, target groups | Routes HTTPS traffic to services |
| Certificates | AWS Certificate Manager | Certificate for the platform domain | TLS for HTTPS |
| Encryption | AWS KMS | Customer-managed keys and aliases | Encryption at rest |
| Parameters | AWS Systems Manager | SSM parameters (for example, the AMI) | Installation configuration |
| Monitoring | Amazon CloudWatch | Log groups, metrics and alarms | Monitoring, alerting and log retention |
| Notifications | Amazon SNS / SES | Configured through the platform, not the stack | Email and SMS sending |
| DNS | Amazon Route 53 (optional) | Hosted zone and records, if you use Route 53 | Custom domain |

Every resource is named with the `ResourcePrefix` chosen at stack creation, and IAM resources also carry the stack name and stack ID for traceability.

## Data locations and encryption

| Data | Stored in | Network placement | Encryption |
| --- | --- | --- | --- |
| Application data | Amazon RDS (PostgreSQL) | Private subnet | At rest with KMS; in transit with TLS |
| Uploaded assets, media, reports, backups | Amazon S3 | Private, except specific public objects | At rest with KMS; in transit with TLS |
| Logs and analytics | Amazon OpenSearch Service | Private subnet | In transit with TLS |
| Cache and sessions | Amazon ElastiCache (Redis) | Private subnet | At rest with KMS; in transit with TLS |
| Events and messages | Amazon MSK | Private subnet | At rest with KMS; in transit with TLS |
| Node volumes | Amazon EBS | Private subnet | At rest with KMS |
| Secrets | Restricted configuration files | Private; not AWS Secrets Manager | Per the file store |

## Public access points

| Resource | Exposure |
| --- | --- |
| Application Load Balancer | Public; the only entry point for the platform domain, normally routed through Route 53 or your DNS provider |
| Specific S3 objects | Public, intentionally, for assets served to browsers and displays |
| Installation Wizard EC2 instance | Reachable at the **EC2InstancePublicURL** stack output during installation |
| Everything else | Private subnets only |

## Instance metadata (IMDS)

| Setting | Default | Description |
| --- | --- | --- |
| IMDSv2 on EKS worker nodes | Enforced | Worker nodes require IMDSv2 tokens |
| IMDSv2 on EC2 instances | Optional | Can be enforced through stack configuration |

## Related

- [AWS deployment: architecture](https://personalisationhub.com/support-centre/platform-installation/aws-deployment-architecture/)
- [AWS deployment: prerequisites](https://personalisationhub.com/support-centre/platform-installation/aws-deployment-prerequisites/)
- [AWS deployment: lifecycle management](https://personalisationhub.com/support-centre/platform-installation/aws-deployment-lifecycle-management/)
- [Where is my data stored and how is the platform secured?](https://personalisationhub.com/support-centre/getting-started/where-is-my-data-stored-and-how-is-the-platform-secured/)