> ## Documentation Index > Fetch the complete documentation index at: https://docs.prisme.ai/llms.txt > Use this file to discover all available pages before exploring further. # Deploying Prisme.ai on AWS > AWS-specific managed services, persistent storage, ingress and IaC pointers. The Helm install itself is documented under Installation. This page covers the AWS-specific bits. The actual Helm install — values, ingress, env vars — lives in [Install with Helm](/self-hosting/kubernetes/helm). *** ## Recommended managed services | Component | AWS service | Notes | | ---------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | -------------------------------------------------------------------------------- | | Kubernetes | **EKS** | 3–5 nodes, ≥ `t3.xlarge` (4 vCPU / 16 GB), Multi-AZ, cluster autoscaler enabled. | | MongoDB | **MongoDB Atlas** (preferred) | Atlas runs in AWS too. See [MongoDB](/self-hosting/databases/mongodb). | | Elasticsearch | **OpenSearch Service** (Multi-AZ, 3 data + 3 dedicated master). See [Elasticsearch](/self-hosting/databases/elasticsearch). | | | Redis | **ElastiCache for Redis** (cluster mode, Multi-AZ). Standard Redis is enough — no modules required. See [Redis](/self-hosting/databases/redis). | | | PostgreSQL (optional) | **RDS for PostgreSQL** (Multi-AZ). See [PostgreSQL](/self-hosting/databases/postgresql). | | | Object storage | **S3**. Two buckets are enough: `models` and `uploads` (the latter serves both public and private files, proxied by the api-gateway). Add a third `public` bucket fronted by **CloudFront** only if you need public assets served directly from a CDN. | | | File storage (PVC RWX) | **EFS** (StorageClass `efs-sc`) or **FSx for NetApp ONTAP**, Multi-AZ. | | | Ingress | **AWS Load Balancer Controller** with **ALB**. | | | TLS / Certificates | **ACM** certificate covering `api.` and `studio.`. | | | Secrets | **AWS Secrets Manager** + **External Secrets Operator**. | | | Identity (S3 / SES) | **IRSA** (IAM Roles for Service Accounts) via the EKS OIDC provider. | | *** ## Persistent storage The shared RWX PVC (used by `prismeai-functions`) must be backed by EFS or FSx for NetApp ONTAP, in **Multi-AZ** mode. EBS volumes are AZ-scoped and not suitable for the shared volume. *** ## Infrastructure as Code A reference Terraform bundle is available on request from Prisme.ai support. It provisions: | Module | What it provisions | | ------------- | ------------------------------------------------------------------------------------------------------------------------- | | `prismeai` | EKS cluster, IAM roles (IRSA), EFS file system, Secrets Manager wiring, Prometheus, Bedrock access. | | `elasticache` | ElastiCache clusters for broker, runtime cache and crawler. | | `opensearch` | OpenSearch domain for events and crawler indices. | | `s3` | Buckets for models and uploads, plus an optional public bucket fronted by CloudFront when direct CDN delivery is enabled. | The bundle also ships a reference deployment guide covering External Secrets Operator wiring, MongoDB Atlas user creation, and example Helm values. CLI commands like `eksctl create cluster …` aren't reproduced here on purpose: most customers use Terraform or CloudFormation, and the AWS docs are the source of truth for the CLI. *** ## DNS and CloudFront Create two CNAME records pointing to the shared ALB hostname: ``` api. CNAME alb-host.elb.amazonaws.com studio. CNAME alb-host.elb.amazonaws.com ``` CloudFront is **optional**. By default, public files in the `uploads` bucket are proxied by the api-gateway and need no CDN. Wire a separate public bucket → CloudFront distribution → custom domain via ACM only if you want public assets served directly from the CDN (see [`UPLOADS_PUBLIC_STORAGE_*`](/self-hosting/kubernetes/environment-variables#s3-compatible-storage-for-uploads)). *** ## Ingress annotations Full ALB ingress example, including the **two distinct LB timeouts** (`client_keep_alive=60s` \< api-gateway server keep-alive of 70s for socket reuse; `idle_timeout=300s` for SSE / long LLM streams) lives in [Helm install — Ingress and load balancer](/self-hosting/kubernetes/helm#5-ingress-and-load-balancer). The non-negotiable annotations: ```yaml theme={null} alb.ingress.kubernetes.io/load-balancer-attributes: idle_timeout.timeout_seconds=300,client_keep_alive.seconds=60 alb.ingress.kubernetes.io/ssl-policy: ELBSecurityPolicy-TLS13-1-2-2021-06 alb.ingress.kubernetes.io/certificate-arn: arn:aws:acm:... ``` *** ## Next Steps Configure values and deploy core + apps namespaces. MongoDB, Redis, OpenSearch and PostgreSQL. Fresh-install walkthrough. Migrate an existing instance to v27.