Enterprise Reference Architecture on AWS

CloudThinker Enterprise can run single-tenant in AWS accounts your organization owns, reachable only from your private network. This page shows the reference design that security and platform teams review before a self-hosted deployment.

CloudThinker Enterprise in a customer AWS organization: a private VPC across three Availability Zones with Amazon EKS platform and sandbox node groups, Aurora, ElastiCache, and AWS services reached through VPC endpoints, connected to the on-premises data centre over Direct Connect. — CloudThinker Enterprise reference architecture on AWS

Reference design. Self-hosted deployments are in early access. Components, sizing, and supported services are confirmed during onboarding and can vary by release. See Deployment options.

Layers

Layer	AWS services	What it does
Connectivity	AWS Direct Connect or Site-to-Site VPN, AWS Transit Gateway, Route 53 Resolver	Users and connections reach the deployment over your private network. There’s no internet ingress.
Ingress	Internal Network Load Balancer, AWS Certificate Manager	Serves the web console and API over TLS 1.2 or later.
Compute	Amazon EKS with a private API endpoint, two node groups across three Availability Zones	The platform node group runs the web console, API, agent workers, and vector store. The sandbox node group runs agent-generated code and connection commands.
Data	Amazon Aurora Serverless v2 (PostgreSQL), Amazon ElastiCache Serverless, Amazon S3, Amazon EFS	Holds conversations, findings, the task queue, documents, and shared files, encrypted with KMS keys you manage.
AI models	Amazon Bedrock in your account, or your own provider through BYOK	Model calls stay in the Regions and provider account you choose.
AWS APIs	VPC endpoints (AWS PrivateLink) for Amazon ECR, AWS Secrets Manager, AWS KMS, Amazon CloudWatch, and Amazon S3	Workloads call AWS without leaving the private network.
Security and audit	Amazon GuardDuty, AWS Security Hub, AWS CloudTrail, AWS Config	Your security account keeps full visibility, and logs flow to your SIEM.
Recovery	AWS Backup with a locked vault in a recovery Region	Daily backups are copied to a second Region.

How a request flows

A user opens the web console over Direct Connect or VPN. Transit Gateway routes the request to the internal Network Load Balancer.
The API checks the user’s role and queues the task for an agent worker.
CloudThinker plans each step with the model you configured. Reads run, and every write goes through Approvals, which can wait for a person or refuse it.
Commands run in a sandbox on the sandbox node group. Connections reach on-premises systems through Transit Gateway, and other AWS accounts through a read-only role in each account.
Data, secrets, and logs stay in your accounts. Backups are copied to the recovery Region.

Design principles

Principle	How the design applies it
Private network only	No internet gateway, public IP address, or public load balancer.
No long-lived credentials	Each workload uses its own IAM role. Connected AWS accounts are reached through roles you create and can revoke.
Keys you manage	AWS KMS keys in your account encrypt the database, cache, storage, and logs.
Isolated agent code	Agent-generated code runs only in sandboxes, on nodes kept apart from the platform.
Approval for changes	Writes pass Approvals before they run. A read-only credential can’t write at all.
Read-only by default	Connected accounts get a least-privilege read role. Add a change role only where you approve one.

What you provide

An AWS organization with separate network, security, and log archive accounts.
AWS Direct Connect or Site-to-Site VPN from your data centre.
An identity provider that supports SAML 2.0 or OIDC. See Single sign-on.
Access to approved Amazon Bedrock models in your Regions, or a provider account for BYOK.

To start a self-hosted deployment, follow Request a private deployment.

Deployment options

Compare the hosted cloud, Workers, and private deployments.

Security and trust

Answer a vendor security review.

Approvals

Control which agent writes run, wait, or are refused.

BYOK

Bring your own LLM provider credentials.

Security and trust

Identity and access

Governance

Deployment

Enterprise Reference Architecture on AWS

Layers

How a request flows

Design principles

What you provide

Deployment options

Security and trust

Approvals

BYOK

​Layers

​How a request flows

​Design principles

​What you provide

​Related

Deployment options

Security and trust

Approvals

BYOK

Layers

How a request flows

Design principles

What you provide

Related