> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Enterprise Reference Architecture on AWS

> Review how a self-hosted CloudThinker Enterprise deployment is laid out in your own AWS accounts, from network to data.

CloudThinker Enterprise can run single-tenant in AWS accounts your organization owns, reachable only from your private network. This page shows the reference design that security and platform teams review before a self-hosted deployment.

![CloudThinker Enterprise in a customer AWS organization: a private VPC across three Availability Zones with Amazon EKS platform and sandbox node groups, Aurora, ElastiCache, and AWS services reached through VPC endpoints, connected to the on-premises data centre over Direct Connect.](https://mintcdn.com/cloudthinker/8X2SdQwL-M_9PX3m/images/deployment/enterprise-reference-architecture-aws.png?fit=max\&auto=format\&n=8X2SdQwL-M_9PX3m\&q=85\&s=c8bb90ac67538402c1c43f45e96f12a0)

CloudThinker Enterprise reference architecture on AWS

> [!NOTE]
>
> **Reference design.** Self-hosted deployments are in early access. Components, sizing, and supported services are confirmed during onboarding and can vary by release. See [Deployment options](https://docs.cloudthinker.io/guide/deployment/overview.md).

## Layers

| Layer | AWS services | What it does |
| - | - | - |
| Connectivity | AWS Direct Connect or Site-to-Site VPN, AWS Transit Gateway, Route 53 Resolver | Users and connections reach the deployment over your private network. There's no internet ingress. |
| Ingress | Internal Network Load Balancer, AWS Certificate Manager | Serves the web console and API over TLS 1.2 or later. |
| Compute | Amazon EKS with a private API endpoint, two node groups across three Availability Zones | The platform node group runs the web console, API, agent workers, and vector store. The sandbox node group runs agent-generated code and connection commands. |
| Data | Amazon Aurora Serverless v2 (PostgreSQL), Amazon ElastiCache Serverless, Amazon S3, Amazon EFS | Holds conversations, findings, the task queue, documents, and shared files, encrypted with KMS keys you manage. |
| AI models | Amazon Bedrock in your account, or your own provider through [BYOK](https://docs.cloudthinker.io/guide/byok.md) | Model calls stay in the Regions and provider account you choose. |
| AWS APIs | VPC endpoints (AWS PrivateLink) for Amazon ECR, AWS Secrets Manager, AWS KMS, Amazon CloudWatch, and Amazon S3 | Workloads call AWS without leaving the private network. |
| Security and audit | Amazon GuardDuty, AWS Security Hub, AWS CloudTrail, AWS Config | Your security account keeps full visibility, and logs flow to your SIEM. |
| Recovery | AWS Backup with a locked vault in a recovery Region | Daily backups are copied to a second Region. |

## How a request flows

1. A user opens the web console over Direct Connect or VPN. Transit Gateway routes the request to the internal Network Load Balancer.
2. The API checks the user's [role](https://docs.cloudthinker.io/guide/security/roles.md) and queues the task for an agent worker.
3. CloudThinker plans each step with the model you configured. Reads run, and every write goes through [Approvals](https://docs.cloudthinker.io/guide/approvals/overview.md), which can wait for a person or refuse it.
4. Commands run in a sandbox on the sandbox node group. Connections reach on-premises systems through Transit Gateway, and other AWS accounts through a read-only role in each account.
5. Data, secrets, and logs stay in your accounts. Backups are copied to the recovery Region.

## Design principles

| Principle | How the design applies it |
| - | - |
| Private network only | No internet gateway, public IP address, or public load balancer. |
| No long-lived credentials | Each workload uses its own IAM role. Connected AWS accounts are reached through roles you create and can revoke. |
| Keys you manage | AWS KMS keys in your account encrypt the database, cache, storage, and logs. |
| Isolated agent code | Agent-generated code runs only in sandboxes, on nodes kept apart from the platform. |
| Approval for changes | Writes pass Approvals before they run. A read-only credential can't write at all. |
| Read-only by default | Connected accounts get a least-privilege read role. Add a change role only where you approve one. |

## What you provide

* An AWS organization with separate network, security, and log archive accounts.
* AWS Direct Connect or Site-to-Site VPN from your data centre.
* An identity provider that supports SAML 2.0 or OIDC. See [Single sign-on](https://docs.cloudthinker.io/guide/security/sso.md).
* Access to approved Amazon Bedrock models in your Regions, or a provider account for [BYOK](https://docs.cloudthinker.io/guide/byok.md).

To start a self-hosted deployment, follow [Request a private deployment](https://docs.cloudthinker.io/guide/deployment/overview.md#request-a-private-deployment).

## Related

> **[Deployment options](https://docs.cloudthinker.io/guide/deployment/overview.md)**
>
> Compare the hosted cloud, Workers, and private deployments.

> **[Security and trust](https://docs.cloudthinker.io/guide/security/overview.md)**
>
> Answer a vendor security review.

> **[Approvals](https://docs.cloudthinker.io/guide/approvals/overview.md)**
>
> Control which agent writes run, wait, or are refused.

> **[BYOK](https://docs.cloudthinker.io/guide/byok.md)**
>
> Bring your own LLM provider credentials.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.