AWS Infrastructure

The BigHammer platform can be deployed on Amazon Web Services (AWS) using various provisioning methods, including:

• AWS Management Console
• AWS CLI
• Terraform
• Infrastructure-as-Code (IaC) tools approved by the customer

Regardless of the provisioning method used, the following reference architecture, resource requirements, and configuration values should be used as the baseline for setting up the infrastructure required for the BigHammer platform.

AWS services recommended configuration

Service	Description
Amazon EKS	Private EKS cluster with managed node groups
Amazon RDS	Multi-AZ RDS PostgreSQL — bighammer_db_<env>, audit_db_<env>, keycloak_db_<env>
AWS Secrets Manager	Secure storage for database passwords, credentials, and app secrets
Route 53	Route 53 hosted zones and hostnames routing to the ALB
AWS IAM / OIDC	IRSA (IAM Roles for Service Accounts) for pod-level AWS API authorization
AWS KMS	Customer Managed Key (CMK) for encrypting Secrets Manager and RDS

Networking (reference dev)

Setting	Reference value
VPC CIDR	Customer-specific (example: 10.0.0.0/16)
Subnets	Private subnets for pods/RDS, public subnets for load balancers
NAT Gateway	Required in public subnets to enable outbound internet access for private pods
Route Tables	Routing private subnets through the NAT Gateway for external dependencies

Amazon EKS

Setting	Reference value
Cluster name	Customer-specific (example: bh-dev-eks-cluster)
Kubernetes version	Tested version: 1.29 or later
Endpoint Access	Private or Public and Private
IAM OIDC Provider	Enabled (required for IRSA/Service Accounts)
EBS CSI Driver	IAM role + EKS Add-on enabled for dynamic PV volume provisioning

Node group — platform / AI Agent (required)

Setting	Reference value
Node type	Amazon Linux 2 (EKS Optimized)
Instance type	t3.xlarge (4 vCPU, 16 GB RAM) or equivalent compute class
Scaling	min 2, max 6 (Autoscaling enabled)
Disk size	80 GB GP3 EBS root volume
Subnets	Deployed only in Private subnets

Amazon RDS (PostgreSQL)

Setting	Reference value
Database Engine	PostgreSQL 16.x
Instance Class	db.t3.xlarge or greater
Multi-AZ	Enabled for Production; Disabled for Dev
Storage	GP3 SSD with Autoscaling enabled
Subnet Group	RDS Private Subnets only
Security Group	Restricted to only allow ingress on port 5432 from the EKS nodes security group

IAM Roles for Service Accounts (IRSA)

Rather than using wide node-level IAM permissions, BigHammer utilizes IRSA (OIDC federated service accounts) to secure cloud API access at the pod level.

1. External Secrets Operator (ESO) IAM Role

• Namespace: external-secrets
• Kubernetes Service Account: external-secrets
• AWS IAM Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "secretsmanager:GetSecretValue",
                "secretsmanager:DescribeSecret"
            ],
            "Resource": "arn:aws:secretsmanager:*:*:secret:*"
        }
    ]
}

2. Application API IAM Role

• Namespace: bh-control-plane
• Kubernetes Service Account: bh-catalog-api-svc-account / bh-audit-api-svc-account
• AWS IAM Policy:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "sqs:SendMessage",
                "sqs:ReceiveMessage",
                "sqs:DeleteMessage",
                "sqs:GetQueueAttributes"
            ],
            "Resource": "arn:aws:sqs:us-east-1:*:audt_api_test.fifo"
        }
    ]
}