AWS Deployment Prerequisites

Use this page as a deploy readiness checklist before running helm upgrade on bighammer.

For infrastructure configurations, reference values, and service architecture, see Infrastructure.

AWS foundation (must exist)

Resource	Purpose
Amazon EKS	Run platform and AI Agent workloads
Amazon RDS (PostgreSQL)	Application, Audit, and Keycloak data
AWS Secrets Manager	Passwords, TLS, app secrets
Route 53	Resolve ingress hostnames
Amazon ECR	Container images
IAM Roles for Service Accounts (IRSA)	ESO + application pod access to AWS APIs

Area	Requirement
EKS	Kubernetes version ≥ 1.28; OIDC provider enabled (for IRSA); node group instances ≥ `t3.xlarge` or equivalent
RDS PostgreSQL	PostgreSQL 16; instance class ≥ `db.t3.xlarge`; private subnet deployment; SSL mode enabled
Databases	`bighammer_db_<env>` (application), `audit_db_<env>` (audit), and `keycloak_db_<env>` (Keycloak server)
DB users	`postgres`, `bh_dev_user`, `bh_app_user`, `keycloak_db_user` — names must match chart defaults
DB passwords in Secrets Manager	Secret entries for `bh-app-user-password`, `bh-dev-user-password`, `db-postgres-password`, `bh-kcdbpwd`
DNS	Public or private Route 53 hosted zones; CNAME/Alias records pointing to the ALB provisioned by AWS Load Balancer Controller

Helm coupling

The chart expects a dual-role database model on the application database (e.g. bighammer_db_<env>):

POSTGRES_USER / POSTGRES_PASSWORD → bh_dev_user — Alembic migrations, create/alter/drop tables
BH_APP_USER / BH_APP_USER_PASSWORD → bh_app_user — runtime API and worker traffic (DML only)

Keycloak server database — platform provisioning

The Keycloak server (bhkeycloak) uses a separate database and user provisioned by your platform tooling — not bighammer_db_setup.sql:

Resource	Reference name	Chart
Database	`keycloak_db_<env>`	`global.bhkeycloak.env.KC_DB_URL`
User	`keycloak_db_user`	`global.bhkeycloak.env.KC_DB_USERNAME`
Password (Secrets Manager)	`bh-kcdbpwd`	`global.remoteSecrets.keycloak.dbPassword` → `KC_DB_PASSWORD`

Allow the following ingress/egress rules on the EKS node security groups:

Port	Protocol	Purpose
TCP 80, 443	Ingress	HTTP/HTTPS ingress traffic from ALB
TCP 5432	Egress	Connectivity to RDS PostgreSQL instance
TCP 5672, 15672	Ingress/Egress	RabbitMQ broker and admin traffic

Add-on	Required	Helm chart [BigHammer tested versions]
External Secrets Operator	Yes	`external-secrets-0.18.2` or later
AWS Load Balancer Controller	Yes	`aws-load-balancer-controller-1.7.2` or later
RabbitMQ (separate Helm release)	Yes	bhrabbitmq or existing broker
Stakater Reloader	Recommended	`reloader-1.1.0`
Cert Manager	Optional	`cert-manager-v1.19.2`

Principal / Role	Minimum Policy Requirement
ESO Service Account IAM Role	`secretsmanager:GetSecretValue` on BigHammer secrets
App Pod IAM Role (IRSA)	`secretsmanager:GetSecretValue` on tenant & dynamic secrets; `sqs:SendMessage` on Audit FIFO queue
EKS Node IAM Role	`ecr:GetDownloadUrlForLayer`, `ecr:BatchGetImage`, `ecr:GetAuthorizationToken` to pull container images