Prerequisites for Automated Deployment on AWS

This documentation is for Kyvos 2026.8.x. To view documentation for other Kyvos versions, click here.

This documentation is for Kyvos 2026.8.x. To view documentation for other Kyvos versions, click here.

✅ Enterprise: AWS

1. Overview

This section describes the requirements that must be completed before deploying Kyvos using a CloudFormation template. It covers the required AWS permissions, networking, IAM roles, EC2 key pair, S3 access, and the Kyvos license and software bundle.

2. CloudFormation Template

If you use the CloudFormation template to create IAM roles and VPC resources, you must have administrative privileges to create IAM roles and VPCs.

Contact Kyvos Support to obtain a custom template.

3. AWS User or Role Permissions

The CloudFormation template can be deployed using either:

The logged-in AWS user, or
An IAM role

The logged-in user must have the policies specified in the aws-console-user-iam-policy-with-VPC.json or aws-console-user-iam-policy-without-VPC.json file (included in the AWS installation files).

4. EC2 Key Pair

An EC2 key pair (private key and public key) is required for instance access. If needed, you can create an EC2 key pair.

On this page:

1 1. Overview
2 2. CloudFormation Template
3 3. AWS User or Role Permissions
4 4. EC2 Key Pair
5 5. Networking Requirements
- 5.1 5.1 Option A — Create Network Resources Using CloudFormation
- 5.2 5.2 Option B — Use Existing Network Resources
6 6. Permissions
- 6.1 6.1 Option 1 — Create IAM Roles Using CloudFormation
- 6.2 6.2 Option 2 — Create IAM Roles Manually
7 7. S3 Bucket Permissions
- 7.1 7.1 Placeholder Reference for S3 Bucket Policy
- 7.2 7.2 S3 Bucket Policy
8 9. Licensing & Access Requirements
9 10. Lambda functions

Refer again:

Common prerequisites for Kyvos Enterprise Deployment

Next step:

Deploying Kyvos on AWS

5. Networking Requirements

Configure the network resources using either of the following options:

5.1 Option A — Create Network Resources Using CloudFormation

The Network CloudFormation template automatically provisions:

Resource	Purpose

Resource	Purpose
VPC	Virtual network for Kyvos resources
Subnet	Segmented network space within the VPC
Security Group	Controls inbound/outbound traffic

To deploy with a NAT Gateway, use the vpc_nat.json (included in the AWS installation files) template.

5.2 Option B — Use Existing Network Resources

If you want to use existing network resources, configure the VPC according to the required specifications.

Refer to the Amazon documentation for the VPC and subnet requirements for an EKS cluster.

Ensure that the following requirements are met:

Requirement	Detail

Requirement	Detail
Dedicated IPs	One dedicated IP address is required per endpoint
Public subnet IPs	At least 8 IP addresses must be available in each public subnet, and each subnet must be in a different Availability Zone within the VPC. These are required by the EKS load balancer.
Internet/VPC access	Either create VPC endpoints for required AWS services, or ensure the subnet has internet access via a NAT Gateway

5.2.1 VPC Endpoints for AWS Services Required by Kyvos

In the following table, change {AWS-REGION} to the region in which you are deploying Kyvos.

Note

AWS does not provide a VPC endpoint for the Cost Explorer service, so the Kyvos Resource Usage feature will not work without internet access.

AWS Service Name	Description	VPC Endpoint Name

AWS Service Name	Description	VPC Endpoint Name
CloudWatch Logs	Used to send bootstrap logs from the EC2 machines to CloudWatch Logs.	`com.amazonaws.{AWS-REGION}.logs`
CloudFormation	Used by Kyvos Manager at the time of deployment to validate and get details from the AWS stack in CloudFormation.	`com.amazonaws.{AWS-REGION}.cloudformation`
Redshift	Required when Amazon Redshift is configured as the data source.	`com.amazonaws.{AWS-REGION}.redshift`
Athena	Required when Amazon Athena is configured as the data source.	`com.amazonaws.{AWS-REGION}.athena`
Auto Scaling Group	Required for Kyvos BI Server operations that use dedicated compute resources. The Kyvos BI Server uses the Auto Scaling Group to automatically scale compute instances during semantic model processing.	`com.amazonaws.{AWS-REGION}.autoscaling`
CloudWatch Event	Used to schedule events on CloudWatch Event for scheduled starting of the Kyvos BI Server.	`com.amazonaws.{AWS-REGION}.events`
S3	Used to connect to an S3 bucket for reading raw data and writing metadata.	`com.amazonaws.{AWS-REGION}.s3`
RDS	Used for scheduled start/stop of the Kyvos cluster along with RDS.	`com.amazonaws.{AWS-REGION}.rds`
EC2	Used by Kyvos Manager to describe EC2 and Kyvos BI Server for scheduled start/stop of Query Engines.	`com.amazonaws.{AWS-REGION}.ec2`
Secrets Manager	Used by the Kyvos BI Server to get the passwords stored in AWS Secrets Manager.	`com.amazonaws.${AWS-REGION}.secretsmanager`
ExecuteApiEndpoint	Used to create a VPC Endpoint ID to access the Private API Gateway for deploying Lambda functions privately.	`com.amazonaws.${AWS::Region}.execute-api`

6. Permissions

Configure the required IAM roles using one of two options:

6.1 Option 1 — Create IAM Roles Using CloudFormation

Use the automated_deployment_iam_role.json template to automatically create the required roles.

6.2 Option 2 — Create IAM Roles Manually

Role	Attached To	Purpose

Role

Attached To

Purpose

EC2 IAM Role

All Kyvos instances

Must contain all permissions required by Kyvos Services and Kyvos Manager.

See Details for permissions required for EC2 for more information.

Lambda IAM Role

Lambda functions created by Kyvos

Must contain all permissions required for the Lambda functions to run.
See the Permissions Required for Lambda Role for more information.

7. S3 Bucket Permissions

Required when

Using an existing S3 bucket.

7.1 Placeholder Reference for S3 Bucket Policy

Replace the following placeholders in the S3 bucket policy JSON with the corresponding values from your AWS environment, as described below the table.

Placeholder	Replace with

Placeholder	Replace with
`<Bucket Name>`	The name of your S3 bucket
`<Lambda Role>`	The name of your Lambda role
`<EC2 Role>`	The name of your EC2 role
`<AWS Account ID>`	Your AWS account ID
`<kyvosEksOidcrole>`	The OIDC role name attached to the EKS cluster add-on
`<NodeGroupRole>`	The role name attached to your EKS cluster's node group

7.2 S3 Bucket Policy

{ 
  "Version": "2008-10-17", 
  "Statement": [ 
    { 
    "Sid": "Ec2LambdaRoleBucketPolicy", 
    "Effect": "Allow", 
    "Principal": { 
      "AWS": [ 
        "arn:aws:iam::<AWS Accout ID>:role/EC2-Role",
         "arn:aws:iam::<AWS Accout ID>:role/kyvosEksOidcrole",
         "arn:aws:iam::<AWS Accout ID>:role/NodeGroupRole"
		  "arn:aws:iam::<AWS Accout ID>:role/<Lambda Role>",
     ] 
    }, 
    "Action": [ 
      "s3:PutAnalyticsConfiguration", 
      "s3:GetObjectVersionTagging", 
      "s3:ReplicateObject", 
      "s3:GetObjectAcl", 
      "s3:GetBucketObjectLockConfiguration", 
      "s3:DeleteBucketWebsite", 
      "s3:PutLifecycleConfiguration", 
      "s3:GetObjectVersionAcl", 
      "s3:DeleteObject", 
      "s3:GetBucketPolicyStatus", 
      "s3:GetObjectRetention", 
      "s3:GetBucketWebsite", 
      "s3:PutReplicationConfiguration", 
      "s3:PutObjectLegalHold", 
      "s3:GetObjectLegalHold", 
      "s3:GetBucketNotification", 
      "s3:PutBucketCORS", 
      "s3:GetReplicationConfiguration", 
      "s3:ListMultipartUploadParts", 
      "s3:PutObject", 
      "s3:GetObject", 
      "s3:PutBucketNotification", 
      "s3:PutBucketLogging", 
      "s3:GetAnalyticsConfiguration", 
      "s3:PutBucketObjectLockConfiguration", 
      "s3:GetObjectVersionForReplication", 
      "s3:GetLifecycleConfiguration", 
      "s3:GetInventoryConfiguration", 
      "s3:GetBucketTagging", 
      "s3:PutAccelerateConfiguration", 
      "s3:DeleteObjectVersion", 
      "s3:GetBucketLogging", 
      "s3:ListBucketVersions", 
      "s3:RestoreObject", 
      "s3:ListBucket", 
      "s3:GetAccelerateConfiguration", 
      "s3:GetBucketPolicy", 
      "s3:PutEncryptionConfiguration", 
      "s3:GetEncryptionConfiguration", 
      "s3:GetObjectVersionTorrent", 
      "s3:AbortMultipartUpload", 
      "s3:GetBucketRequestPayment", 
      "s3:GetObjectTagging", 
      "s3:GetMetricsConfiguration", 
      "s3:DeleteBucket", 
      "s3:PutBucketVersioning", 
      "s3:GetBucketPublicAccessBlock", 
      "s3:ListBucketMultipartUploads", 
      "s3:PutMetricsConfiguration", 
      "s3:GetBucketVersioning", 
      "s3:GetBucketAcl", 
      "s3:PutInventoryConfiguration", 
      "s3:GetObjectTorrent", 
      "s3:PutBucketWebsite", 
      "s3:PutBucketRequestPayment", 
      "s3:PutObjectRetention", 
      "s3:GetBucketCORS", 
      "s3:GetBucketLocation", 
      "s3:ReplicateDelete", 
      "s3:GetObjectVersion", 
      "s3:PutBucketTagging" 
    ], 
    "Resource": [ 
      "arn:aws:s3:::bucket-name/*", 
      "arn:aws:s3:::bucket-name" 
    ] 
    } 
  ] 
}

9. Licensing & Access Requirements

Requirement	Detail

Requirement	Detail
Access Key and Secret Key	Required to access the Kyvos bundle — contact Kyvos Support
Kyvos license file	A valid, current license file is required

10. Lambda functions

Kyvos uses Lambda to start the Analytical Server instances during cluster-scaling operations. The CloudFormation template creates three Lambda functions:

Scheduled start of the Analytical Server
Forced start of the Analytical Server
Display of cluster status on the Kyvos Web Portal