Deploy

Launch the CloudFormation template in your own AWS account, enable Amazon Bedrock model access for the Region you launch in, then sign in to the console.

Region: at launch the appliance is available in US East (N. Virginia), us-east-1, only. Everything on this page refers to that Region unless a note says otherwise.

Before you launch: an account administrator should complete the one-time Anthropic and Bedrock steps in Amazon Bedrock model access, in us-east-1, the Region the stack will run in. If you skip them the stack still launches, but the skipped Claude models report as denied until they are done.

Parameters

The template takes eight parameters. Everything else is created for you (see what the template creates).

Parameter What to enter
ImageId Pre-filled by the Marketplace listing; leave it as-is.
InstanceType

t3.large by default, offered in every Availability Zone of us-east-1 except one (zone ID use1-az3; see Availability Zone exceptions).

The eight allowed types:

t3.large t3.xlarge t3a.large t3a.xlarge m6i.large m6i.xlarge m6a.large m6a.xlarge

Besides the default, the other seven types are also available for heavier workloads.

The t3a.* and m6a.* AMD variants cost less where a zone offers them.
AvailabilityZone The Availability Zone in us-east-1 for the appliance's subnet and instance, for example us-east-1a. Most zones offer every InstanceType value, but not all. Zone names map to different physical zones in each AWS account, so the exceptions are listed by zone ID (the EC2 console and aws ec2 describe-availability-zones show your account's name for each ID); see Availability Zone exceptions. If the stack fails at the Instance resource with an unsupported-configuration error, relaunch with a different zone or a different InstanceType.
KeyName An existing EC2 key pair in this account and Region, for SSH access.
AdminCidr Your own IP address as a CIDR, for example 203.0.113.42/32. Never 0.0.0.0/0: this is the only network this stack lets reach SSH.
AdminEmail The email address of the admin account first boot creates: letters, digits and . _ + - only, with one @ (for example admin@example.com). You sign in with this address (see First login).
DomainName Optional: a hostname such as ai.example.com, with no https://, port, path or IP address. Leave blank to reach the console over the Elastic IP with a self-signed certificate. To use a domain instead, either set it here before launching, or leave it blank, launch, point that domain's DNS A record at the ElasticIp output, and then run sudo appxenctl set-domain <name> on the instance. Either way, first boot (or set-domain) obtains a Let's Encrypt certificate for it.
RootVolumeSize Root EBS volume size in GiB, gp3, encrypted. Minimum 30, default 50.

Availability Zone exceptions

This zone does not offer any of the InstanceType values. It is listed by zone ID because zone names differ between AWS accounts.

Zone ID Region What it offers
use1-az3 us-east-1 None of the allowed instance types.

Other Regions (not available at launch)

The appliance is not offered outside us-east-1 at launch. For when more Regions are added, these are the zones in other Regions that do not offer every instance type:

Zone ID Region What it offers
euw2-az4 eu-west-2 Only the t3.* sizes.
apne1-az1 ap-northeast-1 No t3a.* sizes.
cac1-az4 ca-central-1 No t3a.* sizes.
every zone eu-north-1 No t3a.* or m6a.* sizes.

Quotas

The stack creates one VPC, one Internet gateway and one Elastic IP of its own. Each counts against a quota of the Region you launch in, us-east-1 at launch (5 by default).

If a quota is already used up: if your account is already at one of those quotas in us-east-1, the stack fails at that resource and rolls back. Delete an unused one or raise the quota in Service Quotas, then launch again.

Before you launch: Amazon Bedrock model access

This appliance calls Amazon Bedrock in the same Region as the stack (us-east-1 at launch), using six models by default. AWS retired the Bedrock console's "Model access" page in October 2025: serverless models are now enabled by default, but Anthropic's Claude models still need a one-time step. The first call to a third-party model also creates your account's AWS Marketplace subscription for it, which needs aws-marketplace:Subscribe, a permission the appliance's instance role deliberately does not have.

Before launching, in us-east-1, an account administrator should:

  1. 1

    Submit Anthropic's one-time use-case form in the Bedrock console.

  2. 2

    Invoke each of the three Claude models below once, for example in the Bedrock console's model playground, to create the account's Marketplace subscription for it.

The six default models

Model Before launch
Anthropic Claude Sonnet 4.5 Use-case form, then invoke once
Anthropic Claude Opus 4.6 Use-case form, then invoke once
Anthropic Claude Haiku 4.5 Use-case form, then invoke once
Amazon Nova Lite Nothing to do
Amazon Nova Pro Nothing to do
Amazon Titan Text Embeddings V2 (RAG document embeddings) Nothing to do

Amazon Nova and Amazon Titan need no such step.

If you skip it

The stack still launches and first boot still finishes. The health panel and sudo appxenctl bedrock-check report the skipped Claude model as denied until an administrator completes the steps above, and every other model keeps working.

Inference profiles

The default model ids are US cross-Region inference profiles. First boot maps them to the inference profiles available in the stack's Region. sudo appxenctl bedrock-check names any model that Region does not offer.

Other Regions (not available at launch)

The appliance is not offered outside us-east-1 at launch. For when more Regions are added, first boot prefers the Region's geography profile (for example eu., served from EU Regions) over a global. one, so Bedrock traffic stays within the stack's geography where the model is offered there. As of 2026-09-29:

  • Amazon Nova is not offered through an inference profile at all in eu-west-2 or sa-east-1.
  • Nova Pro specifically is not offered in ca-central-1.

A stack launched in one of those Regions would show the affected Nova model as unresolved in bedrock-check and the health panel. Nova is an optional model choice for workflows, not a requirement, so this would not stop the appliance from working.

Re-checking access

First boot probes Claude Haiku 4.5 and the embedding model and reports the result; re-run it any time with sudo appxenctl bedrock-check. The console's health panel shows the access status of every model.

First login

  1. 1

    Wait a few minutes after the stack reaches CREATE_COMPLETE for first boot to finish generating secrets and starting every service.

  2. 2

    Open the stack's ConsoleUrl output. Accept the self-signed certificate warning unless you set DomainName (or ran set-domain), in which case the certificate is already trusted.

  3. 3

    Sign in as the AdminEmail output, using the stack's InstanceId output as the initial password.

  4. 4

    You will be required to change that password immediately.

  5. 5

    Check the health panel on the dashboard home page. It confirms the AWS identity, every sibling service, and Bedrock model access for each configured model.

Stack outputs used in these docs

Output Used for
ConsoleUrl The console address you open at first login.
AdminEmail The address you sign in with.
InstanceId The initial password for that first sign-in.
ElasticIp The address a domain's DNS A record points at.
SshCommand The command to SSH to the instance (see Operations).
BackupsBucket The bucket the Postgres backups go to (see Backups).

Next