> ## Documentation Index
> Fetch the complete documentation index at: https://arize-ax.mintlify.site/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# EKS cluster and AWS resources

> Requirements for EKS node pools, S3 buckets, IAM, storage classes, and private VPC endpoints when installing Arize AX on AWS.

## Overview

Use this page when you already have an EKS cluster and will create or align supporting AWS resources to match Arize AX requirements.

## Storage buckets

Create two S3 buckets:

* One bucket for Gazette data.
* One bucket for ArizeDB data.

Buckets can use AES256, KMS, or no encryption, depending on your security requirements.

## Node pools

Use at least two node pools:

* **Base pool** - general workloads and ingestion. Label nodes with `arize=true` and `arize-base=true`.
* **ArizeDB pool** - ArizeDB historical workloads. Label nodes with `arize=true` and `druid-historical=true`.

If you cannot use separate pools, deploy on a shared pool by setting `historicalNodePoolEnabled: false` in `values.yaml`.

## Storage classes

Use a default storage class. `gp2` is preferred and used by default.

## Namespaces

Use dedicated namespaces for Arize AX, typically `arize` and `arize-operator`. They can be pre-existing or created by the Helm chart.

## Private VPC endpoints

If deployed on a private VPC, these endpoints must be reachable from the cluster:

* `com.amazonaws.<region>.s3`
* `com.amazonaws.<region>.ecr.api`
* `com.amazonaws.<region>.ecr.dkr`
* `com.amazonaws.<region>.ec2`
* `com.amazonaws.<region>.elasticloadbalancing`
* `com.amazonaws.<region>.sts`
* `com.amazonaws.<region>.ebs`

## IAM permissions

The IAM role used for Arize AX access to the ArizeDB and Gazette buckets needs these policy actions:

* `s3:ListBucket`
* `s3:*Object`
* `kms:Encrypt`
* `kms:Decrypt`
* `kms:ReEncrypt*`
* `kms:GenerateDataKey*`
* `kms:DescribeKey`
* `bedrock:InvokeModel`

If using IAM roles for service accounts (IRSA), the roles must have a trust policy that allows these service accounts to assume the role:

* `system:serviceaccount:arize:*`
* `system:serviceaccount:arize-operator:*`

If not using IRSA, add the policy actions to the role attached to the nodes. Pods must be able to discover the node role through instance metadata.

## Optional image registry

An ECR or private registry is optional when pulling from Arize AI's central image registry. If you use a private registry, set `pushRegistry` and `pullRegistry` in `values.yaml`.

## Sizing

Contact Arize AI for the `clusterSizing` field. This field controls the deployment size and must align with the size of the cluster. Common values are `small1b` and `medium2b`.

## Next steps

* [Terraform-based provisioning](/ax/selfhosting/installation/aws/cluster-terraform) if you prefer to create infrastructure from the distribution modules
* [Install Arize AX on AWS (quick start)](/ax/selfhosting/installation/aws/install-arize-quickstart)
* [Detailed walkthrough (AWS)](/ax/selfhosting/installation/aws/install-arize-detailed)