> ## Documentation Index
> Fetch the complete documentation index at: https://arize-ax.mintlify.site/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Detailed walkthrough (AWS)

> Step-by-step guidance for AWS values.yaml fields, base64 encoding, IAM, S3 buckets, and installing with arize.sh or Helm.

## Before you start

* Complete [Download and extract the distribution](/ax/selfhosting/getting-started/download-and-unpack-the-distribution). Work from the extracted folder that contains `arize.sh`, `arize-operator-chart.tgz`, and your `values.yaml`.
* Align your cluster with [EKS cluster and AWS resources](/ax/selfhosting/installation/aws/cluster-existing-eks), or provision it with [Terraform](/ax/selfhosting/installation/aws/cluster-terraform).
* Contact Arize AI for `clusterSizing`. It must match your cluster capacity.
* Keep the [AWS quick start](/ax/selfhosting/installation/aws/install-arize-quickstart) open as a template.
* Treat `values.yaml` as sensitive. Store generated passwords and keys in your secret manager, not in git history.

For every field that must be base64-encoded, use:

```bash theme={null}
printf '%s' '<plain-text-value>' | base64 | tr -d '\n'
```

## 1. Verify cluster access and clusterName

Configure `kubectl` for your EKS cluster:

```bash theme={null}
aws eks update-kubeconfig --region <region> --name <cluster-name>
kubectl get nodes
```

Set `clusterName` to the EKS cluster ARN:

```yaml theme={null}
clusterName: "arn:aws:eks:<region>:<account-id>:cluster/<cluster-name>"
```

## 2. Seed hubJwt

Store the runtime registry JWT Arize AI provided under `hubJwt`, base64-encoded:

```yaml theme={null}
hubJwt: "<JWT_BASE64>"
```

## 3. Set cloud and region

```yaml theme={null}
cloud: "aws"
region: "<region>"
```

Use the same region as the EKS cluster and S3 buckets.

## 4. Point to S3 buckets

Set the bucket names you prepared for Gazette and ArizeDB:

```yaml theme={null}
gazetteBucket: "<gazette-bucket-name>"
druidBucket: "<adb-bucket-name>"
```

If your buckets use server-side encryption, set `serverSideEncryption` to the value approved by your AWS platform team. Leave it empty only when that is intentional.

## 5. Configure IAM

If using IRSA, set the role ARN that has read/write access to the Gazette and ArizeDB buckets:

```yaml theme={null}
awsServiceAccountRoleRwBucket: "arn:aws:iam::<account-id>:role/<read-write-role>"
```

If not using IRSA, omit `awsServiceAccountRoleRwBucket` and make sure the node role has the required S3 and KMS permissions from [EKS cluster and AWS resources](/ax/selfhosting/installation/aws/cluster-existing-eks).

## 6. Set secrets, organization, and sizing

Choose a Postgres password and cipher key, base64-encode them, and set the organization and sizing values:

```yaml theme={null}
postgresPassword: "<POSTGRES_PASSWORD_BASE64>"
cipherKey: "<CIPHER_KEY_BASE64>"
organizationName: "<name of the organization or company>"
clusterSizing: "<sizing option>"
```

## 7. Set appBaseUrl

Set the URL users will use for the Arize AX UI after ingress and DNS exist:

```yaml theme={null}
appBaseUrl: "https://<arize-app.domain>"
```

You can update this after ingress is finalized, but the installed application should eventually advertise the hostname users will keep.

## 8. Optional private registry

If the cluster must pull images from your registry, set both registry values:

```yaml theme={null}
pushRegistry: "<account-id>.dkr.ecr.<region>.amazonaws.com"
pullRegistry: "<account-id>.dkr.ecr.<region>.amazonaws.com"
```

## 9. Install with arize.sh or Helm

Using `arize.sh`:

```bash theme={null}
./arize.sh install
```

Using Helm directly:

```bash theme={null}
helm upgrade --install -f values.yaml arize-op arize-operator-chart.tgz
```

Both approaches install the operator chart using the same `values.yaml`.

## Next steps

* [Configure ingress on AWS](/ax/selfhosting/installation/aws/ingress-aws-load-balancer)
* [Validate the deployment](/ax/selfhosting/installation/validate-deployment)