Self-Hosting on AWS

Included on the Enterprise plan. Book a demo, opens in a new tab. Not included on the Team plan. Not included on the Starter plan. Not included on the Free plan.

Run the full Confident AI platform on AWS, inside your own account and region. A published Terraform module stands up an EKS cluster, a managed RDS PostgreSQL database, and S3 object storage, and the confident-ai Helm chart deploys the application on top. The app reaches S3 through EKS Pod Identity, so there are no access keys, and no IRSA or OIDC wiring to manage.

You run it in two steps: Infrastructure provisions the cloud resources with Terraform, then Deploy with Helm installs the app and exposes it over HTTPS. Plan for roughly 15 to 20 minutes of Terraform time plus a few minutes for the chart to come up.

What Terraform provisions

The module deploys into a VPC you already have. It never creates one.

Amazon EKS

A cluster with a managed node group and the EBS CSI and Pod Identity add-ons.

Amazon RDS for PostgreSQL

The app's primary database, private in your subnets, Multi-AZ with automated backups.

Amazon S3

Two buckets, one for test cases and one for payloads, private and encrypted at rest.

EKS Pod Identity

An IAM role bound to the app's Kubernetes ServiceAccount, scoped to the buckets and the sandbox. No access keys, no IRSA.

Lambda code executor

Required for code-based and transformer metrics: a sandboxed Lambda that runs the mirrored image.

Secrets Manager + ElastiCache

Recommended: a secret for the External Secrets Operator, and managed Redis.

ClickHouse runs inside the cluster (the Helm chart installs it). The recommended setup keeps secrets in Secrets Manager and runs Redis on ElastiCache; in-cluster Redis and a Kubernetes Secret remain available as a simpler option. Cluster add-ons such as an ingress controller or the External Secrets Operator are your choice and are not installed by Terraform.

How it fits together

Identity is keyless. The app pods run as a Kubernetes ServiceAccount tied to an IAM role through an EKS Pod Identity association. That role has least-privilege access to the two buckets and permission to invoke the Lambda sandbox. There is nothing static to store or rotate, and the ServiceAccount needs no annotation.
The data plane is private. Nodes and RDS sit in private subnets and reach the internet only through a NAT gateway. You choose whether the cluster API endpoint is public (handy for kubectl and helm from your laptop) or private-only.
Traffic flows one way in. Your applications send traces to confident-otel, which writes them to ClickHouse. The dashboard and API read from RDS and ClickHouse. Evaluations run in confident-evals and its workers, calling your model provider and the Lambda sandbox for code and transformer metrics. Datasets and payloads live in S3.

Deployed services

The Helm chart installs these workloads into the confident-ai namespace:

Service	Role
`confident-backend`	Core API
`confident-frontend`	The dashboard
`confident-evals`	Evaluation service
`confident-evals-worker`	Async evaluation jobs
`confident-ingestion-worker`	Trace ingestion
`confident-worker`	Background jobs
`confident-otel`	OTLP and trace collector
ClickHouse and Keeper	Trace and span store
Redis	Cache and queues (in-cluster unless you use ElastiCache)

See Scaling for how each of these grows with load.

Defaults

Component	Default
Node group	4 x `m6i.2xlarge`
Region	From your AWS provider and profile (no region variable)
Cluster endpoint	Private (`confident_public_eks = true` to reach it from your machine)
RDS	Multi-AZ, private, deletion protection available
Storage class	None by default, you create a gp3 default on the Infrastructure page

Everything above is overridable in the Terraform module. See the module inputs for the full list.

The module

The module is published to the Terraform Registry and its source lives on GitHub.

Terraform Registry

confident-ai/confident-ai/aws

Source on GitHub

terraform-aws-confident-ai

Prerequisites

terraform (≥ 1.5), the aws CLI, kubectl, helm (≥ 3.8), and docker (to mirror the code sandbox image).
AWS credentials (aws configure or SSO) allowed to create EKS, RDS, S3, and IAM.
From Confident AI: image pull credentials and a CONFIDENT_LICENSE_KEY (see Deploy with Helm).

Next steps

Infrastructure

Provision EKS, RDS, and S3 with Terraform.

Deploy with Helm

Install the app and expose it over HTTPS.

Planning a private deployment?Get a clear deployment path across cloud, security, and rollout needsTalk to deployment team