> For the complete documentation index, see [llms.txt](https://docs.zerve.ai/zerve-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.zerve.ai/zerve-docs/self-hosting/aws-cloudformation-reference.md). # AWS CloudFormation reference Everything the AWS QuickStart's CloudFormation stack creates in your account. This page lists what the [AWS QuickStart](/zerve-docs/self-hosting/aws-quickstart.md) stack creates in your AWS account. For the access it gives Zerve, see [What Zerve can access in your AWS account](/zerve-docs/self-hosting/aws-access.md). ## Access | Resource | Purpose | | --------------------------------- | ------------------------------------------------------------------------------------------------------------ | | **The `zerve` IAM role** | Lets Zerve manage the other resources. Usable only by Zerve, with your organization's ID as the external ID. | | **Compute roles** | Separate roles for Lambda, Fargate and SageMaker runs, each with only what that kind of compute needs | | **A notebook-scoped access role** | Limits each block run to its own notebook's data | ## Networking If you don't choose an existing VPC, the stack creates: | Resource | Details | | ----------------------- | ------------------------------------------------------------------------------------------------------------------------- | | **A VPC** | `10.192.0.0/16` by default | | **Subnets** | Two public and two private, across two Availability Zones | | **An internet gateway** | For public traffic | | **NAT gateways** | One in each Availability Zone, with fixed IP addresses, so your code's outbound traffic always comes from known addresses | It also creates security groups for block runs, deployments and the setup process. ## Storage | Resource | Details | | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------- | | **An S3 bucket** | Holds block outputs, variables and files. Named `-`. Each notebook's data is kept in its own folder. | ## Compute and environments | Resource | Details | | ------------------------------ | -------------------------------------------------------------------- | | **An ECS cluster** | Runs container blocks and deployments | | **A CodeBuild project** | Builds environments | | **ECR container repositories** | Store environment images. Untagged images are removed after 14 days. | | **A log group for builds** | Build logs are kept for 90 days | ## Deployments Created only if you set a **base domain**: | Resource | Details | | -------------------------- | ----------------------------------------------------------------------------------------------------------------- | | **An SSL certificate** | For your base domain, validated through DNS | | **A Route 53 hosted zone** | For your base domain, unless you provided one | | **A load balancer** | For deployed apps. Internet-facing, HTTPS only (HTTP redirects to HTTPS), and limited to the IP ranges you allow. | | **API gateways** | For deployed APIs and SageMaker model endpoints, each with its own certificate | Deployments get these addresses: | Type | Address | | ------------------ | -------------------------------- | | **App** | `.app.` | | **API** | `.api.` | | **Model endpoint** | `.sagemaker.` | ## Setup | Resource | Details | | -------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **A setup function** | Runs once while the stack is created, and sends Zerve the details it needs: the account, role, region, bucket, networking, NAT gateway IP address, hosted zone and load balancer | ## What's kept when you delete the stack Deleting the stack removes most of its resources. These are **kept on purpose**, so DNS and networking aren't lost by accident: * The **Route 53 hosted zone** * The main **security groups** Delete them yourself if you no longer need them. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.zerve.ai/zerve-docs/self-hosting/aws-cloudformation-reference.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.