Skip to main content

Prerequisites and IAM Permissions

Before installing AI Cockpit: Smart Engineering on Amazon EKS, prepare the cluster, S3 buckets, and runtime IAM permissions.

Cluster and tooling prerequisites​

Before starting the deployment, make sure you have:

  • An active AWS account with permission to subscribe to AWS Marketplace products
  • An Amazon EKS cluster with kubectl access
  • helm installed locally
  • A default storage class in the cluster for PostgreSQL and Valkey volumes
  • An ingress controller if you want to expose the application with public DNS names

Confirm that your local access is working:

aws eks update-kubeconfig --region us-east-1 --name <cluster-name>
kubectl get nodes
helm version

Required S3 buckets​

The product requires three buyer-managed buckets:

  • one for source uploads
  • one for generated outputs
  • one for workspace artifacts

Example:

smart-eng-source
smart-eng-output
smart-eng-workspace

These bucket names are passed to the Helm chart during installation.

For Amazon EKS, the recommended runtime identity model is IRSA.

This means:

  • the pods run with a dedicated Kubernetes service account
  • that service account is mapped to an IAM role
  • the application uses temporary AWS credentials through the standard AWS credential chain

Create the Kubernetes service account​

Create a namespace and a dedicated service account:

kubectl create namespace aic-modernization
kubectl create serviceaccount aic-modernization -n aic-modernization

After the IAM role is created, the service account should look like this:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: aic-modernization
  namespace: aic-modernization
  annotations:
    eks.amazonaws.com/role-arn: arn:aws:iam::<account-id>:role/aic-modernization-marketplace
Service Account Disclaimer

Some Marketplace installation flows pass ${AWSMP_SERVICE_ACCOUNT} as an input value, but they do not always create the Kubernetes service account automatically. If that happens in your environment, create the service account manually before running the Helm install or upgrade command.

Required IAM permissions​

The runtime IAM role must allow access to:

  • AWS Marketplace metering
  • AWS License Manager consumption APIs
  • the three S3 buckets
  • Amazon Bedrock model invocation
  • Bedrock model catalog discovery

Attach permissions for:

  • AWSMarketplaceMeteringRegisterUsage
  • AWSMarketplaceMeteringFullAccess
  • AWSLicenseManagerConsumptionPolicy
  • s3:ListBucket
  • s3:GetObject
  • s3:PutObject
  • s3:DeleteObject
  • bedrock:InvokeModel
  • bedrock:InvokeModelWithResponseStream
  • bedrock:ListFoundationModels

Example IAM policy​

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "MarketplaceAndLicense",
      "Effect": "Allow",
      "Action": [
        "aws-marketplace:MeterUsage",
        "aws-marketplace:RegisterUsage",
        "license-manager:CheckoutLicense",
        "license-manager:GetAccessToken"
      ],
      "Resource": "*"
    },
    {
      "Sid": "S3Buckets",
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::<source-bucket>",
        "arn:aws:s3:::<output-bucket>",
        "arn:aws:s3:::<workspace-bucket>"
      ]
    },
    {
      "Sid": "S3Objects",
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject",
        "s3:DeleteObject"
      ],
      "Resource": [
        "arn:aws:s3:::<source-bucket>/*",
        "arn:aws:s3:::<output-bucket>/*",
        "arn:aws:s3:::<workspace-bucket>/*"
      ]
    },
    {
      "Sid": "BedrockRuntime",
      "Effect": "Allow",
      "Action": [
        "bedrock:InvokeModel",
        "bedrock:InvokeModelWithResponseStream"
      ],
      "Resource": [
        "arn:aws:bedrock:us-east-1::foundation-model/<primary-model-id>",
        "arn:aws:bedrock:us-east-1::foundation-model/<secondary-model-id>"
      ]
    },
    {
      "Sid": "BedrockCatalog",
      "Effect": "Allow",
      "Action": [
        "bedrock:ListFoundationModels"
      ],
      "Resource": "*"
    }
  ]
}

Marketplace runtime behavior​

The application validates Marketplace entitlement as part of the runtime flow, but buyers do not need to provide a Marketplace license secret parameter in the install command for the current deployment path documented in this module.