AWS - Hilt Documentation

Hilt runs as a single-tenant platform inside your own AWS account. Ingest tasks run on ECS Fargate behind a PrivateLink + NLB endpoint, the dashboard (frontend, backend, and query service) runs on ECS Fargate behind an internal ALB, enrichment and classification workloads run on EKS, and ClickHouse runs on a dedicated EC2 instance. Collectors stream telemetry through the private ingest endpoint into MSK (Kafka), and all traffic stays inside your account with no public internet exposure.

Services

Service	Role
ECS Fargate	Ingest service (behind NLB + PrivateLink) and dashboard services (frontend, backend, query — behind internal ALB)
EKS	Managed Kubernetes for enrichment and classification workloads
EC2	Dedicated instance for ClickHouse analytics database (optionally ClickHouse Cloud via PrivateLink)
MSK (Kafka)	Event streaming
PrivateLink	Private ingest endpoint: collectors connect without traversing the public internet
S3	Cold storage tiering, data-export staging, and app configuration
RDS (PostgreSQL)	Dashboard database
ACM + Route 53	TLS certificates and private DNS

Network topology

Collectors connect to a VPC Endpoint (PrivateLink) in your account
All traffic stays within AWS private networking
No inbound internet access to any platform component
Outbound internet access only where needed for image pulls (configurable to use private registries)

Provisioning

Hilt provisions your AWS deployment using Terraform. The typical process:

You provide a target AWS account with the agreed IAM permissions
Hilt applies the Terraform configuration to create all infrastructure (ECS, EKS, EC2, MSK, RDS, S3, PrivateLink, and networking)
PrivateLink connectivity is established between your workload VPCs and the platform VPC
Collectors are deployed to your hosts using the Linux and macOS collector guides