> ## Documentation Index
> Fetch the complete documentation index at: https://hilt.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS

> Hilt's single-tenant deployment architecture and provisioning on AWS.

Hilt runs as a single-tenant platform inside your own AWS account. Ingest tasks run on ECS Fargate behind a PrivateLink + NLB endpoint, the dashboard (frontend, backend, and query service) runs on ECS Fargate behind an internal ALB, enrichment and classification workloads run on EKS, and ClickHouse runs on a dedicated EC2 instance. Collectors stream telemetry through the private ingest endpoint into MSK (Kafka), and all traffic stays inside your account with no public internet exposure.

***

## Services

| Service | Role |
| :- | :- |
| ECS Fargate | Ingest service (behind NLB + PrivateLink) and dashboard services (frontend, backend, query — behind internal ALB) |
| EKS | Managed Kubernetes for enrichment and classification workloads |
| EC2 | Dedicated instance for ClickHouse analytics database (optionally ClickHouse Cloud via PrivateLink) |
| MSK (Kafka) | Event streaming |
| PrivateLink | Private ingest endpoint: collectors connect without traversing the public internet |
| S3 | Cold storage tiering, data-export staging, and app configuration |
| RDS (PostgreSQL) | Dashboard database |
| ACM + Route 53 | TLS certificates and private DNS |

***

## Network topology

* Collectors connect to a **VPC Endpoint** (PrivateLink) in your account
* All traffic stays within AWS private networking
* No inbound internet access to any platform component
* Outbound internet access only where needed for image pulls (configurable to use private registries)

***

## Provisioning

Hilt provisions your AWS deployment using Terraform. The typical process:

1. You provide a target AWS account with the agreed IAM permissions
2. Hilt applies the Terraform configuration to create all infrastructure (ECS, EKS, EC2, MSK, RDS, S3, PrivateLink, and networking)
3. PrivateLink connectivity is established between your workload VPCs and the platform VPC
4. Collectors are deployed to your hosts using the [Linux](https://hilt.ai/docs/linux-collector/layout.md) and [macOS](https://hilt.ai/docs/macos-collector/layout.md) collector guides


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.