This page lists what a self-hosted workspace creates in your AWS account and how to run it. For how the parts fit together, how each one is secured and what stays in your account, start with Architecture and security.
At a glance
| Deployment | One CloudFormation stack, normally named AutobotAI-Workspace, in your AWS account |
| Regions | us-east-1 and ap-south-1. More regions are being added; contact support to confirm yours |
| Workspaces per account | One per account and region |
| Address | https://<workspace name>.autobot.live |
| Availability | Compute across more than one availability zone in one region. Cross-region disaster recovery is available with Enterprise support; multi-region active-active is not supported |
Resources the stack creates
The root stack contains three nested stacks:
| Nested stack | What it creates |
|---|---|
| PersistStack (data and network) | A VPC with one public subnet, two private subnets, a NAT gateway with an Elastic IP and an S3 gateway endpoint; an Amazon DocumentDB cluster; an Amazon Cognito user pool; Amazon DynamoDB tables; Amazon S3 buckets; an AWS AppSync Events API; and the workspace configuration secret in AWS Secrets Manager |
| NewDisposableStack (compute) | AWS Lambda functions (container images), Amazon API Gateway, an Amazon ECS cluster and task definitions, Amazon SQS queues, Amazon SNS topics and AWS Step Functions |
| DefaultIntegrationStack | The IAM role for the default integration with the same AWS account |
The stack also creates IAM roles for each component, CloudWatch log groups, and an Amazon SES identity for the administrator email. Setup steps, such as creating the administrator user, running database migrations and syncing the integration catalog, run as Lambda-backed custom resources. If one fails, see Troubleshoot a deployment.
Workspace resource names contain -live-<workspace name>, for example abAI-PostWSLambda-live-<workspace name>.
Data storage
| Data | Stored in |
|---|---|
| Workflows, integration configuration and audit data | Amazon DocumentDB |
| Workflow metadata and execution history | Amazon DynamoDB |
| Integration credentials and workspace configuration | AWS Secrets Manager |
| Application logs | Amazon CloudWatch Logs |
| Files, imports and exports | Amazon S3 |
No data leaves your AWS account unless you connect an external model provider, export data or set up cross-region replication. See What stays in your account, and what leaves.
Encryption
At rest. Data stores are encrypted with AWS KMS, using AWS managed keys by default. Customer-managed keys and custom rotation schedules are available with Enterprise support. Key usage is logged in AWS CloudTrail when CloudTrail is enabled on the account.
In transit.
| Path | Protection |
|---|---|
| Browser to API Gateway and AppSync | HTTPS, TLS 1.2 or later |
| API Gateway to Lambda | AWS internal, over TLS |
| Lambda and ECS to DocumentDB | TLS |
| Lambda and ECS to AWS services | HTTPS through the AWS SDK |
| Integration service to your tools | HTTPS, as each tool's API requires |
Network
- VPC. A dedicated VPC for the workspace. Custom CIDR ranges are available for Enterprise deployments.
- Public subnet. Holds only the NAT gateway and its Elastic IP. Nothing in it accepts inbound connections.
- Private subnets. Two private subnets hold the Lambda functions' network interfaces, ECS tasks and the DocumentDB cluster. None has a public IP.
- Outbound traffic. Lambda functions and ECS tasks reach your tools, model providers, autobotAI's container registry and AWS services through the NAT gateway. S3 traffic uses the S3 gateway endpoint and stays on the AWS network.
- Security groups. Each tier allows only the traffic it needs; DocumentDB accepts connections only from the workspace's compute. Don't open extra ports without a security review.
Tip: All outbound traffic leaves from the NAT gateway's Elastic IP. If a tool restricts API access by source IP, allow-list that address.
Caution: Blocking the NAT gateway or its routes stops setup steps, upgrades and calls to your tools. Plan network changes with support.
Least privilege
- Deployment. Deploy with an IAM user or role that has
AdministratorAccess, never the account's root user. Remove that access after deployment and give people only what daily operation needs. - Service roles. The stack creates a role for each component, scoped to the resources it uses. Review them, but don't change their policies unless autobotAI support asks you to: upgrades expect them as deployed.
- Ongoing review. Review roles and policies each quarter with IAM Access Analyzer, remove what is unused, and keep AWS CloudTrail enabled to audit sensitive API calls.
For more controls you can add on top, see Add your own guardrails.
Sizing and scaling
| Service | How it scales |
|---|---|
| AWS Lambda | Automatically with demand. Concurrency counts against your account's regional Lambda quota, so raise it for heavy workloads |
| Amazon ECS on Fargate | Tasks start as work arrives |
| Amazon DynamoDB | Automatically |
| Amazon DocumentDB | Fixed instance size (db.t3.medium by default) with storage that grows automatically |
No manual capacity planning is needed for typical use. For large deployments, Enterprise customers can change the DocumentDB instance class and count, ECS task limits and VPC CIDR ranges.
Costs
AWS bills these services to your account. autobotAI's subscription is billed separately through AWS Marketplace.
| AWS service | Used for | Billed by | Required |
|---|---|---|---|
| AWS Lambda | Workflows and the API | Requests and duration | Yes |
| Amazon ECS on Fargate | Agents and long runs | vCPU and memory per second | Yes |
| Amazon DocumentDB | Workflows, configuration, audit data | Instance hours, storage and I/O | Yes |
| Amazon DynamoDB | Metadata and execution history | Reads, writes and storage | Yes |
| Amazon API Gateway | The API | Requests | Yes |
| AWS AppSync | Live updates | Events and connection minutes | Yes |
| Amazon Cognito | Sign-in | Monthly active users | Yes |
| NAT gateway | Outbound access | Hours and data processed | Yes |
| Amazon SQS, SNS, Step Functions | Coordinating runs | Requests and state transitions | Yes |
| AWS Secrets Manager | Credentials and configuration | Secrets per month and API calls | Yes |
| Amazon CloudWatch | Logs, metrics and schedules | Data ingested and stored | Yes |
| Amazon S3 | Files, imports and exports | Storage and requests | Yes |
| AWS KMS | Encryption | API calls, plus a monthly fee per customer-managed key | Yes |
| Amazon Bedrock | AI models | Tokens | If you use Bedrock |
| AWS CloudTrail | Your audit of API calls | Events delivered | Optional, recommended |
The largest fixed costs are usually the DocumentDB instances and the NAT gateway; the rest grows with use. Estimate with the AWS Pricing Calculator.
Upgrades
autobotAI runs on managed AWS services, so there are no servers or operating systems for you to patch.
- autobotAI releases new workspace versions with backend code, container images and, when needed, database changes.
- You start an upgrade from the Workspaces page and choose the version.
- The upgrade updates the Lambda functions, ECS task definitions and database in your account. If it fails, you can retry it from the same page.
- Plan upgrades in a maintenance window. Major database engine upgrades have their own guide: Upgrade the workspace database.
Health monitoring
In autobotAI. Watch run outcomes in Bot executions, and set up system notifications to hear about failures.
In AWS. CloudWatch Logs hold the logs of the Lambda functions (for example /aws/lambda/abAI-PostWSLambda-live-<workspace name>), ECS tasks and API Gateway. Useful CloudWatch metrics include:
- Lambda invocations, duration, errors and throttles
- ECS CPU and memory use
- DynamoDB throttled requests
- DocumentDB CPU, connections and free memory
- API Gateway requests, latency and errors
If a deployment, upgrade or deletion fails, see Troubleshoot a deployment.