Deploy AWS GovCloud Infrastructure with Terraform

Copy link to this section

C3 AI infrastructure scripts / HashiCorp Terraform deployment

HashiCorp Terraform is a popular open-source tool for creating safe and predictable cloud infrastructure across several cloud providers. Terraform scripts are used to create the cloud infrastructure required by the C3 Agentic AI Platform and automate the deployment of the C3 Agentic AI Platform in your AWS account.

Copy link to this section

Initial configuration

Ahead of the C3 AI infrastructure deployment, you will need the tools mentioned in Tools and Libraries installed on the host that will perform the install. In addition, you will also need the following Terraform providers:

• registry.terraform.io/hashicorp/aws: 6.28.0
• registry.terraform.io/hashicorp/local: 2.5.2
• registry.terraform.io/hashicorp/null: ~> 3.2
• registry.terraform.io/hashicorp/tls: 4.0.5
• registry.terraform.io/hashicorp/cloudinit: 2.3.3

Note that the exact Terraform module versions will vary from version to version of the C3 AI Platform - be sure to use the exact versions referenced in the C3 AI Terraform modules.

For air-gapped systems and installs, you will need to locally download these modules for the appropriate bastion host architecture and make them available to the bastion host, either via local mirrors or hosted mirrors like JFrog Artifactory.

For portability, we recommend locally downloading and referencing the Terraform modules. You can do so with the following commands:

mkdir -p ./modules/3.0.17/ ./modules/bootstrap/ ./modules/c3cluster/
curl -u "myuser:mypassword" -o "./modules/3.0.17.zip" https://jfrog.c3.ai/artifactory/tf-registry/c3/aws/c3/3.0.17.zip
unzip ./modules/3.0.17.zip -d ./modules/3.0.17

Note that:

• 3.0.17 is the C3 AI Terraform module version for C3 AI Platform version v8.11. Reach out to your C3 AI Center of Excellence for the right version for your install
• myuser:mypassword is the C3 AI registry credentials, same as those for registry.c3.ai. Reach out to your C3 AI Center of Excellence for these.

Before executing any of the Terraform commands, you will need to have configured AWS CLI on the host that you intend on running the infrastructure deployment scripts from.

Copy link to this section

Bootstrap module

The bootstrap module sets up the necessary permissions for the c3cluster module to be ran. See below for an example configuration of a Terraform overlay for C3 AI’s bootstrap module.

bootstrap/main.tf

Create a new file at “./bootstrap/main.tf”. Edit it and paste in the following contents:

module "bootstrap" {
  source       = "../modules/3.0.17/modules/bootstrap"
  cluster_name = "stgawscustomer"
  region       = "us-gov-west-1"
  account_id   = "123456789012"
  partition    = "aws-us-gov"
  trusted_identifier_arns = [
    "arn:aws-us-gov:iam::123456789012:role/c3-user-role-name"
  ]
  tags = { "mycustomtag1" : "example", "mycustomtag2" : "example" }
}
terraform {
  backend "s3" {
    bucket  = "my-terraform-state-bucket"
    key     = "stgawscustomer-bootstrap.tfstate"
    region  = "us-gov-west-1"
    encrypt = true
  }
}
provider "aws" {
  region = "us-gov-west-1"
}

Be sure to configure or set the following:

• “source” / the version in the module reference may need to change for your install depending on the infrastructure version.
• Replace “stgawscustomer” with your cluster name (see Preferred Cluster Naming Convention).
• Change “region” to your desired region. Be sure to communicate this to the C3 AI Center of Excellence.
• Account ID should be changed to your actual AWS GovCloud Account ID.
• Partition should be adjusted as needed.
• “trusted_identifier_arns” should change to the AWS IAM Role(s) that you will assign to C3 AI infrastructure administrator personnel.
• “tags” are optional and will add tags to all resources.
• “backend” should change to the remote location that you intend on storing the Terraform state

C3 AI provisions an AWS WAF by default on the public-facing Application Load Balancer (ALB), enabled out of the box and governed by the following variables: managed_waf_rules, waf_rate_based_rules, waf_enforce_managed_rules, and waf_cloudwatch_logging_enabled.

Customers with an existing firewall or edge protection solution must disable the C3-provisioned WAF to avoid duplicate or conflicting controls. To disable the WAF, set the following in your c3cluster configuration: waf_enforce_managed_rules = false.

The bootstrap module contains additional variables - if you need additional configuration parameters, look at the file at “modules/3.0.17/modules/bootstrap/variables.tf”.

Deployment

Once you have configured the bootstrap main.tf file, you will need to run the following to initialize the Terraform install:

cd bootstrap
terraform init

This step will attempt to pull down all dependent Terraform providers and initialize your state backend.

Once that succeeds, you will need to then execute a Terraform plan:

terraform plan -out tfplan

Finally, once you have reviewed the plan and ensured its accuracy for your installation, then you can deploy the bootstrap infrastructure via the following:

terraform apply tfplan

Once the bootstrap infrastructure is successfully deployed, the C3 AI infrastructure administrator personnel can proceed with the c3cluster installation.

Copy link to this section

C3Cluster module

For reference, the c3cluster module configuration is outlined below. The c3cluster module deploys all the compute and storage workloads as well as some additional IAM roles and policies. The overall deployment process is like bootstrap. Note that c3cluster can only be deployed after the bootstrap module has been successfully deployed.

c3cluster/main.tf

Create a new file at “./c3cluster/main.tf”. Edit it and paste in the following contents:

module "c3cluster" {
  source       = "../modules/3.0.17"
  cluster_name = "stgawscustomer"
  c3_region    = "us-gov-west-1"
  account_id   = "123456789012"
  ip_allowlist = [{
    cidr_blocks  = ["1.2.3.4/32"],
    display_name = "C3 Allowed IPs"
  }]
  eks_version = "1.34"
  vpc_endpoint_use_fips = true
  eks_authorized_ips = ["10.1.2.3/32"]
  pg_instance_class = "db.m6i.xlarge"
  default_nodegroup_http_tokens = "required"
  enable_delete_protection = true
  eks_default_node_pools = {
    "c3ondemand" = {
      machine_type = "r6i.4xlarge"
      http_tokens  = "required"
    }
    "c3spot" = {
      machine_type = "r6i.4xlarge"
      http_tokens  = "required"
    }
    "c3fallback" = {
      machine_type = "r6i.4xlarge"
      http_tokens  = "required"
    }
    "c3gpu" = {
      machine_type = "g4dn.metal"
      http_tokens  = "required"
    }
    "c3obs" = {
      machine_type = "c6i.2xlarge"
      http_tokens  = "required"
    }
    "c3logs" = {
      machine_type = "r6i.2xlarge"
      http_tokens  = "required"
    }
    "c3cass" = {
      machine_type = "r6i.xlarge"
      http_tokens  = "required"
    }
  }
  tags = { "mycustomtag1" : "example", "mycustomtag2" : "example" }
}
terraform {
  backend "s3" {
    bucket  = "my-terraform-state-bucket"
    key     = "stgawscustomer-c3cluster.tfstate"
    region  = "us-gov-west-1"
    encrypt = true
  }
}
provider "aws" {
  region = "us-gov-west-1"
}

Be sure to configure or set the following:

• “pg_password” must be changed to a strong, unique password via terraform.tfvars or via a secrets manager. Never deploy with the module default.
• Ensure interface endpoints are routed to GovCloud FIPS-validated endpoints
• “source” / the version in the module reference may need to change for your install depending on the infrastructure version.
• Replace “stgawscustomer” with your cluster name (see Preferred Cluster Naming Convention).
• Change “region” to your desired region.
• Account ID should be changed to your actual AWS GovCloud Account ID.
• “tags” are optional and will add tags to all resources.
• “backend” should change to the remote location that you intend on storing the Terraform state. The exact state bucket and key must differ from bootstrap.
• “ip_allowlist” should be changed to contain the CIDR ranges of end user and C3 AI administrative IPs that should be allowed to access the C3 AI Platform deployment web interface.
• “eks_authorized_ips” should be changed to the CIDR ranges of IPs that should be allowed to access the EKS Kubernetes API endpoint. This likely will be a range or IP of your EC2 bastion host, a range of C3 AI VPN IPs if remote management is permitted.
• In general, “instance_class” and “machine_type” may need to be adjusted to reflect the machine types available in your region.

The c3cluster module contains many additional variables - if you need additional configuration parameters, look at the file at “modules/3.0.17/variables.tf”. There are also examples for various common configurations at “modules/3.0.17/examples”.

Deployment

Once you have configured the c3cluster main.tf file, you will need to run the following to initialize the Terraform install:

cd c3cluster
terraform init

This step will attempt to pull down all dependent Terraform providers and initialize your state backend.

Once that succeeds, you will need to then execute a Terraform plan:

terraform plan -out tfplan

Finally, once you have reviewed the plan and ensured its accuracy for your installation, then you can deploy the bootstrap infrastructure via the following:

terraform apply tfplan

Infrastructure deployment for c3cluster usually takes several minutes due to the startup times of EKS and RDS. Once the c3cluster infrastructure is successfully deployed, the C3 AI infrastructure administrator personnel can then proceed with the Helm installation of the C3 AI Agentic Platform if the engineer has sufficient access to the EKS cluster (i.e. private EKS deployment necessitates bastion host).

Copy link to this section

Network resources

Below is a table of external network resources required for specific C3 AI Platform functionality, descriptions as to purpose and requirement, and suitable hosted alternatives in air-gapped or egress-limited environments.

For private or air-gapped deployments where nodes cannot reach public endpoints, configure VPC interface endpoints using the vpc_endpoint_services variable. Supply the required service short-names (e.g., eks, ecr.api, ecr.dkr, sts, kms, logs, monitoring, secretsmanager, elasticloadbalancing, ec2, ssm). For GovCloud/FedRAMP environments, also set vpc_endpoint_use_fips = true to use FIPS-compliant endpoints.

Copy link to this section

Egress (outbound)

Note that all these resources are listed for outbound / egress access (from the cluster to the Internet), not ingress. If a resource is listed as required and has alternatives listed, then any one of the alternatives suffices in place of the original resource. List of hosted alternatives may not be exhaustive.

Core Deployment + Platform

Language Package Repositories

Source Code + ML Model Repositories

C3 AI Central Managed Services

Application / User Case Specific

Copy link to this section

Ingress (inbound)

Inbound access is generally only required from end user IP ranges over HTTP(S) ports and from specific administrative IPs for SSH access if solutions like AWS SSM are not being used. This table specifically lists external to internal traffic, not traffic privately routed between deployed resources.

Copy link to this section

Preferred cluster naming convention

The cluster name is used throughout the deployment to name AWS resources, IAM roles, security groups, subnets, and Kubernetes objects. Choosing a name that follows the required convention is critical. Cluster names can be configurable to support customer requirements. Changing a cluster name after deployment requires rebuilding infrastructure.

Cluster name should be alphanumerical, lowercase, and at most 15 characters long.