Customer VPC

Purple8 Hyper Graph (v0.72.0) and the Purple8 AML Platform are deployed into the customer's own AWS account and VPC using Purple8-supplied infrastructure as code. The customer, or a system integrator acting on the customer's behalf, operates the deployment. Data, encryption keys, logs and backups never leave the customer's account.

Scope

Aspect	Responsibility
AWS account, VPC, IAM boundary	Customer
Infrastructure provisioning	Customer or system integrator, using Purple8 Terraform or CloudFormation
Installation and upgrades	Customer or system integrator
Operations, monitoring, on-call	Customer or system integrator
Backups and disaster recovery	Customer, using built-in backup tooling to the customer's S3
Software updates	Purple8 publishes container images; customer applies
Purple8 access	None by default. Optional break-glass role granted by the customer for support engagements.

Reference architecture

Single AWS region. Two availability zones minimum. All compute in private subnets.

 AWS Region (customer account)
 ┌──────────────────────────────────────────────────────────────────────┐
 │  Route 53 ─► CloudFront ─► S3 (Investigator UI static assets)        │
 │                  │                                                   │
 │                  ▼                                                   │
 │  AWS WAF ─► Application Load Balancer (ACM TLS)                      │
 │                  │                                                   │
 │   ┌──────────────┼──────────────────────────────────────────────┐    │
 │   │ Private subnets                                             │    │
 │   │                                                             │    │
 │   │  AZ-a                            AZ-b                        │    │
 │   │  ┌────────────────────┐          ┌────────────────────┐      │    │
 │   │  │ Purple8 Graph      │ WAL      │ Purple8 Graph      │      │    │
 │   │  │ primary (EC2)      ├─────────►│ replica (EC2)      │      │    │
 │   │  │ EBS gp3 / io2      │ SYNC     │ EBS gp3 / io2      │      │    │
 │   │  └────────────────────┘          └────────────────────┘      │    │
 │   │                                                             │    │
 │   │  ECS Fargate: Purple8 DocIntel (tasks across AZ-a, AZ-b)     │    │
 │   │  ElastiCache (Valkey) — DocIntel job store, optional         │    │
 │   └─────────────────────────────────────────────────────────────┘    │
 │                                                                      │
 │  VPC endpoints: S3, KMS, Secrets Manager, CloudWatch, Bedrock, ECR    │
 │  S3 (backups, versioned, SSE-KMS)   AWS KMS (customer-managed keys)   │
 │  Secrets Manager   CloudWatch Logs / Metrics   Amazon Bedrock         │
 └──────────────────────────────────────────────────────────────────────┘
          │                                   │
          ▼                                   ▼
  Customer IdP (OIDC / SAML)          Customer SIEM (egress webhooks,
  via IAM Identity Center or           CloudWatch subscription, OTEL)
  external provider

Component placement

Component	AWS service	Placement	Notes
Investigator UI	S3 + CloudFront	Edge	Static SPA. Optionally restricted with CloudFront + WAF geo and IP rules, or served from an internal ALB for private access only.
Purple8 Graph primary	EC2 + EBS	Private subnet, AZ-a	Serves writes and reads. Reference compute; see Compute options.
Purple8 Graph replica	EC2 + EBS	Private subnet, AZ-b	WAL replica; serves GET/HEAD via the read target group. Runs the failover watchdog; promoted on primary failure.
Purple8 DocIntel	ECS Fargate	Private subnets, both AZs	Stateless. Autoscale on CPU or queue depth.
DocIntel job store	ElastiCache for Valkey	Private subnets	Required when running more than one DocIntel task.
Inference	Amazon Bedrock via VPC endpoint	Regional	Keeps inference within the account and region. Alternatives: Ollama on EC2 or ECS with GPU; external provider via NAT.
Key management	AWS KMS	Regional	Customer-managed key wraps the data encryption key.
Secrets	AWS Secrets Manager	Regional	JWT signing secret, API keys, provider credentials, replication auth token.
Backups	Amazon S3	Regional, optional cross-region replication	Versioned bucket, SSE-KMS, Object Lock optional.
Logs and metrics	CloudWatch; Prometheus scrape of `/metrics`	Regional	OTEL export to customer collector optional.
Identity	Customer IdP	External	OIDC or SAML federation configured in Purple8 Graph.

Compute options for Purple8 Graph

	EC2 + EBS (reference)	ECS Fargate + EFS (alternative)
WAL commit path	Local block device; `fdatasync` sub-millisecond	NFS; `fdatasync` typically 1–3 ms
Throughput predictability	Provisioned IOPS (io2) or gp3 baseline	Governed by EFS throughput mode
High availability	WAL replication to replica in second AZ; in-process failover watchdog promotes and swaps the ALB write target group	EFS is multi-AZ; replacement task in another AZ remounts the same file system
Recovery point	RPO ≈ 0 with `SYNC` replication	RPO = 0 (single file system)
Recovery time	Seconds; follower already warm	Minutes; new task starts and replays WAL
Operations	AMI patching, instance lifecycle (Auto Scaling group of size 1 per role)	No instance management
Writers per instance	One	One
Supplied IaC	CloudFormation `deployment/cloudformation/aws/purple8-aml-instance.yaml`	Terraform module `deployment/terraform/aws`

EC2 + EBS is the reference for production AML workloads. ECS Fargate + EFS is appropriate for evaluation, development, and lower-throughput instances where minimal instance management outweighs WAL latency.

Availability and resiliency

Failure	Behaviour
Primary EC2 instance or AZ-a	The AZ-b replica probes the primary `/health` every 5 s; after 6 consecutive failures (`FailoverUnhealthyThreshold`) it promotes itself via `POST /replication/promote` and registers itself in the ALB write target group, deregistering the old primary. It also records its slot in the SSM primary-slot parameter and repoints the `primary.` CNAME. No operator action to restore writes. Cooldown 60 s prevents flapping.
Old primary rebuilt by its ASG	Roles are not hard-coded in launch templates. The new instance reads the primary-slot parameter at boot, sees the other slot is primary and starts as a follower. If the parameter cannot be read it fails closed (exit 1, ASG retries) instead of guessing. Its EBS volume must be wiped or restored from the new primary's backup before it resyncs (diverged WAL tail).
Primary instance replaced while primary	The rebuilt node boots primary; if the replica promoted in the meantime, `PrimarySlotFence` on the rebuilt node observes the parameter change within the probe interval and freezes writes (`503`). Terminate it; its replacement boots as follower.
Follower	Primary continues. In `SYNC` mode with `sync_replicas: 1` and no follower available, writes block up to `sync_timeout_s` then commit locally; alert raised.
EBS volume	Restore from S3 incremental backup, or promote follower. EBS snapshots as a secondary control.
DocIntel task	ECS replaces the task. In-flight jobs are marked failed and can be resubmitted.
Region	Out of scope for a single-region deployment. Cross-region options: ASYNC follower in a second region (warm standby), or S3 cross-region replication of backups (cold standby).

Recovery targets depend on instance size and replication mode; they should be measured during acceptance testing, not assumed.

Regions and data residency

One instance is confined to one region. Storage, keys, logs and backups are regional.
For multiple jurisdictions, deploy one instance per region. See One-to-Many in AWS Deployment Patterns.
Amazon Bedrock inference is regional. Confirm model availability in the target region.
Cross-region backup replication moves data across borders and must be evaluated against residency requirements.

Security

All Purple8 compute in private subnets. Ingress only via ALB. Egress via VPC endpoints; NAT gateway only if an external inference provider or IdP requires it.
Customer-managed KMS key for envelope encryption (AwsKmsProvider), EBS, S3 and CloudWatch Logs.
IAM roles per component (Graph instance profile, DocIntel task role) with least privilege: KMS Decrypt/GenerateDataKey, S3 backup bucket, Secrets Manager read, Bedrock InvokeModel.
Security groups: ALB → Graph 8080 (commercial image); Graph primary → replica 8101; DocIntel → Graph 8080; nothing else inbound.
CloudTrail, GuardDuty and Config remain under the customer's account governance.
SIEM: egress sinks deliver HMAC-signed change events; audit trail queried at GET /admin/audit; CloudWatch Logs subscription filter to the customer's SIEM.

Provisioning

Purple8 supplies:

CloudFormation template deployment/cloudformation/aws/purple8-aml-instance.yaml (reference EC2 + EBS topology), parameterized by region, VPC, subnets, AZs, instance type, volume type and size, KMS key ARN, replication mode, inference provider and IdP settings. One stack per instance.
Terraform module deployment/terraform/aws for the ECS Fargate + EFS variant.
Container images in Purple8's registry, or mirrored to the customer's Amazon ECR.
Investigator UI build artifacts.

The customer or system integrator applies the stack, configures the IdP and inference provider, and completes acceptance testing.

Support model

Purple8 has no standing access. For support engagements the customer may grant a time-bound IAM role with read-only or scoped permissions, revocable at any time.

When to choose Customer VPC

Regulatory requirement that the platform run inside the institution's own cloud account.
Existing AWS landing zone, security tooling and governance that must apply uniformly.
Platform team or system integrator available to operate the deployment.
Multiple jurisdictions where each instance must sit in a specific region under the customer's control.

Customer VPC ​

Scope ​

Reference architecture ​

Component placement ​

Compute options for Purple8 Graph ​

Availability and resiliency ​

Regions and data residency ​

Security ​

Provisioning ​

Support model ​

When to choose Customer VPC ​