# Prerequisites

> Before you deploy Self-Hosted Deployment to Amazon Web Services

## Access to Amazon Web Services

Ensure that you have the following access to Amazon Web Services (AWS):

* An AWS account
* A role with sufficient permissions to create and manage resources

## Tooling

Ensure that you have this tooling:

* Access to a terminal, and basic knowledge of the command line

* One of these tools if you use Microsoft Windows:

  * Windows Subsystem for Linux (WSL)
  * Git for Windows

* [AWS Command Line Interface (CLI)](https://docs.aws.amazon.com/cli/latest/userguide/install-cliv2.html), to set up a Terraform backend

* [Helm](https://helm.sh/docs/intro/install/), to install helm charts

* [GNU Make](https://en.wikipedia.org/wiki/Make_\(software\)), to run various convenience targets

* [ORAS CLI](https://oras.land/docs/installation), to download the required scripts and packaging

* [Terraform](https://developer.hashicorp.com/terraform/tutorials/aws-get-started/install-cli), to provision cloud resources

* [yq](https://github.com/mikefarah/yq/#install), to generate helm values

* [jq](https://jqlang.org/download/), to read .json configuration

## Networking

You must have Amazon Virtual Private Cloud (Amazon VPC).

These practices are recommended:

* To ensure that public exposure is restricted, provide a VPC with private subnets to the deployment configuration.
* Avoid using the default VPC, because you run the risk of exposing services to the internet through misconfigured security groups.

To modify your configuration before deployment, refer to the [deployment overview](./_index.md).

## System requirements

Ensure that you have these elements:

* A Unity Version Control (UVCS) server to store asset data. The deployment can run the UVCS server inside the Kubernetes cluster (`enable_uvcs = true`), which is the recommended setup, because you don't need to provide a separate server. The in-cluster server requires a valid UVCS license, which you provide as a base64-encoded value through the `uvcs_license` Terraform variable.

  Alternatively, to connect an existing UVCS server outside the cluster, set `enable_uvcs = false` and provide the `uvcs_url`, `uvcs_authorization`, and `uvcs_repository_guid` Terraform variables. An external server must meet these minimum requirements:

  * Version: 11.0.16.10181 or later
  * vCPUs: 4
  * Memory: 12 GB
  * The Kubernetes cluster must be able to communicate with the server.
* A valid hostname that can be updated to point to the IP of the Load Balancer.
* A valid Unity Asset Transformer SDK license to run transformations on assets.

  A valid Unity Asset Transformer license is required for all users who perform asset transformations. The platform uses static licenses, so a floating license server is not required.

## Kubernetes

The deployment requires a Kubernetes cluster.

We recommend that you use Kubernetes version 1.30. Newer versions are likely compatible but we haven't extensively tested them.

Choose whether to deploy Self-Hosted Deployment to a new cluster or to an existing cluster:

* For a new cluster, the installation process can also deploy all the required dependencies.
* For an existing cluster, ensure that you already have all the required dependencies.

### Dependencies

These third-party dependencies are required:

* [External Secrets Operator](https://external-secrets.io/latest), to access and sync cloud-native secrets into the cluster
* [Kubernetes Autoscaler](https://github.com/kubernetes/autoscaler), or a comparable node autoscaler, to automatically scale workloads up and down
* [Argo Workflows](https://argoproj.github.io/workflows), to enable transformations and 3D streaming

You can install each dependency with its respective Helm charts.

### Namespaces

Services come preconfigured for use within a single Kubernetes namespace. You configure the target namespace when configuring deployment.

### Network policies

During deployment to an existing cluster, you may need to control the flow of network traffic by using network policies. You can deploy most Kubernetes resources in a single namespace, which you can you use to scope network isolation from other services that run in your cluster.

### Service meshes

We recommend that you don't use service meshes, such as Istio, because they can cause network issues and performance issues. If you are running a cluster-wide service mesh, we recommend that you disable it on the namespace where you have deployed the system.

## Regions

Self-Hosted Deployment supports these regions:

* ap-south-1
* ap-south-2
* ap-southeast-1
* ap-southeast-2
* ca-central-1
* eu-central-1
* eu-northeast-1
* eu-south-1
* eu-west-1
* eu-west-2
* eu-west-3
* sa-east-1
* us-east-1
* us-east-2
* us-west-1
* us-west-2

To add support for additional regions, modify the instance types in the Terraform configuration. Modify these variables:

* aws\_db\_instance\_postgres\_instance\_type
* aws\_eks\_node\_group\_instance\_types
* aws\_ec2\_mongo\_instance\_type
* aws\_ec2\_flexlm\_instance\_type

## Security

Before deployment, read about [security enforcement](./security.md).

## Next steps

[Deploy Self-Hosted Deployment](./deployment.md)