{"id":20581549,"url":"https://github.com/langgenius/aws-cdk-for-dify","last_synced_at":"2025-11-03T16:19:31.167Z","repository":{"id":254930322,"uuid":"847658036","full_name":"langgenius/aws-cdk-for-dify","owner":"langgenius","description":"AWS CDK for Dify","archived":false,"fork":false,"pushed_at":"2025-02-25T05:47:06.000Z","size":3678,"stargazers_count":27,"open_issues_count":2,"forks_count":6,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-03-28T08:11:41.913Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/langgenius.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-08-26T09:42:19.000Z","updated_at":"2025-03-27T06:41:14.000Z","dependencies_parsed_at":"2024-08-27T02:35:48.307Z","dependency_job_id":"c1bbf105-e633-4f64-bb45-a15c2dedf161","html_url":"https://github.com/langgenius/aws-cdk-for-dify","commit_stats":null,"previous_names":["langgenius/aws-cdk-for-dify"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/langgenius%2Faws-cdk-for-dify","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/langgenius%2Faws-cdk-for-dify/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/langgenius%2Faws-cdk-for-dify/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/langgenius%2Faws-cdk-for-dify/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/langgenius","download_url":"https://codeload.github.com/langgenius/aws-cdk-for-dify/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":248951807,"owners_count":21188419,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-16T06:29:19.459Z","updated_at":"2025-11-03T16:19:31.125Z","avatar_url":"https://github.com/langgenius.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Dify Enterprise on AWS\n\nDeploy Dify Enterprise on AWS using CDK.\n\n![1719058485616](images/README/infra.jpg)\n\n# Components\n\n### Testing Deployment\n\n| **Component**   | **Helm Chart Value** | **Count** | **vCPU** | **Memory (GB)** | **Storage (GB)** | **Notes** |\n| --------------- | -------------------- | --------- | -------- | --------------- | ---------------- | --------- |\n| S3              | persistence          | 1         |          |                 |                  |           |\n| Redis DB        | externalRedis        | 1         | 2        | 6.38            |                  |           |\n| RDS Postgres DB | externalPostgres     | 2         | 2        | 8               |                  |           |\n| K8S Worker Node |                      | 1         | 4        | 16              | 100              |           |\n| OpenSearch      | vectorDB             | 1         | 2        | 16              | 100              |           |\n\n### Production Deployment\n\n| **Component**   | **Helm Chart Value** | **Count** | **vCPU** | **Memory (GB)** | **Storage (GB)** | **Notes** |\n| --------------- | -------------------- | --------- | -------- | --------------- | ---------------- | --------- |\n| S3              | persistence          | 1         |          |                 |                  |           |\n| Redis DB        | externalRedis        | 1         | 2        | 12.93           |                  |           |\n| RDS Postgres DB | externalPostgres     | 1         | 4        | 32              |                  |           |\n| K8S Worker Node |                      | 6         | 8        | 32              | 100              |           |\n| OpenSearch      | vectorDB             | 2         | 8        | 64              | 100              |           |\n\n\n\n# Deployment\n\n\u003e The whole process is expected to take 60 mins\n\n1. ### Configure AWS CLI:\n\n   Install and configure the [AWS CLI](https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html):\n\n   ```bash\n   aws configure\n   ```\n\n2. ### Clone this repository:\n\n   ```bash\n   git clone https://github.com/langgenius/aws-cdk-for-dify.git\n   ```\n\n3. ### Install NodeJS Dependencies:\n\n   ```bash\n   npm install\n   ```\n\n4. ### Configure environment variables:\n\n   ```bash\n   cp .env.example .env\n   ```\n\n   Modify the environment variable values in the `.env` file.\n\n   - `ENVIRONMENT`: Specifies the deployment environment; must be either `test` or `prod`.\n\n   - `CDK_DEFAULT_REGION`: The AWS region where Dify Enterprise will be deployed.\n\n   - `CDK_DEFAULT_ACCOUNT`: Your AWS account ID.\n\n   - `DEPLOY_VPC_ID`: The ID of an existing VPC for deployment. If not set, CDK will create one for you.\n\n   - **Note:** **If using an existing VPC**\n\n     - Make sure you have 2 or more **public** subnets for Application Load Balancer, and 2 or more **private** subnets can access internet(associated with NAT) to pull docker image from internet.\n\n     - Add **Tag** for the subnets(**Otherwise**, Step 6 will show WARN about auto-tag failed, which will result in the Application Load Balancer failing to be created successfully.):\n\n       | Subnet Type | Tag key                         | tag value |\n       | ----------- | ------------------------------- | --------- |\n       | public      | kubernetes.io/role/elb          | 1         |\n       | private     | kubernetes.io/role/internal-elb | 1         |\n\n   - Subnets Configuration (`DEPLOY_VPC_ID` required, comma-separated without spaces, **private subnets** is recommended by AWS security best practices):\n\n     - `EKS_CLUSTER_SUBNETS`: Subnet IDs for the EKS control plane. Requires at least 2 subnets in different Availability Zones (AZs).\n     - `EKS_NODES_SUBNETS`: Subnet IDs for the EKS worker nodes. Requires at least 2 subnets in different AZs.\n     - `REDIS_SUBNETS`: Subnet IDs for Redis deployment.\n     - `RDS_SUBNETS`: subnet ids for RDS database. (At least 2 with different AZs)\n     - `OPENSEARCH_SUBNETS`: Subnet IDs for OpenSearch deployment.\n     - `OPENSEARCH_ADMINNAME`: OpenSearch Domain master ame.\n     - `OPENSEARCH_PASSWORD`: OpenSearch Domain master password.\n\n   - `AWS_EKS_CHART_REPO_URL`: (For AWS China regions ONLY) The AWS EKS Helm chart repository URL.\n\n   - `RDS_PUBLIC_ACCESSIBLE`: Set to `true` to make RDS publicly accessible (NOT RECOMMENDED).\n\n   **Note:**\n\n   - If you are using AWS China regions, you must configure the `AWS_EKS_CHART_REPO_URL` for proper functionality. Please contact Dify Team for the URL.\n   - It is recommended to use an existing VPC for easier resource access.\n\n5. ### CDK Bootstrap:\n\n   Initialize the CDK environment:\n\n   ```bash\n   npm run init\n   ```\n\n6. ### CDK Deploy:\n\n   - Deploy Dify Enterprise:\n\n     ```bash\n     npm run deploy\n     ```\n\n7. ### Update AWS EKS Access Permissions:\n\n   1. Navigate to the EKS Cluster panel, select the \"Access\" menu, and click on \"Manage access\":\n      ![Dify-Testing-DifyStackTest-EKS](images/README/eks-access-panel.png)\n   2. In the \"Manage access\" dialog, select \"EKS API and ConfigMap,\" then click \"Save Changes.\"\n   3. In the IAM Access Entries panel, click \"Create access entry\":\n      ![IAM access entries](images/README/eks-iam-access.png)\n   4. Add your IAM user and assign the following permissions:\n      - `AmazonEKSAdminPolicy`\n      - `AmazonEKSAdminViewPolicy`\n      - `AmazonEKSClusterAdminPolicy`\n\n8. ### Configure `kubeconfig` to access the Kubernetes (K8S) cluster locally:\n\n   ```bash\n   aws eks update-kubeconfig --region \u003ccn-northwest-1\u003e --name \u003cDify-Testing-DifyStackTest-EKS\u003e\n   ```\n\n   Adjust the `region` and `name` parameters according to your deployment:\n\n   - **region:** The AWS region where your cluster is deployed.\n   - **name:** The EKS cluster name .\n\n9. ### Data Persistence Configure:\n\n   Change the Helm `values.yaml` file. To enable it, modify the `persistence` section as follows, replace {your-region-name} and {your-s3-bucket-name} with the name of resource created by CDK, make sure you have turn `useAwsManagedIam` on:\n\n   ```yaml\n   persistence:\n     type: \"s3\"\n     s3:\n       endpoint: \"https://s3.{your-region-name}.amazonaws.com\"\n       region: \"{your-region-name}\"\n       bucketName: \"{your-s3-bucket-name}\"\n       useAwsManagedIam: true\n   ```\n\n10. ### Database Configure:\n\n    Change the Helm `values.yaml` file, **remove** `postgre` section, and modify the `externalPostgres` section as follows, replace {your-postgres-endpoint} and {your-postgres-password} with data stored in the **Secret Manager** of AWS:\n\n    ```yaml\n    postgre:\n      enabled: false\n    externalPostgres:\n      enabled: true\n      address: \"{your-postgres-endpoint}\"\n      port: 5432\n      credentials:\n        dify:\n          database: \"postgres\"\n          username: \"clusteradmin\"\n          password: \"{your-postgres-password}\"\n          sslmode: \"disable\"\n        enterprise:\n          database: \"postgres\"\n          username: \"clusteradmin\"\n          password: \"{your-postgres-password}\"\n          sslmode: \"disable\"\n    ```\n\n11. ### Redis Configure:\n\n    Change the Helm `values.yaml` file, **remove** `redis` section, and modify the `externalRedis` section as follows, replace {your-redis-host} with `Primary endpoint` in console of  **ElastiCache-Redis OSS caches**\n\n    **Note:** **remove** the port number of the `Primary endpoint`\n\n    ```yaml\n    redis:\n      enabled: false\n    externalRedis:\n      enabled: true\n      host: \"{your-redis-host}\"\n      port: 6379\n      username: \"\"\n      password: \"\"\n      useSSL: false\n    ```\n\n12. ### VectorDatabase Configure:\n\n    Change the Helm `values.yaml` file,  modify the `externalType` section as follows:\n     1. replace `{openSearch_endpont}` with aws Opensearch instant's **Domain endpoint**, remove `https://` and use the left.\n     2. replace the `\u003cOPENSEARCH_ADMINNAME\u003e` and `\u003cOPENSEARCH_PASSWORD\u003e` with the value you have set in `.env`\n\n    ```yaml\n    vectorDB:\n      useExternal: true\n      externalType: \"opensearch\"\n      externalOpenSearch:\n        host: \"{openSearch_endpont}\"\n        port: 443\n        user: \"\u003cOPENSEARCH_ADMINNAME\u003e\"\n        password: \"\u003cOPENSEARCH_PASSWORD\u003e\"\n        useTLS: true\n    ```\n\n13. ### Set docker image pull secret\n\n    You need to set the docker image pull secret before installing Dify Enterprise.\n    \n    **Note:** If you haven't got the username and password, please contact us, email address:[Support@dify.ai](support@dify.ai)\n\n15. ### TLS\n\n    #### For testing:\n\n    If you are just testing the deploy process, you can just ignore this step and go on.\n\n    #### For production:\n\n    Go to AWS `ACM` to require the certificates of the domain you declared in helm chart configuration file `values.yaml`:\n\n    ```yaml\n      consoleApiDomain: \"console.xxxx.com\"\n      consoleWebDomain: \"console.xxxx.com\"\n      serviceApiDomain: \"api.xxxx.com\"\n      appApiDomain: \"app.xxxx.com\"\n      appWebDomain: \"app.xxxx.com\"\n      filesDomain: \"upload.xxxx.com\"\n      enterpriseDomain: \"enterprise.xxxx.com\"\n    ```\n\n    they are:\n\n    ```yaml\n    console.xxxx.com\n    api.xxxx.com\n    app.xxxx.com\n    upload.xxxx.com\n    enterprise.xxxx.com\n    ```\n\n    go to your domain service provider (e.g. cloud flare, aws route53, etc.) and setup the `cname` to prove your ownership of these domains.\n\n    **change the values.yaml param: global.useTLS**\n\n    ```\n      useTLS: true\n    ```\n\n16. ### AWS Load Balancer Configuration\n\n    It is recommended to use an AWS Application Load Balancer (ALB) for your ingress configuration in the Helm `values.yaml` file. To enable it, modify the `ingress` section as follows:\n\n    **For testing:**\n\n    ```yaml\n    ingress:\n        enabled: true\n        className: \"alb\"\n        annotations: {\n            # Existing annotations\n            ...\n            # Add the following annotations\n            alb.ingress.kubernetes.io/target-type: \"ip\",\n            alb.ingress.kubernetes.io/scheme: \"internet-facing\",\n        }\n    ```\n\n    **For production:**\n\n    refer to: [AWS load balancer controller setup](https://kubernetes-sigs.github.io/aws-load-balancer-controller/v2.9/guide/ingress/cert_discovery/)\n\n    ```yaml\n    ingress:\n      enabled: true\n      className: \"alb\"\n      annotations: {\n        # set file upload size limit\n            alb.ingress.kubernetes.io/target-type: \"ip\",\n            alb.ingress.kubernetes.io/scheme: \"internet-facing\",\n            alb.ingress.kubernetes.io/listen-ports: '[{\"HTTPS\":443}]'\n      }\n    ```\n\n17. ### Install Dify Enterprise\n\n    Dify Enterprise is deployed using Helm. \n\n    ```bash\n    helm repo add dify https://langgenius.github.io/dify-helm\n    helm repo update\n    \n    helm upgrade -i dify -f values.yaml dify/dify\n    ```\n\n18. ### Access Dify Enterprise\n\n    #### For testing:\n\n    After setting up, get the temperally external IP of the ALB.\n\n    ```bash\n    ping {aws_alb_dns}\n    ```\n\n    Then add the following line to your `/etc/hosts` file.\n\n    ```bash\n    4.152.1.216 console.dify.local\n    4.152.1.216 app.dify.local\n    4.152.1.216 api.dify.local\n    4.152.1.216 upload.dify.local\n    4.152.1.216 enterprise.dify.local\n    ```\n\n    #### For production\n\n    Go to your Domain service provider, and set up DNS to the ALB address(Go to AWS-EC2-Load Balancer to get the dns of alb):\n\n    | domain              | cname     |\n    | ------------------- | --------- |\n    | api.xxxx.com        | \u003calb_dns\u003e |\n    | app.xxxx.com        | \u003calb_dns\u003e |\n    | upload.xxxx.com     | \u003calb_dns\u003e |\n    | enterprise.xxxx.com | \u003calb_dns\u003e |\n    | console.xxxx.com    | \u003calb_dns\u003e |\n\n    \n\n19. ### Verify Installation\n\n    **Warning**: You have to set up Dify Console `http://console.dify.local` first before login to Dify Enterprise Dashboard `http://enterprise.dify.local`.\n\n    - Dify Console: visit `http://console.dify.local` and finish the installation.\n\n    - Enterprise Dashboard: visit `http://enterprise.dify.local`, and login with the default email and password. You can change the password after login.\n\n      ```\n      email: dashboard@dify.ai\n      password: difyai123456\n      ```\n\n    \n\n# Destroy\n\n\u003e The process may take 20 mins.\n\nDestroy the deployment for the environment specified in the `.env` file under `ENVIRONMENT`.\n\n```bash\nnpm run destroy\n```\n\n**Note**: login to AWS console, review the VPC, and make sure the VPC created by CDK has destroyed, if not, please Check `Cloudformation` and perform the deletion operation.\n\n# Advanced Configuration\n\n### Advanced Configuration\n\nTo customize deployment configurations, modify the [test.ts](./configs/test.ts) file for the testing environment or the [prod.ts](./configs/prod.ts) file for the production environment.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flanggenius%2Faws-cdk-for-dify","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flanggenius%2Faws-cdk-for-dify","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flanggenius%2Faws-cdk-for-dify/lists"}