AWS Marketplace

This guide walks a buyer through the AWS Marketplace journey for Nomain: subscribing to the listing, completing the Nomain set-up form, launching the CloudFormation stack into your own AWS account with one click, and signing in. The platform runs entirely in your account (BYOC). This is the purchase and onboarding view; the companion AWS BYOC deployment summary covers the full architecture your platform team provisions.

How it works

Nomain is delivered on AWS Marketplace as a Bring-Your-Own-Cloud (BYOC) container product. You subscribe on the Marketplace, complete a short Nomain set-up form, and launch a CloudFormation stack into your own AWS account. There is no Nomain-operated data plane. From your first call with Nomain to a working sign-in is six steps: subscribe on the Marketplace, then everything runs in your AWS account.

Requirements

Everything Nomain needs to deploy and run in your AWS account, in one place: the Bedrock models, the IAM the deploy needs, the compute and data capacity, and the two networking modes. All of it is provisioned by the single CloudFormation stack, with no separate set-up step afterwards. The companion AWS BYOC deployment guide expands each item with operator-level detail.

Foundation models: Amazon Bedrock

Nomain runs inference entirely on Amazon Bedrock in your account, reached over a private interface VPC endpoint (no public egress for inference). Three models must have model access approved in your target Region before you launch; the set-up form only offers Regions where all three are generally available. A fourth, the high-capacity orchestrator, is optional and only needed if you opt into it (see the table).

The IDs below are the bare base-model IDs the stack uses; it normalizes each to your Region's cross-region inference profile at invoke time (no global. prefix needed). In the Bedrock console you grant model access on the underlying base model (e.g. Claude Sonnet 4.6).

Role	Bedrock model ID	Used for
Chat	anthropic.claude-sonnet-4-6	Chat orchestration, knowledge-graph extraction, code reasoning.
Orchestrator (optional)	anthropic.claude-opus-4-6-v1	Higher-capacity model for the chat agent's orchestration loop and final answer. Opt in via the OrchestratorModel stack parameter; leave it empty and the orchestrator runs on the Chat model. If you set it, approve access and raise its RPM quota in this Region too.
Fast / low-latency	anthropic.claude-haiku-4-5-20251001-v1:0	Low-latency helper tasks and the fallback model.
Embeddings	amazon.titan-embed-text-v2:0	Vector embeddings for semantic search (pgvector).

Minimum Bedrock quotas to provision. Inference is the only AWS limit that surfaces as user-facing throttling. Fresh accounts Nomain has onboarded start at a soft-launch floor of ~10 requests/minute per Claude model, far below what the analysis pipeline needs (it issues roughly one inference per code-graph node), so it throttles immediately on the first documentation job. Raise the requests-per-minute quota before you launch; the tokens-per-minute quotas already ship at their full default and need no change. The AWS defaults cited below are the published values from the AWS Bedrock quotas documentation.

Model	Requests / min (RPM)	Tokens / min (TPM)
Claude Sonnet 4.6	raise to ≥ 1,000 (AWS default 10,000); fresh accounts start at 10	6,000,000 (default, no change)
Claude Opus 4.6 (optional)	only if you opt into the orchestrator tier: raise off the soft-launch floor toward the AWS default 10,000. Chat-orchestration volume sits well below the analysis pipeline, so a modest RPM is enough	3,000,000 (default, no change)
Claude Haiku 4.5	raise to ≥ 1,000 (AWS default 10,000); fresh accounts start at 10	5,000,000 (default, no change)
Titan Text Embeddings v2	per-Region default (sufficient)	default

Allow 1-2 business days for first-time model access

Anthropic models trigger a one-time Region review that usually clears within 1-2 business days (later requests in the same Region are instant). Raise the RPM quota in the same pass, via Service Quotas → Amazon Bedrock. Because the self-service form rejects any value below the default, restoring a soft-launched account from 10 to the 10,000 default is done through an AWS Support service-limit-increase case. Size RPM to your estate: measured across Nomain analyses, roughly one inference per code-graph node at ~1,000 tokens per call, so a 100M+ LoC estate wants the full 10,000 RPM. See the AWS BYOC deployment guide, sections 5 and 10.4.

IAM to deploy the stack

The principal that creates the stack needs permission to create the resources the template provisions, and must acknowledge two CloudFormation capabilities. This is your own deploying principal: no standing Nomain access is involved, and it needs no ongoing access once the stack is up.

Area	AWS services the stack creates
Core infrastructure	EC2 / VPC (subnets, route tables, IGW, NAT, EIPs, security groups, VPC endpoints, flow logs), RDS, S3, KMS
Security & identity	IAM (named roles & policies), Secrets Manager, WAFv2, CloudTrail
Compute & ingress	ECS (Fargate), Elastic Load Balancing v2 (ALB), Lambda, Application Auto Scaling, Cloud Map (service discovery)
Platform & observability	CloudWatch (Logs, alarms, dashboard), EventBridge, SQS, SNS, SSM Parameter Store

Simplest grant: attach AdministratorAccess to the deploying principal for the duration of the first deploy (long-running operators can scope down to the per-service action list afterwards). At Create stack, acknowledge CAPABILITY_NAMED_IAM (the stack creates named, least-privilege per-service IAM roles) and CAPABILITY_AUTO_EXPAND (it uses nested stacks). The Marketplace Quick Launch flow surfaces both check-boxes for you.

Compute & data capacity

The platform is one ECS Fargate cluster of five services and one RDS PostgreSQL 17 + pgvector instance. Sizing is a handful of stack parameters with Medium defaults; pick the bucket that matches your estate and adjust at launch (or later). ServiceCpu / ServiceMemory apply to the four application services (webapp, graphs-api, chats-api, recipes-api); the recipes-worker is sized separately via RecipesWorkerCpu / RecipesWorkerMemory (default 8192 / 32768, i.e. 8 vCPU / 32 GB), because AST analysis and embeddings are memory-heavy, and it scales to 0 when idle.

Bucket	Estate · users	ServiceCpu	ServiceMemory	DBInstanceClass	DB storage
Small	≤ 10M LoC · ≤ 25 users	256 (0.25 vCPU)	512 MiB	db.r6g.large	200 GB
Medium (default)	~30M LoC · ~50 users	1024 (1 vCPU)	2048 MiB	db.r6g.xlarge	500 GB
Large	100M+ LoC · 150+ users	2048 (2 vCPU)	4096 MiB	db.r6g.2xlarge	1 TB

Every service auto-scales 1 to 4 tasks (the Recipes Worker scales to 0 when idle, so you pay no Fargate while there is no analysis work). RDS storage autoscales up to DBMaxAllocatedStorage (2 TB default). The default Fargate vCPU quota (2,000 / Region) covers any bucket: a Medium stack sits at ~4 vCPU idle and ~48 vCPU at full scale-out (16 across the four app services plus up to 32 for the recipes-worker at 8 vCPU/task). Multi-AZ HA adds an RDS standby and a second NAT Gateway; it does not change task shapes.

Networking

One VPC (default 10.10.0.0/16, set via VpcCidr) holds the whole platform across four subnet tiers: public, private compute, private data, and isolated (RDS). Everything except the webapp load balancer is private; AWS services are reached over VPC endpoints. You choose the webapp's exposure at launch via the WebAppAccess parameter; it cannot be flipped on a running stack (the ALB would need replacing). See AWS networking for the full topology.

WebAppAccess = Public (default): public webapp. An internet-facing ALB (fronted by AWS WAF) in the public subnets. You provide:

• An ACM certificate for your domain, in the same Region as the stack (DNS-validated, free).
• A public CNAME / Route 53 A-Alias from your domain to the ALBDnsName output.

Reachable from the internet over HTTPS; sign-in is still gated by WorkOS.

WebAppAccess = Internal (full-private): private webapp + VPN. An internal-scheme ALB in the private subnets, no public IP, not resolvable or reachable from the internet. You provide:

• An ACM certificate for your domain, in the same Region as the stack; HTTPS terminates at the internal ALB too.
• Private connectivity into the VPC: Transit Gateway, Direct Connect, Site-to-Site VPN, VPC peering, or AWS Client VPN.
• Your client / on-prem range allowed via VpnClientCidr (added to the ALB security group alongside the VPC CIDR).
• A record in a private hosted zone (not public DNS) pointing at the ALB.

Subscribe & licensing

Two touch-points with Nomain bookend the set-up: a one-time call with a Nomain sales consultant to obtain your BYOL license key, and the self-service Nomain set-up form reached from the Marketplace.

Step 1: talk to Nomain first

Contact your Nomain sales consultant to retrieve your license key. At that time, give Nomain the domain your users will reach (e.g. nomain.example.com). Nomain authorizes it in WorkOS (sign-in redirect, logout redirect, and CORS origin) so browser sign-in works the moment your stack is live.

Step 2: subscribe & register

Open the Nomain listing on AWS Marketplace (or search "Nomain" in the AWS Console), Subscribe, and accept the terms, then follow the usage instructions to the Nomain set-up form, a short three-step wizard:

1. Before you begin. Confirm Bedrock model access (Claude Sonnet 4.6, Claude Haiku 4.5, Titan Text Embeddings v2) is enabled in your Region, then enter your AWS account ID (grants the account image-pull access) and your Nomain license key from Step 1.
2. Your details. Admin email (receives the first-admin invitation), your SSO domain, and the deployment Region (only Regions where every required Bedrock model is available are listed).
3. Infrastructure. Review Nomain's recommended defaults: deployment size (Small / Medium / Large), Multi-AZ HA, backup & audit-log retention, deletion protection, an optional alerts email, an optional ACM certificate ARN for HTTPS, and the VPC CIDR. Adjust here, or later on the CloudFormation screen.

Submitting the wizard hands you off to AWS CloudFormation with your Tenant ID and M2M credentials pre-embedded; you never see or handle them directly (see Launch the stack).

Licensing model: BYOL through AWS Marketplace. Your BYOL license key comes from your Nomain sales consultant (Step 1) and your entitlement is bound to your AWS account at activation. The license is validated at runtime via the M2M channel; a tenant whose subscription lapses stops validating and the stack reports as inactive. One subscription maps to one AWS account.

Billing is two separate streams under BYOL. You pay AWS for the infrastructure the stack consumes (on your normal AWS bill), and you pay Nomain for the product license, purchased through your Nomain sales consultant. The AWS Marketplace listing is the BYOL delivery and subscription mechanism; it does not meter or charge the Nomain license.

Launch the stack

The Quick Launch URL from the set-up form opens the CloudFormation Console in your account with the Nomain template pre-loaded and the tenant-binding parameters filled in for you. You add the handful of account-specific values and create the stack.

1. Open the Quick Launch URL. CloudFormation opens with main.yaml pre-loaded; TenantId and the M2M ClientId/Secret are pre-filled (read-only).
2. Set the account-specific parameters (see the table below). The only mandatory ones for HTTPS are CertificateArn and EnvironmentName; everything else has a sensible default.
3. Acknowledge CAPABILITY_NAMED_IAM and CAPABILITY_AUTO_EXPAND, then Create stack.
4. Wait for CREATE_COMPLETE, roughly 28 min multi-AZ (the default) or 20 min single-AZ in Nomain's test deployments. The stack only reports complete once every ECS service is healthy and ALB targets pass health checks.
5. Wire DNS and sign in (see Go-live checklist).

Parameter	Default	Notes
CertificateArn	you supply	ACM certificate ARN for the ALB; must be issued in the same Region as the stack.
EnvironmentName	production	Environment label for the deployment.
OrchestratorModel	inherits ChatModel	Optional high-capacity Bedrock model for the chat orchestrator + final answer (e.g. anthropic.claude-opus-4-6-v1, a bare ID normalized to the Region's inference profile at runtime). Leave empty to run the orchestrator on the Chat model; if set, enable Bedrock access for it in this Region.
MultiAz	true	Default true = multi-AZ HA (RDS standby + per-AZ NAT, tasks across two AZs); set false for single-AZ (lowest cost, non-prod).
ServiceCpu / ServiceMemory	1024 / 2048	CPU units / MiB applied to each of the four application services (medium-estate defaults).
RecipesWorkerCpu / RecipesWorkerMemory	8192 / 32768	CPU units / MiB for the recipes-worker (AST + embeddings), 8 vCPU / 32 GB, sized independently of the app services; scales to 0 when idle.
RecipesWorkerMaxCount	5	Maximum recipes-worker Fargate tasks the SQS-backlog autoscaler may run in parallel (min stays 0, scale-to-zero when idle). Higher = more throughput and more Fargate cost.
DBInstanceClass / DBAllocatedStorage	db.r6g.xlarge / 500	RDS PostgreSQL instance class and initial gp3 storage.
AlarmNotificationEmail	empty	Email subscribed to the CloudWatch alarms SNS topic at create time; can be wired post-deploy.

What gets deployed

One CloudFormation stack, one AWS account, one Region. A single VPC holds the whole platform across four subnet tiers (public ALB, private compute, private data, private VPC endpoints). Five application services run as ECS Fargate tasks; only the webapp is public-facing.

Category	Resource
Compute	ECS Fargate cluster + 5 services: webapp · graphs-api · chats-api · recipes-api · recipes-worker
Database	RDS PostgreSQL 17 + pgvector, KMS-encrypted, IAM DB Authentication, Multi-AZ on the HA topology
Object storage	Amazon S3, SSE-KMS, versioned, Block Public Access on
Foundation models	Amazon Bedrock via interface VPC endpoint, no public-Internet egress for inference
Ingress	ALB + AWS WAF + ACM (HTTPS termination, managed WAF rule sets)
Network	VPC + 4 subnet tiers · NAT Gateway (1 per AZ on multi-AZ) · VPC endpoints (Bedrock, ECR, S3, Secrets Manager, CloudWatch Logs, EventBridge)
Security	Customer-managed KMS CMKs · Secrets Manager · least-privilege per-service IAM roles · no static credentials
Observability	CloudWatch Logs + Container Insights + RDS Performance Insights

The network, data-flow, component, HA/scalability, and integration views ship alongside the architecture diagram in the AWS diagram pack, and the companion AWS BYOC deployment summary covers every resource in depth for your platform team.

Pre-launch checklist

The full specs are in Requirements; this is the short list of things to arrange ahead of time, since a couple have lead times. Most can run in parallel with the subscription.

• Bedrock model access: request the three models in your target Region early; first-time Anthropic approval can take 1-2 business days, the longest lead time on launch day.
• Bedrock RPM quota: raise the requests-per-minute quota for Claude Sonnet 4.6 and Haiku 4.5 off the soft-launch floor of ~10 toward the AWS default; a fresh account throttles on the first analysis job otherwise.
• AWS account & deployer access: an account you control and a principal that can create the stack (deploy-time IAM above).
• ACM certificate & DNS control: a same-Region ACM certificate plus the ability to add the DNS record: a public CNAME / Route 53 alias, or a private hosted-zone record for an internal webapp.
• Identity provider (optional): sign-in works out of the box on WorkOS AuthKit; you invite users by email. Optionally connect your own IdP (Okta, Entra ID, Auth0, Keycloak) via WorkOS Connect for SSO, with no app-level changes.

Security & data boundary

Because Nomain runs in your AWS account, the security boundary is yours. The BYOC posture rests on three properties: your data never leaves your AWS account, no Nomain operator has runtime access to the stack, and every cross-service call uses short-lived identity tokens, not static credentials. See Security for the full posture.

Control	What's in place
Network isolation	ECS tasks in private subnets, no public IPs. RDS, Bedrock, ECR, Secrets Manager, CloudWatch Logs reached over VPC endpoints, so AWS-service traffic stays on the AWS backbone. Only the ALB is public, fronted by AWS WAF.
Encryption	TLS 1.2+ at the ALB; at-rest encryption with a customer-managed KMS CMK across RDS, S3, EBS, Secrets Manager and SQS.
Identity	Per-service least-privilege IAM task roles; IAM Database Authentication for RDS (15-minute tokens); zero static credentials in images or task definitions.
End-user auth	WorkOS AuthKit (OIDC); WorkOS Connect bridges your IdP. JWTs validated locally in the webapp BFF and each API.
Audit logging	Tenant-lifecycle, admin, auth and data-deletion events retained 12 months in a dedicated CloudWatch log group; customer SIEM ingestion via Kinesis Firehose subscription.
Outbound dataflow	A small set of Customers API calls leave the account: stamp/tenant configuration (incl. licensing), a seat count, the 5-minute health heartbeat (aggregate counters plus an aggregate, content-free chat-health summary), and user-submitted feedback. No customer code, AST, embeddings, file names/paths, or analysis results is ever sent to Nomain; logs and detailed per-event telemetry stay in CloudWatch.

What Nomain cannot access

No standing operator credentials into your AWS account, no runtime read/write to your data plane (RDS, S3, Secrets Manager), and no telemetry of your source code, AST, embeddings, or chat content.

Cost & billing

Under the BYOL model there are two separate billing streams: the AWS infrastructure the stack runs on (paid to AWS, on your AWS bill) and the Nomain product license (paid to Nomain, separately).

AWS infrastructure: indicative monthly estimate

Public list pricing in us-east-1, on-demand (no Reserved Instances or Savings Plans), for a baseline of ~30M lines of code analyzed and ~50 active users. Actual spend varies with estate size, usage, Region, and commitments.

Usage scenario	Single-AZ	Multi-AZ (HA), default
Light usage	~$935 / mo	~$1,350 / mo
Typical usage	~$1,175 / mo	~$1,590 / mo
Heavy (active multi-user + monthly full re-ingestion)	~$2,375 / mo	~$2,790 / mo

What drives it: Amazon Bedrock is the largest swing factor; model choice and re-ingestion frequency can move it 5 to 10 times. Multi-AZ HA adds ~$420/mo (RDS standby instance + storage doubling, plus a second NAT Gateway).

Nomain license

The Nomain product license (BYOL) is sold and billed separately by Nomain, not through AWS. Contact your Nomain representative for license pricing tailored to your estate.

Go-live checklist & support

Once the stack reaches CREATE_COMPLETE:

1. Wire DNS. Public webapp (default): add a CNAME (or Route 53 A-Alias) from your domain to the ALBDnsName stack output. Route 53 propagates in minutes; external DNS may take longer. Internal webapp (WebAppAccess=Internal): the ALB is private (no public IP), so instead create an A-Alias in a private hosted zone for your domain (or a record in your own internal DNS) pointing at the ALB. A public CNAME will not work and the name should not resolve on the internet. This case also requires network connectivity into the stack VPC: the ALB is only reachable from inside the VPC, so connect your network via VPC peering, Transit Gateway, Site-to-Site VPN, Direct Connect, or Client VPN, and make sure the ALB security group admits your client/on-premises range (the VpnClientCidr stack parameter). If your network is in a separate VPC, you will need VPC peering or a Transit Gateway attachment to the stack VPC before the private DNS name resolves to a reachable address.
2. Set the first admin's password. When you finished the set-up form, Nomain emailed your admin address a Reset your password link (from Nomain, access@workos.dev, sent via WorkOS) to set the first admin's initial password. The link expires in 15 minutes, and it is sent at registration, so it usually lapses before the stack finishes deploying. Set it as soon as it arrives, or use Forgot your password? on your sign-in page to request a fresh link once your domain is live.
3. Smoke-test. https://<your-domain>/ returns HTTP 200 in a browser (the WAF Bot Control rule blocks bare curl), and a real user can sign in. For an internal webapp, run this from a machine on your connected network (peering/VPN); the ALB is not reachable from the public internet.
4. Subscribe your on-call to the CloudWatch alarms SNS topic if you left AlarmNotificationEmail empty at launch.

Need help? Contact your Nomain customer success representative for onboarding, domain authorization, region eligibility, or subscription questions. Operational runbooks (deployment, health, backup, maintenance) are in the AWS BYOC deployment guide.

Keeping Nomain up to date

Each Nomain release is an immutable version (vX.Y.Z): the container images and the CloudFormation template are published together under that version. You choose your starting version when you subscribe; later releases are applied with a small helper, and your stack never leaves your account.

1. You are notified. Nomain emails your admin address whenever a new version is published, with the upgrade command.

2. Download & review the helper (published next to the version list):

   curl -fsSO https://nomain-shared-config.s3.eu-north-1.amazonaws.com/byoc/update.sh
   less update.sh

3. Preview first, which shows exactly what would change and applies nothing:

   bash update.sh --stack-name <your-stack> --region <your-region> --dry-run

4. Apply by dropping --dry-run; it stages a change set and asks you to confirm before anything changes:

   bash update.sh --stack-name <your-stack> --region <your-region>

The helper gives you three guarantees:

• Lock-step (template + image, together). The helper moves the template, nested templates and image tag to the chosen version as one unit, so they cannot drift. Defaults to the latest published version, or pass --version vX.Y.Z.
• No downtime (rolling deploy). Services roll to the new version with at least one task always healthy; schema changes apply on startup. Take an RDS snapshot first as your rollback anchor.
• Reviewable (change set before apply). Nothing changes until you confirm. The preview lists every resource that changes and flags anything that would be replaced, so you see the impact up front.

Rollback

A failed update auto-rolls-back to your current version. To roll back deliberately, re-run the helper with --version set to the previous version. Schema changes are forward-only, so a rollback reverts the code but not the database.