AWS networking options

Nomain deploys into your AWS account as a CloudFormation stack: ECS Fargate services, an RDS PostgreSQL database, an Application Load Balancer and Amazon Bedrock access. There are two ways to place that stack on the network. This page compares them so your DevOps team can pick the model that fits your security posture, and see exactly what to fill in and which network permissions the deploy needs.

This page is an advanced reference for the AWS BYOC deployment. For the full deployment walkthrough see BYOC on AWS and AWS Marketplace.

Subject to change

Parameter names and defaults may change in a future release. The network model is chosen at launch and cannot be changed on a running stack.

• Audience: your cloud / DevOps engineers
• Decision: choose one network model before launch

The two models

Model	Summary	Best when	You provide
A. Stack creates a dedicated VPC	The default. Nomain's stack provisions the whole network for you.	You can let the deploy role create VPC-level resources and don't need to sit inside an existing network.	Nothing network-level (optionally a CIDR range).
B. Existing VPC + your subnets	You bring the VPC and the subnets; the stack adds almost nothing network-level.	VPC and subnet creation are centrally controlled and pre-allocated by your network team.	VPC, subnets, routing, egress.

Model B deploys the webapp Internal only (no internet-facing load balancer). In both models the stack still creates the security groups and a VPC Flow Log inside the target VPC.

Model A: stack-created dedicated VPC

The stack owns the entire network. Leave the existing-VPC settings empty and the stack builds a dedicated VPC: Internet Gateway, NAT gateway(s), all subnet tiers, route tables and VPC endpoints, plus the security groups and the VPC Flow Log. There is no pre-work for your network team, but the CloudFormation deploy role needs permission to create VPC-level resources. The webapp can be Public (internet-facing) or Internal.

• Stack creates: VPC, IGW, NAT, subnets, route tables, endpoints, security groups, Flow Log
• You provide: nothing network-level

Model B: existing VPC + existing subnets

You bring the VPC and the subnets. You supply the VPC ID, its CIDR, and pre-created subnet IDs for two tiers: private (ECS, the internal ALB, db-setup) and isolated (RDS), each spanning at least two Availability Zones. The stack creates no VPC, subnets, gateways or route tables; it only creates the security groups, the application resources and the VPC Flow Log inside your VPC. Egress to the AWS APIs is reached through your NAT/Transit Gateway and a host allowlist.

• Stack creates: security groups, internal ALB, RDS, ECS, Flow Log
• You provide: VPC, subnets, routing, egress

What you configure

CloudFormation parameters per model. The Nomain registration wizard pre-fills most of these; the table shows what differs by model. Empty cells mean the parameter is left blank.

Parameter	Model A (create VPC)	Model B (VPC + subnets)
ExistingVpcId	Leave empty	Provide vpc-0a1b…
ExistingVpcCidr	Not needed	Provide 10.20.0.0/16
VpcCidr (range for the new VPC)	Default 10.10.0.0/16	Ignored
ExistingPrivateSubnetIds (ECS, ALB, db-setup)	Not needed	Provide ≥2, in 2 AZs
ExistingIsolatedSubnetIds (RDS)	Not needed	Provide ≥2, in 2 AZs
CreateVpcEndpoints (Auto / Always / Never)	Auto → creates	Auto → skip; Always to create them
WebAppAccess	Public or Internal	Internal (fixed)
CertificateArn (ACM cert for TLS)	Required if Public	Required
MultiAz	true / false	true / false (needs 2-AZ subnets)

Plus the standard tenant, authentication and model parameters (TenantId, M2M credentials, Bedrock model IDs), identical in both models and supplied by the registration wizard.

Network permissions to deploy

The full, per-nested-stack deploy permission list is the single reference in BYOC on AWS → Deploy permissions (written for the Model B / internal layout). This section is the network-layer delta between the two models: the only permissions that change with the network choice. Application resources (RDS, ECS, ALB, Secrets Manager, KMS, S3, IAM task roles) are stack-created in both models regardless.

Capability (representative IAM actions)	Model A	Model B
Create VPC (ec2:CreateVpc)	Required	Not needed
Internet Gateway + NAT (ec2:CreateInternetGateway, CreateNatGateway, AllocateAddress)	Required	Not needed
Create subnets (ec2:CreateSubnet)	Required	Not needed
Route tables (ec2:CreateRouteTable, CreateRoute, AssociateRouteTable)	Required	Not needed
VPC endpoints (ec2:CreateVpcEndpoint)	Required	Only if Always
Security groups (ec2:CreateSecurityGroup, AuthorizeSecurityGroup*)	Required	Required
VPC Flow Logs (ec2:CreateFlowLogs, iam:PassRole, logs:CreateLogGroup)	Required	Required

What your network team pre-provisions

Prerequisite	Model A	Model B
Existing VPC	Not needed	Required
Subnets (≥2 AZ, private + isolated)	Not needed	You create
Route tables with egress + return routes	Not needed	Required (attached to your subnets)
Egress to AWS APIs (NAT / Transit Gateway + host allowlist)	Not needed (stack NAT)	Required
DNS (record resolving your domain to the ALB)	Required (public or private zone)	Required (internal)

Egress allowlist (Model B)

When you own egress, allow these endpoints from the private and isolated subnets, per deployment region. The one-off db-setup task is the canary: if a host is blocked it fails first and stops the stack. Replace <region> with your deploy region.

Blocked hosts fail the deploy

The db-setup task runs early and will halt the stack on the first unreachable endpoint. Confirm the full allowlist before launch to avoid a mid-deploy failure.

Container images (Amazon ECR)

api.ecr.<region>.amazonaws.com
*.dkr.ecr.<region>.amazonaws.com
prod-<region>-starport-layer-bucket.s3.<region>.amazonaws.com

Object storage (Amazon S3)

*.s3.<region>.amazonaws.com

AWS service APIs

secretsmanager.<region>.amazonaws.com
logs.<region>.amazonaws.com
events.<region>.amazonaws.com
sts.<region>.amazonaws.com
kms.<region>.amazonaws.com

AI models (Amazon Bedrock)

bedrock-runtime.<region>.amazonaws.com

Nomain control plane and identity

customers-api.app.nomain.com
signin.nomain.com
*.workos.com

How to choose

1. Model A: stack creates the VPC. The simplest path. Pick it when your organization lets the deploy role create VPC-level resources and you don't need to integrate Nomain into an existing network.
2. Model B: you bring the VPC and subnets. The most restrictive: the stack touches almost nothing at the network layer. Pick it when both VPC and subnet creation are centrally governed and your team can pre-allocate the subnets.

Related

See BYOC on AWS for the end-to-end deployment steps and AWS Marketplace for the subscription flow.