Requirements

AWS Account

• IAM user with PowerUserAccess + IAMFullAccess
• Supported regions: All major AWS regions (US, EU, APAC, Canada, South America)

Service Quotas

Ensure you have at least 1 available:

• VPC
• EKS cluster
• RDS instance
• NAT Gateway
• 4 EC2 instances

Check quotas: Service Quotas console 

Network

Outbound via NAT Gateway:

• *.corpai.io (Control Plane)
• External APIs (MCP integrations)

Outbound via VPC Endpoints:

• S3, ECR, STS, Bedrock (provisioned automatically)

No inbound internet access required.

Optional: Agent Discovery

Agent Discovery for GitHub.com or GitHub Enterprise Cloud has an additional network requirement: the GitHub Actions runner that executes the CorpAI static scan workflow must be able to reach your CorpAI backend URL.

Use one of these patterns:

• Public HTTPS backend URL for GitHub-hosted runners.
• Self-hosted GitHub Actions runners inside your network for private CorpAI endpoints.
• Customer-managed HTTPS ingress, reverse proxy, or tunnel exposing only the required Agent Discovery endpoints.

See Agent Discovery for setup details.

Next

Setup Guide →