Skip to Content
Self-Hosted DeploymentSetup Guide

Setup Guide

Deploy CorpAI infrastructure to your AWS account.

Prerequisites

  • CorpAI organization account with admin access
  • AWS account with an IAM user that has PowerUserAccess + IAMFullAccess
  • AWS Access Key ID and Secret Access Key

1. Validate Credentials

  1. Log in to app.corpai.io 
  2. Go to Settings → Infrastructure Setup
  3. Enter AWS credentials and select region
  4. Click Validate Credentials

2. Provision Infrastructure

Run each step in order. Each must complete before the next begins.

StepWhat It CreatesTime
VPC & NetworkingVPC, subnets, NAT Gateway5-10 min
RDS PostgreSQLDatabase10-15 min
ElastiCache ValkeyCache5-10 min
EKS ClusterKubernetes for MCP servers15-20 min
Bedrock Knowledge BaseAI + vector search5-10 min
Database SchemaTables1-2 min

Advanced: Expand options to customize instance sizes for RDS, Valkey, and EKS.

3. Configure Cross-Account Access

Create an IAM role for CorpAI to manage resources:

  1. Go to AWS IAM Console  → Roles → Create role
  2. Select “AWS account” → enter your account ID
  3. Attach policies:
    • AmazonEKSClusterPolicy
    • AmazonBedrockFullAccess
    • AmazonS3FullAccess
  4. Name it corpai-cross-account-access
  5. Copy the Role ARN
  6. Paste in CorpAI Settings and click Set Role

4. ACM Certificate Setup

Your Data Plane API requires an SSL certificate. Since the certificate must be in your AWS account, you need to create it in AWS Certificate Manager (ACM).

Create the Certificate

  1. Go to AWS Certificate Manager  in the same region as your CorpAI-provisioned EKS cluster
  2. Click Request → select Request a public certificate
  3. Enter the domain shown in your CorpAI UI
  4. Select Disable export and DNS validation
  5. Click Request

Add DNS Validation Record

ACM provides a CNAME record for domain validation. CorpAI then adds this domain for you:

  1. In ACM, copy the CNAME name and CNAME value from the validation details
  2. In CorpAI Settings, paste both values in the ACM Certificate Setup section
  3. Click Add DNS Record

Save Certificate ARN

  1. Wait for ACM status to show Issued (usually 5-30 minutes)
  2. Copy the Certificate ARN from ACM
  3. Paste in CorpAI Settings and click Save Certificate

Important: Only save the ARN after the certificate shows “Issued” status. If the certificate is still pending, Data Plane deployment will fail.

5. Deploy Data Plane API

  1. Enter AWS credentials
  2. Click Deploy Data Plane API
  3. Wait 2-5 minutes for deployment

The Data Plane API is deployed to your EKS cluster with an NLB (Network Load Balancer) configured with your ACM certificate.

6. Verify Health

Status should show Healthy. If it shows Propagating, wait a few minutes for DNS.

StatusMeaning
HealthyReady to use
PropagatingDNS resolving, wait
UnhealthyCheck NAT Gateway and security groups

Optional: Configure Agent Discovery

Agent Discovery lets CorpAI install a static scan workflow into GitHub.com or GitHub Enterprise Cloud repositories. For self-hosted CorpAI, you need a customer-owned GitHub App because the app setup URL, callback URL, and private key must belong to your CorpAI instance.

Create the GitHub App

Create a GitHub App in the GitHub account, organization, or enterprise that will own the integration.

Use these settings:

  • Setup URL: https://<your-corpai-api-domain>/api/v1/agent-discovery/github/callback
  • Repository permissions: Metadata read-only, Contents read and write, Workflows read and write
  • Webhook: Not required for the current static scanning workflow

After creating the app:

  1. Copy the GitHub App ID.
  2. Copy the app slug from the app URL.
  3. Generate and download a private key.
  4. Store the private key securely with your CorpAI backend configuration.

Configure CorpAI

Set these backend environment variables:

GITHUB_APP_ID="<github-app-id>"
GITHUB_APP_SLUG="<github-app-slug>"
GITHUB_APP_PRIVATE_KEY="<pem-private-key>"
SESSION_SECRET_KEY="<long-random-secret>"
FRONTEND_APP_URL="https://<your-corpai-ui-domain>"
BACKEND_APP_URL="https://<your-corpai-api-domain>"

For GitHub.com and GitHub Enterprise Cloud, keep the default GitHub URLs:

GITHUB_APP_BASE_URL="https://github.com"
GITHUB_API_BASE_URL="https://api.github.com"

Restart the CorpAI backend after changing these values.

Private Backend URLs

If BACKEND_APP_URL is public HTTPS, GitHub-hosted runners can report scan results to CorpAI.

If BACKEND_APP_URL is private, configure one of these before enabling repositories:

  • Self-hosted GitHub Actions runners that can reach the private CorpAI backend.
  • Customer-managed ingress, reverse proxy, or tunnel that exposes only the Agent Discovery callback and scan ingest endpoints.

For details, see Agent Discovery.

Next: Add Credentials & Deploy MCP Servers

After your Data Plane is healthy:

  1. Add credentials in Settings → Credentials (GitHub tokens, Atlassian tokens, etc.)
  2. Deploy MCP servers in MCP Servers page
  3. Configure policies to grant tool access

See Management for details.

Troubleshooting

Provisioning failed: Check error message. Common issues:

  • Resource quota exceeded → Request increase in AWS
  • Access denied → Verify IAM permissions

ACM certificate not issuing:

  • Verify DNS validation record was added (check with CorpAI support)
  • Ensure you requested the certificate in the correct region (same as EKS)

Data Plane deployment failed:

  • Ensure ACM certificate shows “Issued” status before deploying
  • Verify the certificate matches the wildcard domain shown in the UI

API unhealthy: Check NAT Gateway is active and security groups allow outbound 443.

Stuck propagating: Wait up to 30 min. Check Route 53 for DNS record.

Next

Infrastructure →

Last updated on
RequirementsInfrastructure