AWS Infrastructure
AIQLick runs on AWS with eu-north-1 (Stockholm) as the primary region. This page provides a comprehensive overview of all infrastructure components.
Account Details
| Property | Value |
|---|---|
| AWS Account ID | 842697652860 |
| Primary Region | eu-north-1 (Stockholm) |
| SSO Profile | Administrator-842697652860 |
| SSO Start URL | https://d-90661a8263.awsapps.com/start/# |
ECS Fargate (compute)
After Phase 7 — EC2 → ECS migration, the backend and AI services run on AWS ECS Fargate inside a single cluster. Per-env isolation is at the IAM, security-group, and SQS-queue level.
| Service | Cluster | Task family | Desired (min/max) | Image |
|---|---|---|---|---|
backend-prod | aiqlick | aiqlick-backend-prod | 2 / 2 / 8 | aiqlick-backend:latest |
backend-dev | aiqlick | aiqlick-backend-dev | 1 / 1 / 4 | aiqlick-backend:dev-latest |
bg-tasks-prod | aiqlick | aiqlick-bg-tasks-prod | 2 / 2 / 8 | background-tasks:latest |
bg-tasks-dev | aiqlick | aiqlick-bg-tasks-dev | 1 / 1 / 4 | background-tasks:dev-latest |
Two ALBs front the cluster:
| ALB | Scheme | Listener | Cert | Used by |
|---|---|---|---|---|
aiqlick-public-alb | internet-facing | HTTPS:443 + HTTP:80 (plain forward, redirect deferred) | ACM api.aiqlick.com SAN api-dev.aiqlick.com (eu-north-1) | Browser → backend |
aiqlick-internal-alb | internal | HTTP:80 (host-header routed) | None (private VPC + internal-service JWT) | Backend → BG |
Cloud Map private namespace aiqlick.local registers per-task A records
for service discovery (backend-{env}.aiqlick.local, bg-{env}.aiqlick.local).
For detailed cluster / autoscaling / IAM / log-group inventory, see ECS Fargate.
EC2 Instances
After the Phase 7 cleanup of 2026-05-14, Jitsi is the only EC2 left.
| Name | Instance ID | Type | Public IP | EBS | Purpose |
|---|---|---|---|---|---|
aiqlick-jitsi | i-0620d2e23695f5bfc | t3.xlarge | 16.16.21.64 | 20GB gp3 | Jitsi Meet (UDP, can't move to Fargate) |
The four legacy backend / AI EC2s were terminated and their EIPs +
IAM + security groups deleted in the same window. The
ai.aiqlick.com / ai-dev.aiqlick.com DNS records were deleted from
one.com on the same day — see
EC2 Instances → DNS cleanup.
RDS PostgreSQL
Two RDS instances provide managed PostgreSQL databases. Both the backend (NestJS/Prisma) and background tasks (FastAPI/AsyncPG) share the same database per environment.
| Identifier | Engine | Class | Endpoint | Storage | Purpose |
|---|---|---|---|---|---|
| aiqlick-postgres | PostgreSQL 16.6 | db.t4g.small | aiqlick-postgres.cx86go6iuul4.eu-north-1.rds.amazonaws.com:5432 | 50GB | Production |
| aiqlick-postgres-dev | PostgreSQL 16.10 | db.t4g.micro | aiqlick-postgres-dev.cx86go6iuul4.eu-north-1.rds.amazonaws.com:5432 | 20GB | Development |
Schema is managed exclusively through Prisma in aiqlick-backend/prisma/schema.prisma (135 models). Background tasks access the same database using raw AsyncPG queries.
S3 Buckets
| Bucket | Purpose |
|---|---|
aiqlick-uploads | Production file storage (CVs, profile images, documents) |
aiqlick-dev-uploads | Development file storage |
aiqlick-postgres-backups | Automated database backups |
aiqlick-deployments | Deployment artifacts |
aiqlick-docs | Production documentation site |
aiqlick-docs-dev | Development documentation site |
CloudFront CDN
CloudFront distributions serve uploaded files and documentation through custom domains with edge caching.
| Distribution ID | Domain | Origin |
|---|---|---|
| E4Z4UJZ2HEV46 | storage.aiqlick.com | aiqlick-uploads.s3.eu-north-1.amazonaws.com |
| E1PLDND9V3L62Y | storage-dev.aiqlick.com | aiqlick-dev-uploads.s3.eu-north-1.amazonaws.com |
| E158FQTQZ7MU1B | docs.aiqlick.com | aiqlick-docs.s3.eu-north-1.amazonaws.com |
| E1ZZP7EF6S8BA | docs-dev.aiqlick.com | aiqlick-docs-dev.s3.eu-north-1.amazonaws.com |
ECR Repositories
Container images are stored in Amazon Elastic Container Registry.
Images are tagged with {dev-}latest and {dev-}{git_sha} plus
BuildKit cache manifests at {dev-}buildcache. The :previous tag
the BG EC2 deploy used is no longer maintained — ECS deployment
circuit breaker handles rollback now.
| Repository | URI | Image Size | Used by |
|---|---|---|---|
aiqlick-backend | 842697652860.dkr.ecr.eu-north-1.amazonaws.com/aiqlick-backend | ~240MB | ECS backend-{dev,prod} |
background-tasks | 842697652860.dkr.ecr.eu-north-1.amazonaws.com/background-tasks | ~699MB | ECS bg-tasks-{dev,prod} |
aiqlick-meeting | 842697652860.dkr.ecr.eu-north-1.amazonaws.com/aiqlick-meeting | ~142MB | Jitsi EC2 (Docker Compose) |
aiqlick-jigasi | 842697652860.dkr.ecr.eu-north-1.amazonaws.com/aiqlick-jigasi | ~505MB | Jitsi EC2 (Docker Compose) |
support-backend-rust | 842697652860.dkr.ecr.eu-north-1.amazonaws.com/support-backend-rust | (varies) | support-backend-alb (standalone Rust service) |
Amplify (Frontend Hosting)
The Next.js frontend is deployed via AWS Amplify with server-side rendering support.
| Property | Value |
|---|---|
| App ID | d2x4yh9us5ctu1 |
| Region | eu-north-1 |
| Framework | Next.js SSR |
Branch mapping:
| Branch | Stage | Domain |
|---|---|---|
dev | DEVELOPMENT | dev.aiqlick.com |
main | PRODUCTION | www.aiqlick.com |
Each branch has a SECRET_NAME environment variable pointing to the corresponding Secrets Manager path. Secrets are fetched at build time.
Secrets Manager
| Secret Path | Description |
|---|---|
aiqlick-backend/production | Production backend + bg-tasks secrets bundle (consumed by ECS task defs as _BUNDLE_JSON) |
aiqlick-backend/development | Development backend + bg-tasks secrets bundle |
jitsi/production | Jitsi Meet XMPP passwords and configuration |
support-backend-rust/production | Support backend (Rust) production secrets |
support-backend-rust/development | Support backend (Rust) development secrets |
support-backend-rust/bootstrap-admin-prod | One-time bootstrap admin credentials for support-backend |
For how the bundle is loaded into the container at boot, see Secrets.
IAM Roles and Policies
ECS task roles (active)
These are the production-active roles for the ECS Fargate workloads.
| Role | Trust principal | Used by |
|---|---|---|
aiqlick-ecs-execution-role-{dev,prod} | ecs-tasks.amazonaws.com | Fargate runtime — pull image from ECR, write CloudWatch logs, read Secrets Manager bundle |
aiqlick-ecs-backend-task-role-{dev,prod} | ecs-tasks.amazonaws.com | Backend app — S3 (uploads bucket), SQS (mail/notifications/inbound), SNS (pubsub), EventBridge PutEvents, AppConfig read, X-Ray |
aiqlick-ecs-bg-task-role-{dev,prod} | ecs-tasks.amazonaws.com | BG app — Bedrock / Rekognition / Transcribe / Polly, S3, SQS, SNS publish, AppConfig read, X-Ray |
For the full per-role policy doc, see ECS Fargate — IAM.
Other AWS service roles
| Role | Purpose |
|---|---|
aiqlick-scheduler-role | EventBridge Scheduler trust principal — invokes aiqlick-cron-destination API destination for cron POSTs into the backend |
aiqlick-canary-role-dev | CloudWatch Synthetics canary execution |
aiqlick-rum-dev-unauth-role | CloudWatch RUM unauthenticated identity for browser RUM |
aiqlick-aws-config-role | AWS Config aggregator role |
CodeBuildServiceRole-aiqlick-backend | CodeBuild service role (used by the support-backend Rust pipeline) |
github-actions-role
Federated via OIDC for CI/CD. Calls ECS APIs only — no SSH any more.
| Policy | Permissions |
|---|---|
AmazonEC2ContainerRegistryPowerUser | Push + pull ECR images |
aiqlick-ecs-deploy-policy (inline) | ecs:RegisterTaskDefinition, ecs:UpdateService, ecs:RunTask, ecs:DescribeServices, iam:PassRole on the four ECS task roles |
AmazonSSMFullAccess | SSM commands — used by the Jitsi deploy workflow only (the backend / BG / FE / docs deploys no longer touch SSM) |
github-actions-amplify-policy | Read-only Amplify access (powers the Amplify deploy-status monitor workflow) |
Jitsi instance profile
| Role / profile | Used by |
|---|---|
EC2-SSM-Profile (instance profile only) | aiqlick-jitsi — only AmazonSSMManagedInstanceCore; Jitsi doesn't talk to AWS services directly |
The legacy aiqlick-{backend,ai}-ec2-role,
aiqlick-{backend,ai}-ec2-profile, and the 9 custom policies that fed
them (aiqlick-backend-{s3-secrets,events,appconfig,inbound,mail}-policy,
aiqlick-background-tasks-policy, aiqlick-ai-{bg-events,events,inbound}-policy)
were all deleted in the Phase 7 cleanup of 2026-05-14.
Their permissions are now carried by the active ECS task roles
listed above; no application change was needed because the workloads
had already moved to ECS during the May 9 cutover.
Multi-Region Strategy
AIQLick uses three AWS regions based on service availability requirements.
| Region | Services |
|---|---|
| eu-north-1 (Stockholm) | ECS Fargate, EC2 (Jitsi), RDS, S3, ECR, Bedrock, CloudFront, Secrets Manager, Amplify, ALBs, NAT, AppConfig, EventBridge, SQS, SNS |
| eu-west-1 (Ireland) | Rekognition (face detection), Transcribe (speech-to-text), Polly (text-to-speech) |
| us-east-1 (N. Virginia) | SSO Identity Center (login portal), ACM certs for CloudFront + Amplify |
The primary region is eu-north-1 for data residency. Rekognition and Transcribe run in eu-west-1 because these services are not available in Stockholm.
Redis (retired May 2026)
Redis Cloud was retired with Phase 4 of the AWS-native migration. The two former workloads now run on AWS-native services:
- Job queues → Amazon SQS (
aiqlick-mail-*,aiqlick-notifications-delivery-*,aiqlick-inbound-*,aiqlick-agent-docs-*,aiqlick-bg-events-*). - GraphQL pub/sub → in-process
graphql-subscriptionsPubSub for SSE notifications, with SNS+SQS fan-out as the multi-pod adapter (deferred until horizontal scaling is required).
AWS-native services added in May 2026
| Service | Purpose | See |
|---|---|---|
| Amazon SES (outbound) | Replaces SMTP/Nodemailer for transactional mail | Mail & Email |
| Amazon SES (inbound) | Replaces 30s IMAP polling for cv+/jobs+ mail | Mail & Email — Inbound |
| Amazon SQS | All async work + redrive + DLQ | AWS-Native Migration |
| EventBridge custom bus | Cross-service domain events (aiqlick-events-{env}) — agent.document.created, billing.cost-config.invalidated | AWS-Native Migration |
| AWS AppConfig | Runtime feature flags polled every 60s (no container restart needed for flag flips) | AWS-Native Migration — Configuration |
| AWS X-Ray | Distributed tracing across NestJS + background-tasks (single trace ID per request) | AWS-Native Migration — Observability |
| CloudWatch Synthetics | 3 dev canaries (15-min cadence): API health, AI gateway health, frontend signin journey | AWS-Native Migration |
| CloudWatch RUM | Frontend real-user-monitoring (errors + Web Vitals) | — |
Useful AWS CLI Commands
# SSO login (required before any AWS command)
aws sso login --profile Administrator-842697652860
# Check RDS instance status
aws rds describe-db-instances --profile Administrator-842697652860 --region eu-north-1 \
--query 'DBInstances[].{ID:DBInstanceIdentifier,Status:DBInstanceStatus,Class:DBInstanceClass}' \
--output table
# View recent ECR images for a repository
aws ecr describe-images --profile Administrator-842697652860 --region eu-north-1 \
--repository-name aiqlick-backend \
--query 'imageDetails | sort_by(@, &imagePushedAt) | [-3:]' --output table
# List secrets (names only)
aws secretsmanager list-secrets --profile Administrator-842697652860 --region eu-north-1 \
--query 'SecretList[].Name' --output table
# Check S3 bucket contents
aws s3 ls s3://aiqlick-uploads/ --profile Administrator-842697652860 --summarize