Spice.ai provides multiple deployment options on Amazon Web Services (AWS), enabling data and AI applications to run on AWS's elastic infrastructure. Whether using virtual machines, container orchestration, or managed services, Spice deploys to meet requirements for performance, scalability, and cost efficiency.
For a complete list of AWS-compatible data connectors, AI models, vector stores, and secret management, see AWS Integrations (opens in a new tab).
Run Spice.ai on Amazon EKS (opens in a new tab) when the workload benefits from Kubernetes orchestration, multi-replica scale, declarative configuration, or shared cluster tenancy. EKS pairs well with the Spice Helm chart (opens in a new tab) and the Argo CD (opens in a new tab) or Flux (opens in a new tab) GitOps workflows.
The fastest path is eksctl (opens in a new tab), which provisions the VPC, IAM roles, and node groups in a single command:
--with-oidc enables the OIDC provider (opens in a new tab) required for IAM Roles for Service Accounts (IRSA). For production, prefer Terraform or CloudFormation for repeatable provisioning. The community terraform-aws-modules/eks (opens in a new tab) module is a common starting point.
For burst or low-utilization workloads, attach an EKS Fargate profile (opens in a new tab) so Spice pods run on serverless capacity instead of managed nodes.
Most Spice connectors (S3, DynamoDB, Bedrock, Glue) accept AWS credentials from the environment. Use IRSA so pods receive scoped, short-lived credentials without static keys:
Reference the service account from the Helm release so Spice pods inherit the role:
For EKS Pod Identity (opens in a new tab) (the newer alternative to IRSA), associate the role with aws eks create-pod-identity-association and skip the OIDC setup step.
For declarative GitOps, swap this command for an Argo CD Application or a Flux HelmRelease pointing at the same chart. See the Argo CD (opens in a new tab) or Flux (opens in a new tab) guides for full manifests.
For stateful acceleration (DuckDB, SQLite, Cayenne):
i4i, i7ie, m6id, m7gd, c7gd, r7gd and other d-suffixed instances). Provision the NVMe local volume (opens in a new tab) with the Local Volume Static Provisioner (opens in a new tab) or use Bottlerocket's local-volume-provisioner (opens in a new tab) to expose it as a local-storage StorageClass. Note that local volumes do not survive node replacement, so pair with a refresh strategy or a re-hydration source. Local NVMe Storage (opens in a new tab) walks through the EKS setup step by step — Karpenter's instanceStorePolicy, nodeadm local-storage mounting, the provisioner, the chart values, and verification.:::tip Amazon EFS works for sharing data across replicas but is not recommended for accelerations: NFS-style latency negates the benefit of using an accelerator. Reserve EFS for stateless artifacts that need to survive pod replacement. :::
:::tip[Spice.ai Enterprise]
For production stateful workloads, the Spice.ai Enterprise (opens in a new tab) Operator's SpicepodSet (opens in a new tab) provides per-replica StatefulSets with automatic PVC resizing, IRSA-aware ServiceAccount annotations, and configurable update strategies. For distributed query execution across scheduler/executor tiers backed by S3, see SpicepodCluster (opens in a new tab).
:::
To expose Spice externally, install the AWS Load Balancer Controller (opens in a new tab) and front the Spice Service with a Network Load Balancer (opens in a new tab):
The Spice Helm chart ships a PodMonitor resource for the Prometheus Operator (opens in a new tab). For EKS, the kube-prometheus-stack (opens in a new tab) chart and Amazon Managed Service for Prometheus (opens in a new tab) are common targets. Set monitoring.podMonitor.enabled: true and import the Spice Grafana dashboard (opens in a new tab).
For comprehensive guidance, refer to the Amazon EKS User Guide (opens in a new tab), the EKS Best Practices Guide (opens in a new tab), and the Spice.ai Kubernetes Deployment Guide (opens in a new tab).
Deploy Spice.ai directly on Amazon EC2 (opens in a new tab) instances for maximum control over the environment.
Manual EC2 Deployment:
Automated EC2 Deployment with CloudFormation:
UserData (opens in a new tab) to automate Docker installation, pull the Spice.ai Docker image (opens in a new tab), retrieve configuration or secrets from AWS Parameter Store or , and run the container with required environment variablesFor detailed guidance and best practices, refer to the AWS CloudFormation User Guide (opens in a new tab), EC2 User Guide for Linux Instances (opens in a new tab), and AWS Systems Manager Parameter Store Documentation (opens in a new tab).
Run Spice.ai on Amazon ECS (opens in a new tab) when a single managed container is sufficient and operating Kubernetes is not desired. ECS Fargate provides serverless capacity; ECS on EC2 provides full control over the host. Both consume the same task definition.
Create a task definition for the spiceai/spiceai image (opens in a new tab), exposing port 8090 (HTTP) and, optionally, 50051 (Arrow Flight) and 9090 (Prometheus). Inject secrets from AWS Secrets Manager (opens in a new tab) or SSM Parameter Store (opens in a new tab) instead of baking them into the image.
spiceai-task.json:
Register the task:
The executionRoleArn (typically ecsTaskExecutionRole) needs secretsmanager:GetSecretValue and ssm:GetParameters permissions to inject secrets. The taskRoleArn is the role Spice itself assumes at runtime — grant it the AWS permissions the Spicepod needs (for example, s3:GetObject on referenced buckets, bedrock:InvokeModel for Bedrock models).
Front the service with a Network Load Balancer (opens in a new tab) (low-latency TCP) or an Application Load Balancer (opens in a new tab) (HTTP routing, TLS termination). For internal-only deployments, place the service in private subnets and set assignPublicIp=DISABLED.
Spice accelerations are latency- and IOPS-sensitive. Choose the storage type based on launch type and sharing requirements:
i4i, i7ie, m6id, m7gd, c7gd, r7gd, etc.) and bind-mount the NVMe device into the task. This delivers the lowest latency and highest IOPS available on AWS but does not survive instance replacement, so pair with a refresh strategy.volumeType: io2 for high-IOPS, low-latency block storage that survives task restarts. Fall back to gp3 (with provisioned IOPS) when io2 is unavailable in the region.In the Spicepod, point file accelerators at /data, for example duckdb_file: /data/taxi_trips.db.
Configure service auto-scaling (opens in a new tab) on average CPU or on custom CloudWatch metrics derived from the Spice /v1/metrics endpoint:
For comprehensive details, see the Amazon ECS Developer Guide (opens in a new tab) and the Spice.ai Docker Deployment Guide (opens in a new tab).
Most AWS services that Spice connects to have explicit parameters for configuring authentication (usually by setting an access_key_id and secret_access_key). If explicit credentials are not provided, Spice follows the standard AWS SDK behavior for loading credentials from the environment based on the following sources in order:
Environment Variables:
AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEYAWS_SESSION_TOKEN (if using temporary credentials)Shared AWS Config/Credentials Files:
Config file: ~/.aws/config (Linux/Mac) or %UserProfile%\.aws\config (Windows)
Credentials file: ~/.aws/credentials (Linux/Mac) or %UserProfile%\.aws\credentials (Windows)
The AWS_PROFILE environment variable can be used to specify a named profile, otherwise the [default] profile is used.
Supports both static credentials and SSO sessions
Example credentials file:
:::tip To set up SSO authentication:
aws configure sso to configure a new SSO profileAWS_PROFILE=sso-profileaws sso login --profile sso-profile to start a new SSO session
:::AWS STS Web Identity Token Credentials:
The connector will try each source in order until valid credentials are found. If no valid credentials are found, an authentication error will be returned.
:::note[IAM Permissions]
Regardless of the credential source, the IAM role or user must have appropriate permissions (e.g., s3:ListBucket, s3:GetObject) to access the service. If the Spicepod connects to multiple different AWS services, the permissions should cover all of them.
:::
io2 (opens in a new tab) delivers up to 256K IOPS and sub-millisecond latency. Use the Amazon EBS CSI driver (opens in a new tab) and a custom StorageClass with type: io2 and a provisioned iops value.gp3 (with provisioned IOPS bumped above the 3,000 baseline) only when io2 is unavailable in a region or when cost outweighs the latency improvement.stateful.enabled: true and stateful.storageClass: <chosen-class> in values.yaml.UserDataECS Container Credentials:
AWS_CONTAINER_CREDENTIALS_RELATIVE_URI or AWS_CONTAINER_CREDENTIALS_FULL_URI which are automatically injected by ECS.AWS EC2 Instance Metadata Service (IMDSv2):