On-VM Deployment Prerequisites
This page outlines the requirements for the lightweight On-VM deployment option, which runs the full AI/Run CodeMie platform on a single virtual machine using Docker Compose.
Account Requirements
- AWS
- Azure
- GCP
- Active AWS Account with a region that supports Amazon Bedrock
- IAM permissions to create an IAM deployer role (one-time setup)
- Sufficient quota for: 1 EC2 instance, 1 VPC, 1 S3 bucket, 1 KMS key, 1 EIP
- Network access: Outbound internet access from EC2 (to pull Docker images, access Bedrock API); optional Route 53 hosted zone (if using a custom domain with ALB + ACM)
The deployment uses a dedicated IAM role with scoped permissions. You only need broad IAM access to create this role once — subsequent deployments use the role.
- Active Azure Subscription with sufficient quota for the required resources
- Contributor role (or equivalent) on the subscription to create VMs, Storage Accounts, Key Vaults, and DNS zones
- AZURE_SUBSCRIPTION_ID and AZURE_TENANT_ID — available in the Azure Portal under Azure Active Directory → Overview
Quota Requirements:
| Resource | Count |
|---|---|
| Standard_E4s_v5 | 1 |
| Azure Key Vault | 1 |
| Storage Account | 1 |
| Private DNS Zone | 1 |
- Active GCP Project with sufficient quota for the required resources
- The operator account must have the following roles or equivalent permissions:
roles/iap.tunnelResourceAccessor— SSH access to the VM via IAProles/secretmanager.secretAccessor— fetch SSH key from Secret Manager- Permissions to create: GCE VM, GCS bucket, Cloud KMS key, Cloud DNS private zone, VPC firewall rules
Quota Requirements:
| Resource | Count |
|---|---|
| n2-highmem-4 VM | 1 |
| GCS Bucket | 1 |
| Cloud KMS Key | 1 |
| Cloud DNS Private Zone | 1 (optional) |
Deployment Machine Tools
The following tools must be installed on the machine where you run ./deploy.sh:
- AWS
- Azure
- GCP
| Tool | Version | Purpose |
|---|---|---|
| Terraform | 1.15.x | Infrastructure provisioning |
| AWS CLI | latest | AWS resource management |
| Session Manager Plugin | latest | SSH access via AWS SSM |
| jq | latest | JSON parsing |
| openssl | latest | Secret generation |
| envsubst | latest | Template rendering |
Verify installation:
terraform version # Should show 1.15.x
aws --version # AWS CLI v2
session-manager-plugin # Should print version info
jq --version
openssl version
envsubst --version
| Tool | Version | Purpose |
|---|---|---|
| Terraform | 1.15.x | Infrastructure provisioning |
| Azure CLI | latest | Azure authentication and management |
| jq | latest | JSON parsing |
| openssl | latest | Secret generation |
| envsubst | latest | Template rendering |
Verify installation:
terraform version # Should show 1.15.x
az version # Azure CLI
jq --version
openssl version
envsubst --version
| Tool | Version | Purpose |
|---|---|---|
| Terraform | 1.15.x | Infrastructure provisioning |
| gcloud CLI | latest | GCP authentication and management |
| jq | latest | JSON parsing |
| openssl | latest | Secret generation |
| envsubst | latest | Template rendering |
Verify installation:
terraform version # Should show 1.15.x
gcloud version
jq --version
openssl version
envsubst --version
If deploying the Enterprise profile, nsc (latest) is also required on the deployment machine for NATS key generation.
GCP Container Registry Access
CodeMie container images are hosted on europe-west3-docker.pkg.dev. You need a GCP service account key file (key.json) with read access to the registry — this applies regardless of the cloud provider you deploy to.
Contact your CodeMie administrator or EPAM delivery team to obtain the key.json file for registry access.
Cloud Authentication
Authenticate to your cloud provider before running the deployment:
- AWS
- Azure
- GCP
# If using AWS SSO:
aws sso login --profile your-profile
export AWS_PROFILE=your-profile
# Verify credentials:
aws sts get-caller-identity
az login
az account set --subscription "<AZURE_SUBSCRIPTION_ID>"
# Verify active subscription
az account show
gcloud auth application-default login
# Verify active project
gcloud config get-value project
Repository Access
Clone the deployment repository:
git clone https://gitbud.epam.com/epm-cdme/codemie-on-vm.git
cd codemie-on-vm
The repository structure:
- AWS
- Azure
- GCP
| Directory | Purpose |
|---|---|
compose/ | Docker Compose files and service configuration |
deploy.sh | Deployment script |
terraform/aws/codemie-on-vm-aws-iam/ | IAM deployer role Terraform module |
terraform/aws/remote-backend/ | S3 Terraform state bucket |
terraform/aws/platform/ | EC2, VPC, ALB, S3, KMS infrastructure |
| Directory | Purpose |
|---|---|
compose/ | Docker Compose files and service configuration |
deploy.sh | Deployment script |
destroy.sh | Destroy script |
terraform/azure/remote-backend/ | Azure Storage Terraform state backend |
terraform/azure/platform/ | VM, Storage Account, Key Vault, DNS, NSG |
terraform/azure/ai-models/ | Azure OpenAI cognitive accounts (optional) |
| Directory | Purpose |
|---|---|
compose/ | Docker Compose files and service configuration |
deploy.sh | Deployment script |
destroy.sh | Destroy script |
terraform/gcp/remote-backend/ | GCS bucket for Terraform state |
terraform/gcp/platform/ | VM, GCS bucket, KMS key, DNS, firewall |
If your deployment machine operates in an isolated environment without direct internet or repository access, the repository can be provided as a ZIP/TAR archive and transferred through approved channels.