Deploy

StrataBI deploys into your own AWS account as code. The module provisions the app (ALB + ECS Fargate), the async Athena runner and status-writer Lambdas, DynamoDB tables, a Glue catalog database, Athena workgroups, and an S3 system bucket seeded with themes and a default dashboard.

The module is written for Terraform and is compatible with OpenTofu — the commands below are identical for either (terraform ↔ tofu).

Prerequisites

An AWS account and credentials that can create the resources above.
Terraform ≥ 1.6 or a current OpenTofu.
An existing VPC with public subnets (for the ALB) and subnets for ECS tasks.
A built StrataBI container image in ECR.
Optional: an ACM certificate in the same region if you want HTTPS.

Quick start (recommended: the wizard)

The recommended path is to let StrataCLI collect configuration and generate the Terraform variables — you answer questions instead of editing .tfvars by hand:

bash

stratacli init        # prompts for region, VPC/subnets, image, security flags, ...
                      # writes strata.yaml (source of truth) + infra/terraform.tfvars
cd infra
terraform init
terraform validate
terraform plan        # review carefully
terraform apply
terraform output alb_dns_name

strata.yaml is the source of truth; re-running stratacli init reuses your answers and only asks for what is missing. See StrataCLI for the full wizard.

Manual alternative

You can still manage terraform.tfvars by hand if you prefer:

bash

cd infra
cp terraform.tfvars.example terraform.tfvars   # then edit
terraform init && terraform plan && terraform apply

Naming and multiple installs

Every named resource is prefixed by name_prefix (default stratabi). The default reproduces the original names exactly, so existing installs see no change. To run a second install in the same account, set a distinct prefix:

hcl

name_prefix = "acme"

HTTPS

HTTPS is off by default (plain HTTP on the ALB). To enable TLS, supply a certificate:

hcl

enable_https        = true
acm_certificate_arn = "arn:aws:acm:us-east-1:<acct>:certificate/<id>"

This adds a 443 listener and ingress; the HTTP listener stays in place.

Verify the install

A smoke test checks the ALB, ECS service, Lambdas, DynamoDB tables, and bucket:

bash

./smoke_test.sh stratabi us-east-1     # <name_prefix> <region>

Caution

The S3 system bucket and DynamoDB tables are created with prevent_destroy. That protects customer data, but it also blocks destroy and any change that would rename them — choose name_prefix before the first apply. Lock down allowed_ip_cidrs rather than leaving the ALB open to 0.0.0.0/0.

Key variables

Variable	Description
`name_prefix`	Prefix for all named resources (default `stratabi`).
`stratabi_image`	ECR image URL for the runtime.
`vpc_id`, `public_subnet_ids`, `private_subnet_ids`	Networking.
`enable_https`, `acm_certificate_arn`	Optional TLS.
`allowed_ip_cidrs`	CIDRs allowed to reach the ALB.
`athena_workgroup_count`	Number of sharded Athena workgroups.