---
title: "Deploy on AWS"
description: "Run OpenWork on Amazon EKS with Amazon RDS for MySQL."
---

The recommended AWS path is Helm on Amazon EKS with Amazon RDS for MySQL. For the smallest first deployment, use EKS Auto Mode and Kubernetes `LoadBalancer` Services so AWS provisions Network Load Balancers for Den web and Den API. Move to an ALB or an existing ingress platform when you need shared layer-7 routing, WAF policy, or more advanced certificate handling.

## What AWS manages

- EKS control plane, compute, pod networking, and load-balancer integration
- VPCs, subnets, routing, security groups, and IAM
- RDS for MySQL, encryption, backups, and failover
- Route 53 DNS and ACM certificates when you use those services

The OpenWork chart manages Deployments, Services, ConfigMaps, Secret references, probes, and the database migration Job.

## AWS checklist

1. Create an EKS Auto Mode cluster with `eksctl` `0.195.0` or newer.
2. Create an RDS MySQL 8-compatible database in private subnets.
3. Allow database port `3306` only from the EKS workload or node security boundary.
4. Store `DATABASE_URL`, `BETTER_AUTH_SECRET`, and `DEN_DB_ENCRYPTION_KEY` in a Kubernetes Secret.
5. Start from the chart's `values.aws-load-balancer.yaml` example.
6. Install the chart, verify migrations and readiness, then point DNS at the generated load balancers.
7. Enable trusted HTTPS before creating the first administrator.

For exact CLI commands, values, DNS/TLS choices, migration troubleshooting, verification, and cleanup, follow the [AWS EKS operator runbook](https://github.com/different-ai/openwork/blob/dev/docs/aws-eks-helm.md).

Next: [Create the first administrator](/self-host/deploy-to-your-cloud/first-administrator).