Enterprise Edition — Installation Guide

Enterprise deploys the licensed StrataBI runtime into your own AWS account via StrataCTL. It requires a commercial license bound to your AWS Account ID.

Evaluating first? The free Developer Edition shares the same StrataCTL foundation and is the fastest way to try StrataBI before licensing Enterprise.

Quick links: Enterprise overview · Pricing · Get started · StrataCTL

1. Purchase & license

Order Form. We send a single Order Form (incorporating the Commercial License and NDA) that captures your terms and your Licensed AWS Account ID. See Get started.
Sign & pay — Stripe on signature, or invoice for annual terms. See pricing.
License token. On payment we issue a license token bound to your AWS Account ID and grant access to your licensed runtime artifact, delivered securely.

2. Prerequisites

Same machine setup as the Developer Edition guide — Python 3.11+, pipx, working AWS credentials, and OpenTofu (or Terraform). Plus:

Your license token and Licensed AWS Account ID.
Credentials for that account with permission to deploy the runtime (ECS/ALB/VPC/ECR).

3. Install with StrataCTL

The install is three commands: install the CLI, stand up the one-time install plane (StrataCI), run the wizard, then deploy.

bash

pipx install stratactl        # or: pip install stratactl

# one-time per account/region: the ephemeral CodeBuild runner (StrataCI)
stratactl --profile <profile> --region <region> bootstrap --run --yes

# interactive wizard — collects config, generates OpenTofu variables (answer sheet below)
stratactl --profile <profile> --region <region> init

# deploy the licensed runtime (verifies entitlement, pulls the signed artifact,
# builds the image in-account, stands up ECS/ALB in your account)
stratactl --profile <profile> --region <region> install-stratabi

install-stratabi verifies the license token is bound to the target account before it deploys — see Entitlements & token security for exactly how that works. Prefer your own CI/CD and image scanning? See Bring your own CI/CD. Full command reference in StrataCTL.

Network preflight

Before the questions, the wizard runs a short network preflight so it can offer real choices instead of making you look them up:

It discovers the VPCs and subnets in the target account/region. If the account has no VPC, it offers to create a default one for you.
It pre-fills the allowed-inbound rule with your current public IP as a /32, so a test deployment isn't open to the world by default. Widen it in the wizard if you need to.
For the ALB subnets it lists what's available and pre-suggests two public subnets in different AZs (marked *). Press Enter to accept the suggestion, type numbers like 1,2 to pick, or paste your own subnet ids.

Wizard answer sheet

Have these ready. Defaults in bold are the common choice for a first install.

Prompt	What to enter
Installation name (`name_prefix`)	A short, lowercase name, e.g. `stratabi`. Use a different name if the Developer Edition is already installed in the account.
AWS region	e.g. `us-east-1`
Organization	A label for your own records (not an AWS value)
Edition	`enterprise`
Public domain	Blank unless you're terminating HTTPS at a domain
Container image	Blank to build the image in-account, or your own ECR URL — see Bring your own CI/CD
VPC	Auto-discovered; if none exists the preflight offers to create a default VPC
ALB subnets	The picker pre-suggests two public subnets in different AZs — Enter to accept, numbers to choose, or paste subnet ids
Place ECS tasks in private subnets?	`no` for a standard setup (it then won't ask for private subnet ids)
Allowed inbound CIDRs	Accept the pre-filled `<your-ip>/32`, or widen as needed
Enable HTTPS/TLS?	`no` for a quick test; `yes` requires an ACM certificate ARN and a domain
Enable RBAC?	`no` to start; `yes` enables deny-by-default access control (see RBAC)
Enable AI builder?	`yes` only if Bedrock model access is enabled in the account; otherwise `no` (see AI generation)
GuardDuty / Inspector / Security Hub	`no` unless you want them — AWS bills these

The wizard writes your answers to strata.yaml and generates the OpenTofu variable files. Re-running init reuses saved values and only asks for what's missing; init --update re-asks everything. If you abort partway (Ctrl-C), what you've answered so far is saved, so you can pick up where you left off.

A successful install

install-stratabi streams the runner log. A healthy run:

Creates the ECR repository for your install.
Builds and pushes the runtime image in your account (unless you supplied your own).
Applies the VPC-adjacent networking, the ALB, and the Fargate service.
Ends with a health gate that prints the live URL — StrataBI is live at http://… — rather than a bare success.

Open that URL to reach the builder and your live-Athena dashboards.

Troubleshooting

Re-running an install is safe: state lives in your S3 backend, so a re-run only creates what's missing. Common first-run issues:

Symptom	Cause & fix
`AlreadyExists` / name collision	Another install used the same name. Re-run `init` and pick a different installation name.
No VPC, or "need ≥2 subnets in different AZs"	The account/region has no suitable network. Let the preflight create a default VPC, or supply a VPC with at least two public subnets in different AZs.
`ExpiredToken` / auth errors mid-run	Your AWS session expired. Refresh it (`aws sso login`) and re-run.
AI builder fails to start	`enable_ai=true` but Bedrock model access isn't enabled in the account. Enable the model in Bedrock, or re-run `init` with AI disabled.
Install resolves an unexpectedly old version	Your entitlement is for an older version. Confirm the licensed version, or pass `install-stratabi --to <version>`.

Inspect the full runner log for any job with stratactl logs <job_id>.

4. What gets deployed

The full production runtime — admin console, RBAC, AI home page — behind a managed ALB/ECS deployment in your VPC, alongside the same data plane (S3 · Athena · Glue · DynamoDB · Lambda) the Developer Edition uses. Everything runs in your account.

Support & maintenance

Enterprise includes a monthly maintenance tier — Supported or Premier — covering patches, AWS-compatibility upkeep, and hands-on support. See pricing.

Uninstall

bash

stratactl --profile <profile> --region <region> uninstall stratabi   # the runtime
stratactl --profile <profile> --region <region> bootstrap --destroy  # StrataCI

bootstrap --destroy applies only when StrataCI was provisioned with the built-in pipeline (stratactl bootstrap --run). If your team deployed the runner with its own Terraform/OpenTofu, tear it down the same way (tofu destroy).

You own every resource; teardown is entirely under your control.