NLSQL

FULL GUIDE: https://github.com/denissa4/nlsql-gcp-marketplace/blob/AWS-ECS/docs/aws-deployment-guide.md 

WHAT THIS DEPLOYS An ECS cluster, a Fargate service running NLSQL, a load balancer, a CloudFront distribution terminating HTTPS, IAM task roles and a log group, all billed by AWS separately. The container listens on TCP 8080 as uid 10001, with the load balancer forwarding port 80 to it. Writing your own task definition, map 8080 - port 80 never goes healthy.

EXTERNAL DEPENDENCY NLSQL needs an ongoing internet connection: api.nlsql.com translates questions into SQL, and the AWS Marketplace Metering Service verifies your subscription. Your database is queried inside your own VPC and its contents go to neither service. Tasks need outbound internet access.

BEFORE YOU START

1. Subscribe first and deploy into the SAME AWS account. The container verifies the subscription at start-up and exits if the account is not entitled.
2. Use one Region throughout: the secret must be in the stack's Region, as ECS cannot read one from another. Leave the 709825985650.dkr.ecr.us-east-1.amazonaws.com image path as written in every Region.
3. Two or more PUBLIC subnets in different Availability Zones, each routed to an internet gateway. The load balancer shares them with the tasks.
4. A database reachable from those subnets: Microsoft SQL Server, MySQL, PostgreSQL or Snowflake. Read-only user recommended - NLSQL issues only SELECT. Snowflake: account identifier in DataSource, plus Warehouse and DbSchema.
5. An NLSQL API token, self-service at https://nlsql.com . The NLSQL account is included with your AWS Marketplace subscription - no separate purchase.
6. An Azure Bot resource in your Entra tenant with a single-tenant app registration. Note its App ID, secret and tenant ID.
7. Rights to create IAM roles (what CAPABILITY_IAM acknowledges), secretsmanager:CreateSecret, and the usual ECS, ELB, EC2, CloudFront and Logs access.

STEP 1 - STORE CREDENTIALS aws secretsmanager create-secret --name nlsql/credentials --region us-east-1 --secret-string '{"ApiToken":"YOUR_TOKEN","DbPassword":"YOUR_DB_PASSWORD","AppPassword":"YOUR_BOT_SECRET"}' Note the ARN. All three keys are required; AppPassword is the Azure Bot secret.

STEP 2 - LAUNCH THE STACK Download the deployment template linked on this listing, then CloudFormation > Create stack > Upload a template file. Required: VpcId, SubnetIds, DataSource, DbName, DbUser, CredentialsSecretArn, MicrosoftAppId, MicrosoftAppTenantId. ImageUri defaults to this version's image. Creation takes 10-20 minutes, mostly CloudFront. Outputs exist only once it finishes: aws cloudformation wait stack-create-complete --stack-name nlsql --region us-east-1 DesiredCount defaults to 1. The trial covers one task for 30 days; after that every task is billed hourly, and a second task bills from the moment you start it.

STEP 3 - CONNECT MICROSOFT TEAMS Stack outputs: aws cloudformation describe-stacks --stack-name nlsql --query 'Stacks[0].Outputs' --region us-east-1 Paste MessagingEndpoint into that Azure Bot resource's Messaging endpoint field, add the Microsoft Teams channel to it, then install the bot in Teams.

STEP 4 - CONFIRM Open ApplicationUrl and ask a question about your data. HealthCheck returns 200 once in service; logs are in the group named by LogGroupName. A task restarting repeatedly means the account is not subscribed, or the subnets lack outbound internet access.

IAM AND DATA ExecutionRole pulls the image, writes logs, and reads GetSecretValue on only the secret ARN you supply. TaskRole grants only aws-marketplace:RegisterUsage, so the task can verify entitlement and report hours. Your secrets stay in Secrets Manager, encrypted at rest, never in the task definition, image or logs. To rotate: update the secret, then aws ecs update-service --cluster nlsql --service <name> --force-new-deployment

SUPPORT info@nlsql.com  - https://nlsql.com/contacts