AI Agent

NLSQL AI Agent 1.0.0 Full guide: https://github.com/denissa4/nlsql-gcp-marketplace/blob/ <commit>/docs/aws-deployment-guide.md

Image: 709825985650.dkr.ecr.us-east-1.amazonaws.com/nlsql/ai-agent:1.0.0 Deploy this delivery option's CloudFormation template (Amazon ECS, AWS Fargate) in the subscribing account, in us-east-1/2, us-west-1/2, ca-central-1, sa-east-1, eu-west-1/2/3, eu-central-1, eu-north-1, ap-south-1, ap-northeast-1/2 or ap-southeast-1/2.

BEFORE YOU START

1. Enable your Claude model in Amazon Bedrock (Model catalog, use case form if asked, one playground prompt; needs aws-marketplace:Subscribe).
2. In your Microsoft Azure subscription, create a single-tenant Azure Bot for Microsoft Teams; note its App ID, tenant ID and a client secret.
3. DocsAndSql mode: get a free API token at https://nlsql.com  and a read-only database user.
4. Two public subnets in different Availability Zones, with a route to your database.

DEPLOY

1. Create one Secrets Manager secret in the stack's Region, JSON keys: AppPassword (bot client secret); for DocsAndSql also ApiToken and DbPassword.
2. Create the stack from the template; set Mode, VpcId, SubnetIds, CredentialsSecretArn, MicrosoftAppId, MicrosoftAppTenantId, LanguageModel and, for DocsAndSql, DatabaseType, DataSource, DbName, DbUser (DbPort, DbSchema, Warehouse as needed). Acknowledge IAM capabilities. First launch: choose Preserve successfully provisioned resources (--disable-rollback) to keep a failed start's logs. Wait for CREATE_COMPLETE (15-25 min).
3. Azure Bot, Settings, Configuration: set Messaging endpoint to the MessagingEndpoint output. Add the Microsoft Teams channel.
4. Upload documents to the DocumentsBucket output, then: aws ecs update-service --cluster <ClusterName> --service <ServiceName> --force-new-deployment
5. Install the bot in Teams from the guide's manifest template.

HEALTH AND MONITORING

• HealthCheck output: 200 once the subscription is verified.
• ReadinessCheck output: 200 {"status":"ready"} once documents are indexed (CREATE_COMPLETE does not wait for it).
• LogGroupName: "entitlement verified" at start; "cannot start" says why a task stopped.
• ECS console: service Events, Tasks and target health.

DATA, ENCRYPTION, ROTATION, BACKUP Credentials live only in your Secrets Manager secret (AWS KMS, or your KmsKeyArn), injected at task start. Documents stay in your S3 bucket (SSE-S3 or your KMS key), the only data store, kept on stack deletion and re-indexed at every start. Viewers use CloudFront HTTPS (TLS 1.2+); the load balancer admits only CloudFront (HTTP inside AWS) with a per-stack header. Charts and CSV exports stay on the task's encrypted disk for 24 h. Bedrock global inference may process prompts in any commercial AWS Region. To rotate, update the secret and force a new deployment; renew the Entra client secret before it expires. The template creates no KMS keys.

COSTS AND QUOTAS Billed by AWS on top of the monthly subscription: Fargate (4 vCPU, 8 GB by default), load balancer, CloudFront, S3, Secrets Manager, CloudWatch Logs, public IPv4 and Amazon Bedrock tokens. Keep the Fargate On-Demand vCPU quota at 8+ (deployments briefly run two tasks); raise the model's Bedrock tokens-per-minute quota if answers throttle.

EXTERNAL DEPENDENCIES This product requires an ongoing internet connection. The following ongoing external services are required to properly function: AWS Marketplace Metering Service, Amazon Bedrock, Amazon S3, AWS Secrets Manager, Amazon CloudWatch Logs, Amazon ECR, a Microsoft Azure subscription for the Azure Bot resource (the standard Microsoft Teams channel is free), Microsoft Entra ID, Microsoft Bot Connector, Microsoft Teams and SharePoint file hosts (files sent to the bot) and, in DocsAndSql mode only, api.nlsql.com (question text only; free token) and https://cdn.plot.ly  (map answers).

Support: info@nlsql.com , https://nlsql.com/contacts