Sold by: aMiSTACX
Deployed on AWS
This product has charges associated with it for performance optimisation, and hardening. Production-hardened Dify.ai visual LLM application studio and workflow orchestrator on Ubuntu 24.04 LTS featuring automated Caddy SSL, native vector database retrieval, and isolated sandboxed execution.
Overview
Deploy a Production-Grade Dify.ai GenAI Platform on Your Own AWS Infrastructure
Dify.ai is an open-source LLM application development platform that combines visual prompt orchestration, agent execution, retrieval-augmented generation (RAG) pipelines, and application monitoring into a unified workspace. This AMI delivers a self-contained, turnkey appliance built on Ubuntu 24.04 LTS - configured specifically for enterprise security, low-maintenance operations, and data sovereignty within your own AWS VPC.
Traffic is securely terminated via a high-performance native Caddy reverse proxy that provides automated Let's Encrypt SSL/TLS certificates and renewal out of the box. Transition from development HTTP to production HTTPS with a single CLI command.
What You Can Build with Dify.ai
- Visual LLM Application Studio: Design, test, and iterate on complex prompt chains and AI workflows using a drag-and-drop visual interface - no custom code required for orchestration.
- RAG-Powered Knowledge Retrieval: Connect your documents and data sources to pre-configured Weaviate vector search for intelligent, context-aware AI responses grounded in your proprietary content.
- Multi-Agent Workflows: Build sophisticated agent pipelines with safe, isolated code execution in a Docker-based sandbox environment designed for multi-agent function calling.
- Application Monitoring: Track prompt performance, token usage, and response quality from a single unified dashboard.
Enterprise Hardening and Security
- Hardened Ubuntu 24.04 LTS Base: Built on clean Noble Numbat minimal images with unnecessary packages and legacy daemons purged to reduce attack surface.
- Strict Network Isolation: Internal microservices (PostgreSQL 15, Redis 6, Weaviate vector engine, internal API daemon, and sandbox runtime) are bound strictly to internal Docker bridge networks and host loopback interfaces. Zero database or internal service ports are exposed to the public internet.
- Data Sovereignty: All data remains within your AWS VPC. No external telemetry or third-party data sharing - you maintain full control over your AI workloads and sensitive content.
Automated Zero-Touch Provisioning
Get running in minutes rather than days. Strong cryptographic secrets and initial environment configurations are automatically generated on first boot and written securely to /home/ubuntu/dify-credentials.txt as well as the EC2 system console log. No manual configuration files to edit before your first login.
- Automated Let's Encrypt SSL: Enable production HTTPS with a single command: sudo dify-ssl your-domain.com
- Native systemd Integration: The entire container topology is managed as standard systemd services (dify.service and caddy.service), guaranteeing clean restarts across instance reboots and maintenance cycles.
- Pre-Configured Vector Storage: Weaviate vector search is ready for document RAG indexing immediately after launch.
Architecture at a Glance
- Reverse Proxy: Caddy with automatic SSL certificate provisioning and renewal
- Database: PostgreSQL 15 for application state and metadata
- Cache: Redis 6 for session management and task queuing
- Vector Engine: Weaviate for high-performance document embedding and semantic search
- Code Sandbox: Isolated Docker-based execution environment for safe agent function calling
- OS: Ubuntu 24.04 LTS (Noble Numbat) minimal, hardened
Who This Is For
This AMI is designed for teams that need to deploy generative AI applications with enterprise-grade security and operational simplicity. Whether you are building internal AI assistants, customer-facing chatbots with RAG-powered knowledge bases, or complex multi-agent automation workflows, this platform gives you a production-ready foundation on infrastructure you fully control.
Launch the AMI, point your domain, and start building AI applications - all within your own AWS account.
Highlights
- Enterprise-Hardened Security and Network Isolation: Built on Ubuntu 24.04 LTS minimal images with unnecessary packages and legacy daemons purged. Internal microservices including PostgreSQL 15, Redis 6, and Weaviate vector engine are bound strictly to internal Docker bridge networks and host loopback interfaces. Zero database or internal service ports are exposed to the public internet, ensuring full data sovereignty within your own AWS VPC.
- Automated Zero-Touch Provisioning with Let's Encrypt SSL: Strong cryptographic secrets and environment configurations are automatically generated on first boot and written securely to a credentials file and the EC2 system console log. Transition from development HTTP to production HTTPS with a single CLI command. A native Caddy reverse proxy handles automated Let's Encrypt SSL/TLS certificate issuance and renewal out of the box.
- Visual LLM Orchestration with RAG and Sandboxed Execution: Dify.ai combines visual prompt orchestration, agent execution, retrieval-augmented generation pipelines, and application monitoring in a unified workspace. Includes pre-configured Weaviate vector search for document RAG indexing and an isolated Docker-based code execution sandbox for safe multi-agent function calling. The entire stack is managed via native systemd services for clean restarts across reboots.
Details
Sold by
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04 LTS
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.xlarge Recommended | $0.075 |
t3a.xlarge | $0.075 |
t3.2xlarge | $0.075 |
t3a.2xlarge | $0.075 |
c6a.2xlarge | $0.075 |
c6i.2xlarge | $0.075 |
c6id.2xlarge | $0.075 |
c6in.2xlarge | $0.075 |
c6a.4xlarge | $0.075 |
c6i.4xlarge | $0.075 |
Dimensions summary
You pay by the hour for the EC2 instance size you choose, with no monthly subscription. Billing stops when you stop the stack, so costs track actual usage. The many options are not feature tiers; they are hardware sizes across several instance families. General-purpose T3 and T3a cover lighter workloads. Compute-optimized C6 and C7 families suit processing-heavy tasks. Memory-optimized R6 and R7 families handle memory-intensive work. HPC variants target high-performance computing. Within each family, prices rise as you move to larger sizes, from large up through metal instances. AWS hosting charges are billed separately.
Top-of-mind questions for buyers
You pay a per-hour software rate for the chosen EC2 instance type. This covers the Dify.ai stack, the A51 Monitoring and Control Dashboard, bundled deployment modules, and deployment support. The rate maps to one running instance of that size. AWS hosting charges for the compute itself are billed separately by AWS.
No. Billing is pay-as-you-go per hour of use. When you stop the stack, the software charge stops. You will still incur any AWS charges for resources you keep, such as stored data. There is no monthly subscription, so costs track your actual running time.
Only the instance classes listed on AWS Marketplace are available at deployment. If you move to a different size, the hourly rate changes to match that instance. Larger sizes within a family cost more per hour. To request a class not listed, contact the vendor for options.
amistacx.io
Helpful?
Vendor refund policy
Software is usage-based, charged hourly, and can be terminated at any time. No refunds are available.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
Dify.ai Enterprise GenAI Application Platform v1.0.0 (Ubuntu 24.04 LTS) Release Date: October 2026 Base Architecture: x86_64 (amd64)
- PRODUCT OVERVIEW Initial production release of the turnkey Dify.ai Enterprise GenAI Application Platform appliance on Ubuntu 24.04 LTS. This golden image bundles the complete Dify visual orchestrator, multi-agent framework, RAG indexing pipelines, embedded Weaviate vector engine, isolated code sandbox runtime, and native Caddy reverse proxy with automatic Let's Encrypt TLS provisioning.
- COMPONENT VERSIONS
- Base OS: Ubuntu 24.04 LTS (Noble Numbat, Kernel 6.8+ x86_64)
- Dify Web Frontend: v1.17.1 (Next.js 16)
- Dify API Core & Celery Workers: v1.17.1 (Python / Flask)
- Dify Agent Backend & Plugin Daemon: v1.17.1 / v0.6.10
- Weaviate Vector Database: v1.39.2
- PostgreSQL Relational Database: 15-alpine
- Redis Cache & Message Broker: 6-alpine
- Isolated Code Execution Sandbox: v0.2.15
- Reverse Proxy: Caddy v2.8.4
- Container Runtime: Docker Engine 27.x with Docker Compose V2
- KEY FEATURES & ENTERPRISE HARDENING
- Zero-Touch Credential Provisioning: High-entropy cryptographic keys, database passwords, and cache secrets are automatically generated on initial boot via a systemd first-boot service. Credentials and setup instructions are output to the EC2 system console and saved to /home/ubuntu/dify-credentials.txt with restricted permissions (0600).
- Strict Network Isolation: Internal services (PostgreSQL 5432, Redis 6379, Weaviate, Sandbox 5004, and Plugin Daemon 5003) are strictly bound to internal Docker bridge networks or host loopback (127.0.0.1). No backend service ports are exposed to the public internet.
- Automated SSL / TLS Management: Includes the dify-ssl CLI utility (sudo dify-ssl [email]) for single-command Let's Encrypt SSL activation and automated certificate renewals managed natively by Caddy.
- Production Process Supervision: The complete Docker Compose topology is managed as standard systemd units (dify.service and dify-first-boot.service), ensuring proper boot ordering and automatic recovery after instance reboots or maintenance events.
- Security & Compliance Sanitization: Golden image disk sanitization performed prior to snapshot: SSH host keys, cloud-init state, machine IDs, temporary install logs, shell histories, and default database config files (including /etc/mysql/debian.cnf) have been purged to comply with AWS Marketplace security policies.
- KNOWN LIMITATIONS & REQUIREMENTS
- Architecture: 64-bit (x86_64) only. ARM/Graviton is not supported in this release.
- Sizing Floor: Minimum recommended instance type is t3.xlarge (4 vCPU / 16 GiB RAM). Instances with less than 16 GiB RAM are unsupported and may experience OOM failures during heavy document ingestion or simultaneous agent execution.
- Recommended Production Instances: m6i.xlarge, m7i.xlarge, or m6a.xlarge.
Additional details
Usage instructions
HARDWARE SIZING AND NETWORK CONFIGURATION
Recommended Instance Types:
Testing and Development: t3.xlarge or t3a.xlarge (4 vCPU, 16 GiB RAM)
Production Workloads: m6i.xlarge, m7i.xlarge, or m6a.xlarge (4 vCPU, 16 GiB RAM)
High-Throughput / Large Knowledge Bases: m6i.2xlarge or r6i.xlarge (32 GiB RAM)
Storage: Minimum 50 GiB gp3 root EBS volume (100 GiB or higher recommended for document uploads and vector storage).
Security Group Inbound Rules:
Port 22 (TCP) - SSH administrative access (restrict to your IP or management CIDR).
Port 80 (TCP) - HTTP web traffic and Let's Encrypt automated challenge validation (open to 0.0.0.0/0).
Port 443 (TCP) - HTTPS encrypted web access (open to 0.0.0.0/0).
Note: Internal microservice ports (5432, 6379, 5001, 5003, 5004, 5050, 8080) are isolated on host loopback and internal Docker bridges. Do not expose them to the public internet.
INITIAL LAUNCH AND SETUP WIZARD On initial launch, the system automatically runs database migrations, provisions cryptographic secrets, and initializes container microservices. This process takes approximately 45 to 60 seconds from instance start.
Step 1 - Access Setup Wizard: Open your web browser and navigate to: http://<INSTANCE_PUBLIC_IP>/install
Step 2 - Administrator Account Creation: Follow the on-screen instructions to set up the primary Administrator account by entering:
Admin Email
Admin Username
Admin Password
Step 3 - Login: After submitting the form, you will be redirected to the Dify Studio login page. Enter your new admin credentials to access the workspace.
OPTIONAL: VERIFY SYSTEM STATUS VIA SSH You can connect to your instance via SSH at any time using your EC2 key pair: ssh -i /path/to/key.pem ubuntu@<INSTANCE_PUBLIC_IP>
To view the generated first-boot information banner: cat /home/ubuntu/dify-credentials.txt
CONFIGURING A CUSTOM DOMAIN AND AUTOMATIC HTTPS (SSL) The appliance includes a built-in automated SSL configuration utility powered by Caddy and Let's Encrypt.
Step 1 - Configure DNS: Create an A record in your DNS provider pointing your domain name (for example, dify.yourdomain.com) to your EC2 instance public IPv4 address. Ensure the DNS record has propagated.
Step 2 - Run the SSL Utility: Connect to the instance via SSH and run: sudo dify-ssl <your-domain.com> [admin-email]
Example: sudo dify-ssl dify.example.com admin@example.com
The utility automatically reconfigures Caddy, issues an SSL/TLS certificate through Let's Encrypt, enforces automatic HTTPS redirection, and schedules renewals.
Step 3 - Access Securely: Open your browser and navigate to: https://<your-domain.com>
CONNECTING LLM PROVIDERS To begin building conversational assistants, agent workflows, and RAG pipelines:
Log in to the Dify web interface.
Click on your profile icon in the top right corner and select Settings.
Select Model Provider from the left sidebar.
Add your API keys for your preferred models (such as OpenAI, Anthropic, AWS Bedrock, Azure OpenAI, Google Gemini, Groq, or self-hosted LiteLLM/vLLM endpoints).
Set system default models for completions, chat, embeddings, and reranking.
SERVICE MANAGEMENT AND TROUBLESHOOTING All services are integrated with systemd for automatic startup on reboot.
Check overall application status: sudo systemctl status dify.service
Check reverse proxy status: sudo systemctl status caddy.service
Check running Docker containers: sudo docker compose -f /opt/dify/docker-compose.yaml ps
View live application logs: sudo docker compose -f /opt/dify/docker-compose.yaml logs -f api worker nginx
Restart the Dify application: sudo systemctl restart dify.service
Application configuration file location: /opt/dify/.env
Support
Vendor support
Deployment support for this product is available via email, chat, and bot. To reach the support team, visit:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
OAIS Sentinel is a zero-knowledge sovereign AI governance and cryptographic audit ledger for enterprise LLMs on AWS. It delivers real-time DLP redaction, prompt injection defense, and RFC 6962 tamper-evident Merkle audit proofs with sub-millisecond latency.
Scale GenAI Platform accelerates the path to safe, highly performant, and lower-cost production deployment by embedding innovative test & evaluation technology throughout the development lifecycle.
This product has charges associated with it for performance optimisation, hardening, and the aMiSTACX A51 Monitoring and Control dashboard. Deploy a turnkey, production-ready Qdrant Vector Database appliance featuring automated Let's Encrypt SSL via Caddy, pre-configured API key security, native Web UI dashboard, and high-performance kernel tuning on Ubuntu 24.04 LTS.
An enterprise-grade AI application development platform with more advanced capabilities than Dify Premium, built for organizations demanding top-tier security, compliance, and scalability.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.