Deployment options

Audience: DevOps who subscribed on AWS Marketplace and need to choose how to run PrivaCI in production.

When you are done: You know which deployment path fits your environment and where to go next.

---

Subscribe once, deploy your way

Every production path starts the same way:

1. Subscribe to the container contract listing on AWS Marketplace (Standard or Compliance tier).
2. Pull the commercial image from Marketplace-managed ECR (URI on your subscription page).
3. Scaffold mask-rules.yaml with privaci init (review with plan) — see Quickstart.
4. Run a one-shot batch job in your VPC with Postgres source + target.

Entitlement is verified at container start via AWS License Manager CheckoutLicense on the task/instance IAM role — not via a BoundaryLogic API, JWT, or GetEntitlements.

You need	Doc
Fastest first run (docker run)	Quickstart
License tiers + IAM policy	Licensing & entitlement
Post-subscribe smoke (<10 min)	Customer install

---

Choose your orchestrator (v1)

Path	Best for	Status
Amazon ECS Fargate	Production AWS — scheduled or ad-hoc RunTask	v1 — recommended (Quick Launch CFN)
Docker on EC2	Single-host smoke, small teams, lift-and-shift	v1
Amazon EKS / Kubernetes	Existing K8s platform — run as a Job / CronJob	v1 — documented (below)
AWS Batch	Large parallel batch fleets	On request — contact support

The commercial image is a standard OCI container and runs unchanged on any of these. The orchestrator only differs in how it supplies the IAM identity for CheckoutLicense and how you schedule the one-shot job.

---

What every path requires

Requirement	Notes
Marketplace subscription	Standard or Compliance — see tiers
IAM role	license-manager:CheckoutLicense + CheckInLicense on the task/instance role
AWS_REGION	Region where you subscribed
Postgres source + target	In-VPC network path from the job
Secrets	DSNs + ANONYMIZATION_SALT (≥32 chars) via Secrets Manager or env injection
mask-rules.yaml	Scaffold with privaci init, review with plan — Quickstart · public configuration

There is no product code or license ARN to copy for container contract listings. The image bakes its ProductSKU; staging builds may set PRIVACI_MARKETPLACE_PRODUCT_SKU.

---

CloudFormation quick launch (ECS)

BoundaryLogic provides a buyer-account CloudFormation template with the task role, execution role, Fargate task definition, and an optional ECS cluster (leave EcsClusterName empty) pre-wired for CheckoutLicense. Download it from your Marketplace subscription fulfillment instructions (or https://docs.boundarylogic.io/commercial/assets/quick-launch.yaml).

See Deploy on AWS ECS for Postgres grants, secrets (including rotation), parameters, and the first RunTask.

---

Amazon EKS / Kubernetes

PrivaCI is a one-shot batch job, so on Kubernetes it is a Job (ad-hoc) or a CronJob (scheduled refresh) — not a long-running Deployment. The same Marketplace image runs unchanged; the only requirement is that the pod's IAM identity can call license-manager:CheckoutLicense and CheckInLicense.

Grant that with IRSA (IAM Roles for Service Accounts) or EKS Pod Identity — the Kubernetes equivalent of the ECS task role:

eksctl create iamserviceaccount \
  --cluster my-cluster --namespace privaci --name privaci \
  --attach-policy-arn arn:aws:iam::<account>:policy/PrivaciCheckoutLicense \
  --approve

The policy mirrors iam-task-role.json (CheckoutLicense + CheckInLicense). Then run the job:

apiVersion: batch/v1
kind: Job
metadata:
  name: privaci-run
  namespace: privaci
spec:
  backoffLimit: 0
  template:
    spec:
      serviceAccountName: privaci   # IRSA identity for CheckoutLicense
      restartPolicy: Never
      containers:
        - name: privaci
          image: 709825985650.dkr.ecr.us-east-1.amazonaws.com/boundarylogic/privaci-commercial:1.0.13
          args: ["run", "--config", "/config/mask-rules.yaml"]
          env:
            - name: AWS_REGION
              value: us-east-1
            - name: SOURCE_DB_URL
              valueFrom: { secretKeyRef: { name: privaci-dsn, key: source } }
            - name: TARGET_DB_URL
              valueFrom: { secretKeyRef: { name: privaci-dsn, key: target } }
            - name: ANONYMIZATION_SALT
              valueFrom: { secretKeyRef: { name: privaci-salt, key: salt } }
          volumeMounts:
            - { name: config, mountPath: /config, readOnly: true }
      volumes:
        - name: config
          configMap: { name: privaci-mask-rules }

Swap Job for CronJob (with a schedule:) for recurring staging refreshes. Use 1.0.13+ (1.0.11+ for CheckoutLicense) — older images fail CheckoutLicense.

Note (AWS Marketplace): as of March 1, 2026 AWS discontinued Quick Launch for Helm chart deployments on EKS. Deploy with standard kubectl / helm commands as above; there is no one-click EKS launch.

---

Evaluation without subscribing

Try the open-source engine locally with masked fixture data — no Marketplace subscription required:

Engine quickstart (evaluation)

Commercial capabilities (signed reports, drift gate, FK subsetting) require a Compliance-tier subscription or an offline JWT contract.

---

FAQ

Do I need SaaS registration / a fulfillment URL?
No. Container contract listings resolve entitlement via License Manager at job start. An optional setup page may collect onboarding email — it is not on the runtime critical path.

Can I use the public GHCR image in production?
No. Production paid deployments use the Marketplace image, which includes the commercial layer and License Manager integration.

Why does the Marketplace launch page list Amazon EKS when the listing only ships an ECS/container-image delivery option?
Because container products are runtime-agnostic. AWS Marketplace advertises a container image as deployable on every supported service — ECS, EKS, Fargate, EKS Anywhere, and self-managed Kubernetes — regardless of which delivery option the seller configured. The delivery option only controls the tailored instructions and templates you get (for us: the ECS container-image option plus the Quick Launch CFN). Choosing EKS on the launch page just gives generic "pull the image and deploy it on your cluster" guidance — use the Kubernetes Job above. It is not a misconfiguration, and there is no per-version EKS toggle to switch off.

Which tier do I need?
Standard covers keyed masking + JSONB. Compliance adds subsetting, drift detection, strict-gate CI, and signed reports — see the capability table.