AWS networking

Korta Enterprise can use the region's default VPC, use an existing network configured in Settings, or build a network from a Markdown role. Networks belong to an AWS account and region. Configure and test an account under Settings > AWS > Accounts first; see AWS provisioning for authentication and IAM permissions.

Use the default VPC

If an instance role does not name a network, Korta uses the region's default VPC and default subnets. The manager selects subnets, an image, an SSH key and a security group and shows those choices in the plan. The account needs a default VPC and default subnets in the selected region for this option.

# AWS instance
- name: web
- count: 2

# Packages
- nginx

Create the role, run it, and review the plan before approval:

korta roles create --file web.md --name web
korta roles run role_ID

Build a network with a role

A network-only role creates a VPC and supporting networking. For example:

# AWS network
- name: prod
- region: eu-west-1
- cidr: 10.20.0.0/16
- zones: 3

The plan shows the resources to be created, including public and private subnets across zones, routes, an internet gateway and NAT gateways. Review it before approving. NAT gateways incur AWS charges. Use nat: none if private subnets do not need internet access, or nat: one to share one gateway across zones. See the AWS guide for permissions, adoption rules and lifecycle details.

Adopt or register an existing network

A network role can adopt an existing VPC. Korta adds its own tagged resources and leaves existing subnets and their routes in place. Alternatively, an administrator can register existing subnets under Settings > AWS with an account, region, address mode, optional SSH source networks and extra security groups.

Once created or registered, select the network by name:

# AWS instance
- name: api
- count: 3
- network: prod
- address: private

# Packages
- nginx

A private address requires a route from the manager into the VPC, for example through a VPN, VPC peering, or by running the manager inside the VPC. Public instances need the appropriate internet routing and security group rules. For public SSH, Korta can use the manager's detected public address; a network's SSH from setting can specify sources such as your VPN range.

Security groups and firewall rules

For a Korta-managed security group, the role's # Firewall section controls the ports Korta opens in AWS as well as on the host. Korta reconciles those rules on later runs, so removing a firewall entry can close that AWS port. If you provide your own security groups in the role, manage their rules yourself. Restrict SSH and application ingress to the networks that need access.

Load balancers, DNS and certificates

An # AWS load balancer section can create an Application Load Balancer with target groups, listeners and a health check. Public load balancers use public subnets and can forward to private instances. An # AWS DNS section can manage Route 53 records; certificate: auto can request and validate an ACM certificate for the named domains.

These features need additional AWS permissions. Read the load balancer and DNS and certificate sections for the full options, permissions, and resource lifecycle.

Changes and removal

For an existing network, region, account, VPC and ranges are fixed. Some additions, including zones, NAT gateways and SSH sources, are supported. Destroying a network requires first destroying instance roles that use it; the destroy plan removes the resources Korta created. For adopted VPCs, existing resources are retained. Review the plan and its consequences before approval.