Skip to content

OpenHands AWS Infrastructure v0.1.0 - Initial Release

Choose a tag to compare

View all tags
@zxkane zxkane released this 29 Jan 03:58
v0.1.0
68af96f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

OpenHands AWS Infrastructure v0.1.0

Initial release of the AWS CDK infrastructure for deploying OpenHands - an AI-driven development platform.

Highlights

🚀 Production-Ready AWS Infrastructure - Complete CDK stack for deploying OpenHands with enterprise features

🔐 Multi-Tenant Authentication - Cognito integration with OAuth2, managed login, and multi-domain support

📦 Self-Healing Architecture - Conversation history and workspaces persist across EC2 replacements

🌐 Runtime Subdomain Routing - User apps accessible via {port}-{convId}.runtime.{subdomain}.{domain}

Features

Infrastructure (8 CDK Stacks)

  • AuthStack - Cognito User Pool with custom email templates
  • NetworkStack - VPC configuration with endpoints
  • SecurityStack - KMS, IAM roles, security groups
  • MonitoringStack - CloudWatch dashboards, alarms, S3 data bucket
  • DatabaseStack - Aurora Serverless v2 PostgreSQL with RDS Proxy
  • UserConfigStack - User configuration API (Lambda) for multi-tenant MCP management
  • ComputeStack - EC2 Auto Scaling with Graviton (ARM64) instances
  • EdgeStack - CloudFront, Lambda@Edge, WAF

Key Capabilities

  • Cognito Authentication with 30-day sessions and silent token refresh
  • Aurora Serverless v2 with RDS Proxy for high availability
  • S3 + EFS Persistence - Conversations and workspaces survive instance replacement
  • Sandbox AWS Access - Optional scoped IAM credentials for sandbox containers
  • MCP Server Support - AWS Docs and Chrome DevTools MCP integration
  • Cross-User Authorization - Runtime requests verify container ownership

Security

  • WAF protection on CloudFront
  • Origin verification headers (direct ALB access blocked)
  • VPC Endpoints for AWS services
  • KMS encryption for secrets
  • Automated security scanning in CI

What's Included

Component Description
CDK Stacks 8 production-ready CloudFormation stacks
Docker Config Custom agent-server image with patches
OpenResty Proxy Runtime subdomain routing
Lambda@Edge JWT verification and routing
User Config API Multi-tenant MCP and secrets management
E2E Test Cases Comprehensive test documentation
GitHub Workflow Skill 10-step development workflow

Requirements

  • AWS CLI configured
  • Node.js 20+
  • Existing VPC with private subnets
  • Route 53 Hosted Zone

Getting Started

npm install
npx cdk deploy --all \
  --context vpcId=<vpc-id> \
  --context hostedZoneId=<zone-id> \
  --context domainName=<domain> \
  --context subDomain=openhands \
  --context region=<region>

See README.md for full deployment instructions.

Full Changelog

See CHANGELOG.md for detailed changes.

Assets 2
Loading