---
title: Amazon Web Services Ocient Installation
slug: Manl-draft-amazon-web-services-ocient-installation
description: Set up an Ocient system on AWS, utilizing cloud infrastructure for scalable and efficient data warehousing.
docTags: 
createdAt: Tue Jul 29 2025 20:43:06 GMT+0000 (Coordinated Universal Time)
updatedAt: Mon Mar 30 2026 18:52:34 GMT+0000 (Coordinated Universal Time)
---

This guide explains how to install an Ocient® System in Amazon® Web Services℠ (AWS℠).

For details about AWS concepts, see these pages:

- [What is Amazon EC2?](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/concepts.html)
- [What is IAM?](https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html)
- [A Primer for Amazon Networking - VPC, Availability Zones & Subnets](https://aws.amazon.com/blogs/apn/amazon-vpc-for-on-premises-network-engineers-part-one/)

Ocient supports deployment in AWS for pilot or testing purposes, but this setup does not guarantee data durability. Stopping Amazon  EC2℠ instances can result in permanent data loss.

The steps for deploying an Ocient System in AWS are:

1. Prepare AWS resources.
2. Set up an initial instance.
3. Create Amazon Machine Images (AMI) from the initial instance.
4. Launch other instances.
5. Follow the standard Ocient installation procedure.

## **Example Configuration**

The table below shows the recommended instance types for each node type.&#x20;

| **Node Type**        | **Instance Type**       |
| -------------------- | ----------------------- |
| Foundation Nodes (3) | i3en.metal, i7ie.metal  |
| Loader Nodes (1)     | i3en.metal, i7ie.metal  |
| SQL Nodes (1)        | r5dn.metal, r6idn.metal |

This diagram shows an example of an Ocient cluster in AWS. The EC2 nodes (SQL, Loader, and Foundation) are deployed within a single subnet of an Amazon  Virtual Private Cloud℠ (VPC). AWS assigns each type of node to a separate security group (`sg1`, `sg2`, `sg3`).

![Virtual private cloud for loading data from an S3 bucket using a JDBC client](https://api.archbee.com/api/optimize/zLEvgH2ISPR6In81OlyIL/gj4Ou8NmkREsrOn4a1LXq_vpc.png)

## Prepare AWS Resources

Create and configure these AWS resources:

- The VPC and subnets for the Ocient System.
- Security groups to access the endpoints for each node type. For details about the network security configuration, see the [Ocient Security Guide](<././Database Administration/Ocient Security Guide.md>).
- Identity and Access Management (IAM) roles.&#x20;

:::hint{type="info"}
If you are loading data from S3, the loader nodes require IAM access to an S3 bucket.
:::

## Node Setup (SQL Role) for Initial Instance

:::::WorkflowBlock
::::WorkflowBlockItem
### Launch Instance

Use this configuration for your AMI. Configuration steps differ depending on whether your setup uses a single-volume or multi-volume AMI.&#x20;

### **Operating System (OS)**

To set up the AMI, you can use any Ocient-supported OS (see [Ocient System Requirements](<./Install an Ocient System/Installation Reference/Ocient System Requirements.md>)). &#x20;

**Single-Volume AMI**

If you use a single-volume AMI, specify this configuration:&#x20;

- Increase the root volume to 128GB or more.&#x20;

**Multi-Volume AMI**

If you use a multi-volume AMI (e.g., CIS hardened RHEL 9), use this configuration: &#x20;

- Increase root volume to 30GB or more.&#x20;
- Increase Elastic Block Store (EBS) volume to 100GB or more.

:::hint{type="info"}
This EBS volume supports key system directories in the image (`/home`, `/var`, `/var/log`, `/var/log/audit`, `/var/tmp`).
:::

**Instance Type**

Use r5dn.metal or a similar instance type.

**Security Group&#x20;**

Use one or more security groups with these rules:&#x20;

- Allow SSH to the nodes.&#x20;
- Allow communication internally between nodes.&#x20;
- Allow access to SQL Node endpoints described in the [Ocient Security Guide](<././Database Administration/Ocient Security Guide.md>).&#x20;
::::

:::WorkflowBlockItem
### Access Shell

Connect to your instance using Secure Shell (SSH). For details, see [Connect to your Linux instance using an SSH client](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-linux-inst-ssh.html).&#x20;
:::

::::WorkflowBlockItem
### Extend Logical Volume Manager (LVM) Volumes (Multi-Volume AMI Only)

:::hint{type="info"}
This step applies only to multi-volume AMIs. If you are using a single-volume instance, skip this step.
:::

If you use a multi-volume manager, extend the `/home` and `/var` LVM volumes and their filesystems to fill up the expanded EBS volumes. These actions expand the LVM volume and the contained file system to accommodate the Ocient package, logging, and metadata.&#x20;

These code examples show how to extend LVM volumes for a CIS Red Hat® Enterprise Linux® (RHEL®) 9 image.&#x20;

:::hint{type="info"}
Other AMI types might require different sizing. Contact Ocient support for the best sizing for your system for multi-volume instances.
:::

**Example&#x20;**

Resize the physical volumes of two drives to use their full capacity after expanding them (see Step 1).&#x20;

```shell
sudo pvresize /dev/nvme0n1
sudo pvresize /dev/nvme1n1
```

Extend local volumes:&#x20;

- Add 66 percent of the available free space in `vg-01` to the `var_vol` logical volume.&#x20;
- Add all (100 percent) of the remaining free space in `vg-01` to the `home_vol` logical volume.&#x20;

```shell
sudo lvextend -l +66%FREE /dev/vg-01/var_vol
sudo lvextend -l +100%FREE /dev/vg-01/home_vol
```

Extend the file system to use all available space on its underlying logical volume.&#x20;

```shell
sudo xfs_growfs /home
sudo xfs_growfs /var
```
::::

:::WorkflowBlockItem
### Update Packages

Update all your software packages to their latest versions and then reboot your instance.&#x20;

For RHEL-compatible systems, use this command.

```shell
sudo dnf update
```

For Debian®-compatible systems, use this command.

```shell
sudo apt update
```

Reboot after the update.

```shell
sudo reboot
```
:::

:::WorkflowBlockItem
### Install the Ocient Package

Copy over the `ocient` RPM or DEB package and install it.

For RHEL-compatible systems, use this command.

```shell
sudo dnf install ./ocient-RELEASE-XX.X.X-xxxxxxxxxxxxxx-x86_64.rpm
```

For Debian-compatible systems, use this command.

```shell
sudo apt install ./ocient-RELEASE-XX.X.X-xxxxxxxx.xxxxxx-xxxxxxxxxxxx-amd64.deb
```
:::

:::WorkflowBlockItem
### Set Up Kernel Parameters

Use the `ockernelparams` utility to set up kernel parameters automatically, including the huge pages configuration. Repeat this step on other nodes.

```shell
sudo /opt/ocient/scripts/ockernelparams --node-role sql  
```

Reboot the system for the parameters to take effect.

```shell
sudo reboot
```

Check that the local storage drive is attached to the `uio` or `vfio` driver after reboot (the Ocient package installs a service that runs on startup to do this).

```shell
sudo /opt/ocient/scripts/nvme-driver-util.sh
```

For examples of attaching drivers to the NVMe drives, see [NVMe Drive Firmware Upgrade Process](<./Maintenance Overview/NVMe Drive Maintenance/NVMe Drive Firmware Upgrade Process.md>).&#x20;
:::

::::WorkflowBlockItem
### Configure the Firewall

:::hint{type="info"}
If you are not using an OS-level firewall, skip this step.&#x20;
:::

If your base AMI includes a system firewall, you must configure rules that explicitly allow required network communication for your Ocient deployment. For details, see [Ocient Security Guide](<././Database Administration/Ocient Security Guide.md>).&#x20;

Required OS firewall rules:

- Allow all necessary ports and protocols between Ocient nodes by: &#x20;
  - Opening all TCP/UDP ports within the private network range (e.g., `10.0.0.0/16`).
  - Or, allowing known Ocient ports.
- Allow external access where needed by:
  - Enabling SSH access (port 22) from your administrator IP range.
  - Allowing client access to SQL endpoints (for example, port 13101 or as specified in your setup).
  - Opening any additional ports required for monitoring or management tools.

For a list of required ports, see [Network Exposure and Firewall](<././Database Administration/Ocient Security Guide.md>).
::::
:::::

## Create AMI

After your initial node is fully configured, you must replicate the setup process for the remaining nodes in your cluster. This action ensures consistency and allows for proper internal communication between nodes.

For details about creating an AMI, see [Creating an AMI from an Amazon EC2 Instance](https://docs.aws.amazon.com/toolkit-for-visual-studio/latest/user-guide/tkv-create-ami-from-instance.html).&#x20;

## Set Up Remaining Nodes to Launch the Remaining Instances

Go through this process for each of your remaining nodes.&#x20;

::::WorkflowBlock
:::WorkflowBlockItem
### Set Up Parameters

Launch the remaining instances with these parameters:

- AMI — Use the AMI created in the [Node Setup (SQL Role) for Initial Instance](./#node-setup-sql-role-for-initial-instance) step.&#x20;
- Instance Type — Use `i3en.metal` or an equivalent instance that:
  - Offers local NVMe SSDs for high-performance local storage.
  - Has high throughput and network bandwidth for internal cluster communication.
- Security groups — Ensure these security rules are in place in the AWS security groups associated with the nodes:&#x20;
  - Allow SSH to the nodes.
  - Allow internal communication between all Ocient nodes.
  - Allow access to endpoints described in the [Ocient Security Guide](<././Database Administration/Ocient Security Guide.md>).
:::

:::WorkflowBlockItem
### Access Shell

Connect to your instance using Secure Shell (SSH). For details, see [Connect to your Linux instance using an SSH client](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/connect-linux-inst-ssh.html).
:::

:::WorkflowBlockItem
### Set Up Kernel Parameters

Use the `ockernelparams` utility to set up kernel parameters automatically, including the `hugepages` parameters.

This example specifies a Foundation Node `foundation`. Use a different node type as necessary.&#x20;

```shell
sudo /opt/ocient/scripts/ockernelparams --node-role foundation  
```
:::
::::

## Bootstrap the Ocient System&#x20;

Complete the bootstrapping process for your Ocient System. For details, see [Node Bootstrapping Reference](<./Install an Ocient System/Installation Reference/Node Bootstrapping Reference.md>).&#x20;

## Related Links

[Load Data](<././Load Data.md>)&#x20;

[Query Ocient](<././Query Ocient.md>)





