​

Dify Enterprise Edition Deployment Guide (AWS)

​

1. Infrastructure Requirements

​

Required AWS Services:

• S3
• ECR

​

Supported Authentication Methods:

• Access Key Mode (AK/SK): Provide credentials via environment variables
• IRSA Mode: IAM Roles for Service Accounts to enable secure and fine-grained access control

​

2. Access Key Mode

​

Step 1: Prepare Credentials

​

Step 2: Create Kubernetes Secret

kubectl create secret generic image-repo-secret --from-file=<path to .aws/credentials>

​

Step 3: Update values.yaml

persistence:
  type: "s3"
  s3:
    endpoint: "https://s3.{region_code}.amazonaws.com"
    region: "{region_code}"
    bucketName: "your_bucket_name"
    useAwsS3: true
    useAwsManagedIam: false
    accessKey: "{your access key}"
    secretKey: "{your secret key}"

plugin_daemon:
  enabled: true
  replicas: 1
  apiKey: "dify123456"

plugin_connector:
  apiKey: "dify123456"
  imageRepoSecret: "image-repo-secret"
  imageRepoPrefix: "{account_id}.dkr.ecr.{region}.amazonaws.com/dify-ee"
  imageRepoType: ecr
  ecrRegion: "us-west-2"

​

Step 4: Configure Plugin Daemon Database

externalPostgres:
  enabled: true
  address: "rds_address"
  port: "5432"
  credentials:
    plugin_daemon:
      database: "dify_plugin_daemon"
      username: "{user}"
      password: "{password}"
      sslmode: "disable"
    audit:
      database: "audit"
      username: "{user}"
      password: "{password}"
      sslmode: "disable"

​

Step 5: Upgrade Helm Release

helm upgrade -i dify -f values.yaml dify/dify

​

3. IRSA Mode

​

✅ Benefits

• Follows AWS security best practices
• Enables fine-grained control over plugin execution environments

​

Setup

​

Step 1: Set up IAM role and Service Account

• Prerequisites

  • An available AWS Region and EKS cluster.
  • An existing S3 bucket for Dify file storage.
  • kubectl is installed and configured locally, and can access the target EKS cluster.
  • AWS CLI is installed and credentials are configured locally.

🚀Option A: Run One-Click Script

./irsa_one_click.sh

🔨Option B: Manually setup

1. Enable the IAM OIDC provider for your EKS cluster Follow the official AWS documentation to associate your EKS cluster with an OIDC identity provider. This step is required before you can use IAM Roles for Service Accounts (IRSA).
2. Setup IAM Policy

   Item	Example Naming	Description
   S3 Policy Name	dify-ee-irsa-<cluster_name>-s3-policy	Full access to the specified S3 bucket
   ECR Policy Name	dify-ee-irsa-<cluster_name>-ecr-policy	Full access to ECR and read-only access to CloudTrail
   ECR Policy Name	dify-ee-irsa-<cluster_name>-ecr-pull-only-policy	Allows pull-only operations from ECR

3. Setup Role with policy

   Item	Example Naming	policy
   IAM Role - S3	DifyEE-Role-<cluster_name>-s3	dify-ee-irsa-<cluster_name>-s3-policy
   IAM Role - S3 + ECR	DifyEE-Role-<cluster_name>-s3-ecr	dify-ee-irsa-<cluster_name>-s3-policy dify-ee-irsa-<cluster_name>-ecr-policy
   IAM Role - ECR Pull-only	DifyEE-Role-<cluster_name>-ecr-image-pull	dify-ee-irsa-<cluster_name>-ecr-pull-only-policy

4. Setup ServiceAccount with IAM Role

   Purpose	Default Name	Bound IAM Role	Description
   For dify-api, dify-worker	dify-api-sa	DifyEE-Role-<cluster_name>-s3	Backend services access S3 for file uploads etc.
   For dify-plugin-crd build	dify-plugin-crd-sa	DifyEE-Role-<cluster_name>-s3-ecr	Accesses S3 and operates plugin image repositories
   For dify-plugin runtime	dify-plugin-runner-sa	DifyEE-Role-<cluster_name>-ecr-image-pull	Pulls plugin images for running plugins

​

Step 2: Set Environment Variables

​

Step 3: Update values.yaml

persistence:
  type: "s3"
  s3:
    endpoint: "https://s3.{region_code}.amazonaws.com"
    region: "{region_code}"
    bucketName: "your_bucket_name"
    useAwsS3: true
    useAwsManagedIam: true

api:
  enabled: true
  replicas: 1
  innerApi:
    enabled: true
    apiKey: "dify123456"
  serverWorkerAmount: 1
  serviceAccountName: "dify-api-sa"

worker:
  enabled: true
  replicas: 1
  serviceAccountName: "dify-api-sa"

plugin_daemon:
  enabled: true
  replicas: 1
  apiKey: "dify123456"

plugin_connector:
  apiKey: "dify123456"
  customServiceAccount: "dify-plugin-build-sa"
  runnerServiceAccount: "dify-plugin-build-run-sa"
  imageRepoPrefix: "{account_id}.dkr.ecr.{region}.amazonaws.com/dify-ee"
  imageRepoType: ecr
  ecrRegion: "us-west-2"

​

Step 4: Add Plugin Daemon Database Configuration

externalPostgres:
  enabled: true
  address: "rds_address"
  port: "5432"
  credentials:
    plugin_daemon:
      database: "dify_plugin_daemon"
      username: "{user}"
      password: "{password}"
      sslmode: "disable"
    audit:
      database: "audit"
      username: "{user}"
      password: "{password}"
      sslmode: "disable"

​

Step 5: Upgrade Helm Release

helm upgrade -i dify -f values.yaml dify/dify

​

Step 6: Add S3 Permissions to the Custom ServiceAccount for the Application

kubesctl annotate serviceaccount -n {namespace} dify-plugin-connector-sa eks.amazonaws.com/role-arn={arn_of_IAM_S3}

​

Step 7: Restart the Dify Daemon Pod

kubectl delete pod {dify-plugin-daemon_name}

​

Notes

• ❌ Redis cluster mode is not supported
• 🌐 EKS nodes must have internet access or be behind a NAT gateway