Cloud account setup

AWSBee launches deployments with an access key that you create and scope. The policy below allows only what a GPU inference stack needs.

1. Create a scoped IAM user

Save the policy as bee-policy.json, then run the commands below (or create the user in the IAM console and attach it as an inline policy).

bee-policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "BeeStacks",
      "Effect": "Allow",
      "Action": [
        "cloudformation:CreateStack",
        "cloudformation:DeleteStack",
        "cloudformation:DescribeStacks",
        "cloudformation:DescribeStackEvents",
        "cloudformation:DescribeStackResources",
        "cloudformation:GetTemplate"
      ],
      "Resource": "arn:aws:cloudformation:*:*:stack/bee-*/*"
    },
    {
      "Sid": "BeeValidate",
      "Effect": "Allow",
      "Action": [
        "cloudformation:ValidateTemplate"
      ],
      "Resource": "*"
    },
    {
      "Sid": "BeeCompute",
      "Effect": "Allow",
      "Action": [
        "ec2:RunInstances",
        "ec2:StartInstances",
        "ec2:StopInstances",
        "ec2:TerminateInstances",
        "ec2:CreateLaunchTemplate",
        "ec2:CreateLaunchTemplateVersion",
        "ec2:DeleteLaunchTemplate",
        "ec2:CreateSecurityGroup",
        "ec2:DeleteSecurityGroup",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:RevokeSecurityGroupIngress",
        "ec2:CreateTags",
        "ec2:Describe*"
      ],
      "Resource": "*"
    },
    {
      "Sid": "BeeGpuAmi",
      "Effect": "Allow",
      "Action": [
        "ssm:GetParameter",
        "ssm:GetParameters"
      ],
      "Resource": "arn:aws:ssm:*::parameter/aws/service/deeplearning/*"
    },
    {
      "Sid": "BeeQuotas",
      "Effect": "Allow",
      "Action": [
        "servicequotas:GetServiceQuota"
      ],
      "Resource": "*"
    }
  ]
}

shell

aws iam create-user --user-name bee-deployer
aws iam put-user-policy --user-name bee-deployer \
  --policy-name BeeDeployer --policy-document file://bee-policy.json
aws iam create-access-key --user-name bee-deployer

Paste the access key ID and secret into Console → Cloud account and pick a default region. AWSBee verifies the key with sts:GetCallerIdentity and reads your GPU quotas.

2. Check GPU quotas

New accounts often have a quota of 0 vCPUs for GPU instances. AWSBee shows two quotas per region: Running On-Demand G and VT instances (g4dn, g5, g6, g6e) and Running On-Demand P instances (p4d, p5). Quotas count vCPUs: a g6.xlarge needs 4, a g6e.12xlarge needs 48. Request an increase in the Service Quotas console if needed.

3. Add model tokens

Hugging Face token (read scope) for gated models. Accept each model's license on its Hugging Face page first.
NVIDIA NGC API key for NIM deployments, from your NGC account.

What a stack contains

Image	Resolved at launch from the public parameter `/aws/service/deeplearning/ami/x86_64/base-oss-nvidia-driver-gpu-ubuntu-22.04/latest/ami-id` (NVIDIA driver, Docker, NVIDIA Container Toolkit).
Server	`vllm/vllm-openai:v0.32.0`, or the model's NVIDIA NIM container.
Network	Security group allowing TCP 8000 from the AWSBee gateway (`54.93.71.63/32`) and an optional CIDR you set. No SSH.
Storage	200 GiB encrypted gp3 root volume for weights and cache, deleted with the stack.
Logs	Bootstrap output in `/var/log/bee-bootstrap.log`; server logs via `docker logs bee-model` (use SSM Session Manager if you attach a role).