Architecture Reference
Cloud Services
Networking
SGP is deployed into a VPC spanning three Availability Zones with separate public and private subnets. All application workloads run in private subnets. Outbound internet access is provided by a NAT Gateway.Ingress
The load balancer can be configured as internal (private subnet only) for deployments that require no direct internet exposure.
Service Mesh
Istio is deployed as a cluster add-on and manages all east-west traffic between SGP services. An internal Istio ingress gateway handles traffic routing within the cluster.EKS Cluster Default Configuration
Node Groups
Cluster Add-ons
Aurora PostgreSQL Default Configuration
DocumentDB Default Configuration
Customer Sensitive Data
Sensitive data may be stored in the following services, all data is encrypted at rest and in transit:- Aurora PostgreSQL: For storing metadata, persistent data, and service-specific databases (SGP API Backend, Identity Service, LLM Engine, SpiceDB, Agents Service, SGP Train, and Temporal)
- DocumentDB: For storing Agentex agent data/workflows and Workflows document processing state
- S3 Buckets: For storing large data objects and datasets
- OpenSearch: For managing text embeddings and vector search capabilities