Skip to main content

Before you launch

Mitzu from AWS Marketplace runs entirely in your AWS account: a CloudFormation stack creates the network, database, cache, containers and sign-in. Nothing leaves your account except the calls you configure yourself, such as an AI provider.

Launching takes about 15 minutes once these are ready. You need permission to subscribe in AWS Marketplace and to create the stack's resources, including IAM roles; an administrator role covers both.

Prepare these before you open the launch page.

Pick a region and a host name​

  • Region: any region with ECS Fargate, RDS for PostgreSQL 17, ElastiCache and Cognito. Every other resource below must live in the same region.
  • Host name: the address people will open, for example mitzu.example.com.

Create the certificate​

Request a public certificate for the host name in AWS Certificate Manager, in the stack's region, and validate it with DNS. Wait until its status is Issued, then copy its ARN; the stack's CertificateArn parameter needs it.

DNS: Route 53 or your own​

  • If the domain is a Route 53 hosted zone in this account, note its ID. The stack creates the record for you.
  • Otherwise leave HostedZoneId empty and, after launch, point the host name at the LoadBalancerDnsName stack output with a CNAME.

Decide who can reach it​

AllowedIngressCidr limits who can open Mitzu. The default, 0.0.0.0/0, is the whole internet, with every user still signing in. A company network range keeps Mitzu internal, but then claude.ai and Claude Desktop connectors can't reach the MCP server (see AI and MCP).

Choose a network range​

The stack creates its own VPC. The default VpcCidr, 10.60.0.0/16, only matters if you plan to peer the VPC with others: pick a range that doesn't overlap them.

Optional: an email domain for invites​

Cognito sends invites from a shared address that allows 50 emails a day and is often filtered as spam. To send from your own domain, verify it in Amazon SES in the stack's region and request production access before you invite your team. See Invite your team and connect SSO. If you set this at launch while SES is still in the sandbox, verify AdminEmail in SES first, or your first sign-in email may not arrive. Otherwise, launch without it and add it later.

Cost​

At the default sizes the stack costs roughly 230 USD a month in us-east-1, mostly the NAT gateway, the load balancer, RDS (db.t4g.medium), ElastiCache and five small Fargate services. Data transfer and your Mitzu subscription come on top.