# Requirements

Source: https://docs.coderhelm.com/self-host/requirements

What you need before installing CoderHelm in your AWS account.

{/* Imported from CoderHelm/coderhelm-platform/docs/self-host/requirements.md at 96a2a3bafd5e. Edit it there. */}
## On your machine [#on-your-machine]

| Tool | Version | Why |
|---|---|---|
| Node.js | 20 or newer | Runs the installer and the CDK app |
| AWS CLI | v2 | Credentials, secrets and checks |
| tar | any | Unpacks the release |
| A browser | any | One click to create the GitHub App |
| GitHub CLI (`gh`) | optional | Checks the release's build provenance |

You do not need Rust, Docker or the CDK CLI: the release ships built code, and the installer runs CDK with `npx`.

## In AWS [#in-aws]

- **An account you can administer.** CDK bootstrap and the first deploy create IAM roles, so use administrator credentials (an SSO admin role is fine). Later deploys can use a narrower role.
- **A region with Lambda on ARM64, Cognito, SES and Bedrock** (if you use Bedrock). All commercial regions with Bedrock work.
- **Service quotas:** the defaults are enough. The worker uses up to 10 concurrent Lambda executions for tickets and 5 each for CI fixes and feedback.
- **SES production access** to email people outside your verified addresses. New accounts start in the SES sandbox. See [Email](./email.md).
- **Bedrock model access** for the Claude models you use, if you choose Bedrock. See [Model providers](./model-providers.md).

## On GitHub [#on-github]

- An account or organization where you can create GitHub Apps (organization owners, or members with the GitHub App manager role).
- github.com. GitHub Enterprise Server can't create apps from a manifest; create the app by hand and pass its values to `github-app` (see [The GitHub App](./github-app.md#github-enterprise-server)). CoderHelm itself calls `api.github.com`, so Enterprise Server is not supported yet.

## Optional [#optional]

- **A domain** in a Route 53 public hosted zone, so certificates and DNS records are created for you. A domain elsewhere works with an ACM certificate you create. See [Domains](./domains.md).
- **Google sign-in** needs a domain and a Google OAuth client.

## What it costs [#what-it-costs]

You pay AWS directly. A small team's install is mostly idle serverless: Lambda, DynamoDB on demand, SQS and CloudFront cost little at rest. The larger items are:

- **Model calls:** to Anthropic with your teams' keys, or Bedrock on your AWS bill.
- **CodeBuild** for the build sandbox (MEDIUM instances, by the minute), when a run checks a repo's build.
- **KMS keys:** four customer managed keys, about $1 a month each.
- **CloudWatch Logs** kept for a month.