Self-hosted overview
Run Tracemill in your own AWS account from one CloudFormation template.
Self-hosted Tracemill runs the same console, API and delivery engine as Tracemill Cloud, but in your AWS account. One CloudFormation stack creates everything. You own the account, the data and the sign-in path, and you decide when a new release goes in.
What runs in your account
- One ECS Fargate service running the Tracemill server: console, API, delivery and detection content. One task by default.
- An Application Load Balancer for your console hostname, internet-facing or internal, with an optional AWS WAF rate-limiting web ACL.
- RDS for PostgreSQL 17, created by the stack or an existing instance you provide.
- A Cognito user pool that only federates to your identity provider (SAML or OpenID Connect). It holds no passwords and allows no self sign-up.
- An emergency-access IAM role for signing in when your identity provider can't.
- The upgrade machinery: Lambda functions, a Step Functions state machine and EventBridge rules that run each release change, snapshot the database before a migration, alert you when a release fails to start, and expire old snapshots.
- Secrets Manager secrets for database roles and encryption keys, a KMS key for the database, an S3 workspace bucket, CloudWatch log groups and an SNS topic for stack notices.
The stack can also create the VPC (two public and two private subnets, one NAT gateway, an S3 gateway endpoint). Security review lists every resource, IAM role and outbound connection.
What leaves your account
Run results, generated telemetry, the detections you exercise, user identities and database contents stay in your account. The deployment connects out to Tracemill only to fetch releases and detection content, and sends error reports to Tracemill only if you turn them on. The details are in Security review.
Supported Regions
us-east-1 and us-west-2. The template refuses to launch anywhere else.
In this section
- Launch: prerequisites and the first launch
- Parameters: every stack parameter and output
- DNS: point your console hostname at the stack
- Single sign-on: connect your SAML or OIDC provider
- Emergency access: sign in without your identity provider
- Updates: content updates, release updates and auto-apply
- Restore: go back to the snapshot taken before a migration
- Teardown: delete the stack and everything it leaves behind
- Security review: what's deployed, what it can do, and what connects out