> ## Documentation Index > Fetch the complete documentation index at: https://docs.formal.ai/llms.txt > Use this file to discover all available pages before exploring further. # Deployment > Infrastructure and network requirements for deploying Connectors The Connector is available as a statically linked binary in a multi-architecture distroless Docker image. ### Container Image Registries You can pull Connector images from either of these registries: * AWS ECR: `654654333078.dkr.ecr..amazonaws.com/formalco-prod-connector:` Available regions: `us-east-1`, `us-west-1`, `us-west-2`, `ap-southeast-1`, and `eu-west-1`. * GCP Artifact Registry: `us-docker.pkg.dev/formal-public-assets/formalco-prod-connector/formalco-prod-connector:` ### Infrastructure Requirements * **Operating System**: Linux environment * **Architecture**: AMD64 or ARM64 * **Container Runtime**: Docker or compatible container runtime ### Network Requirements The Connector requires: * **Network access** to `api.joinformal.com` (Formal Control Plane) * **Outbound access** to your protected resources * **Inbound access** from clients on configured listener ports #### AWS VPC Private Link Connectivity For customers deploying on AWS, the Connector can connect to the Formal Control Plane using AWS VPC Private Link instead of traversing the public internet. This provides enhanced security and network isolation. **Service Details:** * **Service Name**: `com.amazonaws.vpce.eu-west-1.vpce-svc-01bfea09d5ec08d36` * **Region**: `eu-west-1` * **Endpoint Type**: Interface (services that use NLBs or GWLBs) **Setup Steps:** 1. **Create VPC Endpoint** Using AWS Console: * Navigate to **VPC** → **Endpoints** → **Create Endpoint** * Select **Other endpoint services** * Enter service name: `com.amazonaws.vpce.eu-west-1.vpce-svc-01bfea09d5ec08d36` * Click **Verify service** * Select your VPC and subnets where the Connector is deployed * Configure security groups to allow outbound HTTPS traffic (port 443) from the Connector * **Important**: Check **Enable Private DNS Name** * If your VPC is in a region other than `eu-west-1`, enable **Cross-region endpoint** and specify `eu-west-1` as the target region * Review and create the endpoint 2. **Configuration Requirements** * **Private DNS**: Must be enabled for proper DNS resolution of Control Plane endpoints * **Cross-region Support**: Required if your VPC is in any region other than `eu-west-1` * **Security Groups**: Must allow outbound HTTPS (port 443) from Connector to VPC endpoint * **Network ACLs**: Ensure subnet ACLs permit traffic to/from the VPC endpoint 3. **Verify Connectivity** Once the endpoint is in **Available** state, test from your Connector instance: ```bash theme={null} # Verify DNS resolves to private IP nslookup api.joinformal.com # Test HTTPS connectivity curl -v https://api.joinformal.com ``` The VPC endpoint uses Private DNS to automatically redirect `api.joinformal.com` traffic through the private connection. No configuration changes are needed on the Connector side. For cross-region deployments (regions other than `eu-west-1`), you must enable the cross-region endpoint feature and specify `eu-west-1` as the target region, or the connection will fail. ### Resource Requirements The Connector requires adequate resources to apply policies with minimal latency and maintain all necessary context in RAM (Control Plane data, queries metadata, responses data, log buffer, etc.). | Spec | Minimum | Recommended | | -------- | ------- | -------------------------- | | **CPU** | 1 core | 2 cores per node (2 nodes) | | **RAM** | 2 GB | 4 GB per node (2 nodes) | | **Disk** | 0 GB | 10 GB | **CPU Throttling Warning**: If you don't allocate entire CPU cores to the Connector and rely on CPU throttling (e.g., CFS quotas on Linux, CPU limits in Kubernetes), you will most likely experience increased latency and timeouts during peak loads. ### Production Recommendations For production deployments, we recommend: * **High Availability**: Run at least 2 nodes behind a load balancer * **Resource Allocation**: 2 CPU cores and 4 GB RAM per node * **Load Distribution**: Distribute traffic across multiple Connector instances * **Persistent Storage**: Mount a persistent volume to `/formal/logs` for the [log spool](/docs/guides/core-concepts/connectors/logs#logs-spool) CPU, RAM and disk requirements vary based on usage patterns, query types, traffic volume, and enforced policies. Monitor your Connector with a [telemetry collector](/docs/guides/core-concepts/connectors/health.mdx#metrics) and scale resources as needed. The Connector buffers up to 400 MB of logs in memory before [spooling to disk](/docs/guides/core-concepts/connectors/logs#logs-spool). A typical log entry is around 1 KB – at 100 requests per second, 10 GB of disk provides more than a day of outage buffer. The Connector works without disk (spooling is disabled), but logs may be lost during disruptions. When deploying multiple instances, Connectors attempt automatically to form a cluster with shared state. It enables Connectors to coordinate rate limiting across all instances. See the [Clustering](/docs/guides/core-concepts/connectors/clustering) page for details. ### Recommended Deployment Options Deploy as a Fargate service behind a Network Load Balancer with multi-AZ availability Deploy using [Formal Helm charts](https://github.com/formalco/helm-charts) on any Kubernetes cluster (EKS, GKE, AKS, on-premises). Run as a standalone container (development/testing only) See the [Quickstart guide](/docs/guides/getting-started/quickstart) for step-by-step deployment instructions. ## Environment Variables The Connector is configured primarily through the Control Plane, but requires the following environment variable: | Variable | Type | Description | | ------------------------------ | ---------- | --------------------------------------------------------------------------------------- | | `FORMAL_CONTROL_PLANE_API_KEY` | **String** | API token to authenticate with the Control Plane (obtained when creating the Connector) |