Scenario Index

Find your scenario by matching your configuration to a row in the table below. Each row links to the example config file and step-by-step deployment guide.

Get the Example Config Files

Before you start, extract the example configuration files from the Docker image to your local ml/configs/ directory:

# Create your working directory structure
mkdir -p ml/configs ml/templates ml/policies ml/reports

# Extract example configs for your tier (replace :enterprise with :starter or :professional)
docker run --rm \
  -v $(pwd)/ml/configs:/app/configs \
  --entrypoint cp \
  ml-provisioner:enterprise-1.0.1 \
  -r /app/examples/configs/. /app/configs/

Then open the extracted YAML files, replace the placeholder values with your own (company_prefix, account_id, tenant_id, region, etc.), and use the tables below to find the right config file for your scenario.

The config filename encodes all discriminators:

{company}-{env}-{tenant}-{region}-{use_case}-ml-{sc}-{vpc_mode}-{vpc_source}[-rtb][-workload].yaml

---

Starter Tier

Image: ml-provisioner:starter-1.0.1 — No VPC required.

Source Control	Workload	Config file suffix	Example Guide
codecommit	no	-codecommit.yaml	Starter — codecommit
codecommit	yes	-codecommit-workload.yaml	Starter — codecommit + workload
s3	no	-s3.yaml	Starter — s3
s3	yes	-s3-workload.yaml	Starter — s3 + workload

Run commands: Starter Run Commands

---

Professional Tier

Image: ml-provisioner:professional-1.0.1 — No VPC required.

Source Control	Workload	Config file suffix	Example Guide
codecommit	no	-codecommit.yaml	Professional — codecommit
codecommit	yes	-codecommit-workload.yaml	Professional — codecommit + workload
s3	no	-s3.yaml	Professional — s3
s3	yes	-s3-workload.yaml	Professional — s3 + workload

Run commands: Professional Run Commands

---

Enterprise Tier

Image: ml-provisioner:enterprise-1.0.1 — VPC must exist before deployment.

Source Control	VPC Mode	VPC Source	RTB	Workload	Config file suffix	Example Guide
codecommit	sgprov	ssm	—	no	-codecommit-sgprov-ssm.yaml	Enterprise — codecommit + sgprov + ssm
codecommit	sgprov	direct	—	no	-codecommit-sgprov-direct.yaml	Enterprise — codecommit + sgprov + direct
codecommit	standalone	ssm	—	no	-codecommit-standalone-ssm.yaml	Enterprise — codecommit + standalone + ssm
codecommit	standalone	ssm	—	yes	-codecommit-standalone-ssm-workload.yaml	Enterprise — codecommit + standalone + ssm + workload
codecommit	standalone	direct	no	no	-codecommit-standalone-direct.yaml	Enterprise — codecommit + standalone + direct
codecommit	standalone	direct	yes	no	-codecommit-standalone-direct-rtb.yaml	Enterprise — codecommit + standalone + direct + rtb
s3	sgprov	ssm	—	no	-s3-sgprov-ssm.yaml	Enterprise — s3 + sgprov + ssm
s3	sgprov	direct	—	no	-s3-sgprov-direct.yaml	Enterprise — s3 + sgprov + direct
s3	standalone	ssm	—	no	-s3-standalone-ssm.yaml	Enterprise — s3 + standalone + ssm
s3	standalone	ssm	—	yes	-s3-standalone-ssm-workload.yaml	Enterprise — s3 + standalone + ssm + workload
s3	standalone	direct	no	no	-s3-standalone-direct.yaml	Enterprise — s3 + standalone + direct
s3	standalone	direct	yes	no	-s3-standalone-direct-rtb.yaml	Enterprise — s3 + standalone + direct + rtb

Run commands: Enterprise Standalone Run Commands | Enterprise SG Provisioner Run Commands

RTB: route table IDs — only relevant for vpc_source: direct. Set to yes if you want the S3 Gateway VPC endpoint route associations configured automatically at deploy time.

VPC Mode sgprov: SG Provisioner must be deployed and its security group ID available in SSM before deploying the ML Provisioner.

Workload + RTB: not a supported combination. Use workload variant only with vpc_source: ssm.