Workspace

The Workspace in autobotAI offers a cloud-based automation platform powered by an AI engine, enabling users to build and deploy automation bots at scale. With the option to deploy the Workspace on AWS, you maintain control over the AWS account that hosts the Workspace, managing infrastructure, security, and scalability while focusing on automation workflows.

Typical Customer Deployment Overview

When you deploy autobotAI Workspace, the following AWS resources are automatically provisioned in your AWS account:

Compute Resources

• AWS Lambda Functions: Serverless execution engine for automation workflows and API operations
• Amazon ECS Cluster (Fargate): Containerized execution for long-running processes and complex integrations

Data Storage

• Amazon DynamoDB (1 table): Stores workflow metadata, execution history, and user configurations
• Amazon DocumentDB (2 collections): Stores bot definitions, integration configurations, and audit logs

Networking

• Amazon VPC: Private isolated network environment for all workspace resources
• Private Subnets: Host compute and database resources securely
• Public Subnets: Host Application Load Balancer and NAT Gateway
• Internet Gateway: Provides internet connectivity
• NAT Gateway: Enables outbound internet access from private subnets
• Elastic IP: Static IP address assigned to NAT Gateway
• Security Groups: Control inbound and outbound traffic for each service tier
• Network ACLs: Additional subnet-level security controls

API and Authentication

• Amazon API Gateway: RESTful API endpoint for all workspace operations
• Amazon Cognito User Pools: User authentication and authorization
• Amazon Cognito Identity Pools: Federated identity management for AWS service access

Security and Access Control

• IAM Roles: Lambda execution role, ECS task role, API Gateway execution role
• Custom IAM Policies: Least-privilege access policies for each service component

Monitoring and Logging

• Amazon CloudWatch Events: Scheduled automation triggers
• Amazon CloudWatch Logs: Centralized logging for all services
• Amazon CloudWatch Metrics: Performance monitoring and alerting

Architecture: Customer-hosted in your AWS account
Control: Full control over infrastructure, data, and configurations
Availability: Multi-AZ deployment for high availability within a single AWS region

Key Characteristics:

• All resources deployed in customer's AWS account as serverless application.
• Data residency maintained within selected AWS region
• Private VPC deployment with customer-managed networking
• Supports AWS regions: us-east-1, ap-south-1 (additional regions coming soon)
• Automatic failover across Availability Zones within the region
• Suitable for organizations requiring full infrastructure control and data sovereignty

Key AWS-Related Features of Workspace

1. Scalability: Workspace on AWS enables users to build scalable services that can adjust based on the size and complexity of automation workloads. Users can customize compute and networking configurations for tailored performance.

2. AWS Cognito Integration: Integrate with AWS Cognito to authenticate users via built-in accounts or Single Sign-On (SSO), ensuring secure and efficient user management for automation engineers.

3. AWS ECS & Lambda Integration: Workspace utilizes AWS ECS and AWS Lambda to run automation workflows, allowing users to leverage powerful serverless compute capabilities in a collaborative, low-code environment.

4. AWS API Gateway Integration: API Gateway connects the serverless components of Workspace with the frontend, providing AWS-native security and availability controls for seamless automation service interactions.

5. AWS DynamoDB & DocumentDB: Workspace uses NoSQL databases, such as DynamoDB and DocumentDB, to store metadata and bot-related data within a private VPC. This setup ensures data ownership and control, with data securely stored within your AWS environment.

6. Security and Compliance: Workspace on AWS includes role-based access control, encryption, and compliance with standards such as HIPAA and GDPR. Additionally, AWS security features, such as IAM and VPC, further secure automation workflows.

Resource Sizing and Scalability

Serverless Auto-Scaling

autobotAI leverages AWS serverless services to dynamically scale compute and storage resources, minimizing the need for manual capacity planning.

Default Configuration

• No manual intervention needed for typical usage.
• Workloads automatically sized for performance and cost.
• Enterprise customers may request reserved capacity for predictable workloads.

Custom Sizing (Enterprise)

For large-scale deployments, custom sizing options include:

• Reserved read/write capacity for DynamoDB
• Dedicated ECS cluster sizing and task limits
• DocumentDB instance type and cluster scaling
• Custom VPC CIDR ranges and subnet sizes

AWS Services Utilized by Workspace

• Lambda Functions
• ECS Cluster (Fargate-based)
• DynamoDB (1 instance)
• DocumentDB (2 tables)
• AWS VPC, Subnets, Elastic IP, and Internet Gateway
• API Gateway (for secure frontend connection)
• Cognito User Pools and Cognito Identity Pools
• IAM Roles and Custom Policies
• CloudWatch Events (for scheduled automation)
• CloudWatch Logs (for monitoring and logging)

Security Best Practices

Principle of Least Privilege

To minimize security risks, follow these least privilege best practices:

1. Initial Deployment Permissions

   • Customer can choose to update an IAM user permissions applied with default settings during initial deployment.
   • After deployment, remove AdministratorAccess and assign users the minimum permissions required for daily operations.

2. Service-Specific IAM Roles
   autobotAI automatically creates and attaches the following roles with narrowly scoped permissions:

   • Lambda Execution Role: Access only to specific DynamoDB tables and CloudWatch Logs
   • ECS Fargate Execution Role: Permissions to pull container images from ECR and log to CloudWatch
   • API Gateway Role: Permission to invoke designated Lambda functions

3. Custom IAM Policies

   • Review the auto-generated IAM policies in your AWS console.
   • Add inline comments or descriptions to each policy explaining its purpose.
   • Use AWS Managed Policies sparingly; prefer custom policies scoped to only necessary actions and resources.

4. Ongoing Access Review

   • Conduct quarterly IAM role and policy reviews in IAM Access Analyzer.
   • Revoke unused roles and policies.
   • Enable AWS CloudTrail to audit API calls for sensitive operations.

Encryption Keys – Purpose and Location

autobotAI uses AWS Key Management Service (KMS) keys to secure data at rest. The following keys are created:

Sensitive Data Storage and Encryption at rest

All customer data is stored within your AWS account in secure, private resources:

Encryption in Transit

Disk and Volume Encryption

Although autobotAI uses serverless services (Lambda, Fargate) with managed storage, any attached EBS volumes (if used for custom tasks) should be encrypted:

Network Configuration

autobotAI Workspace is deployed in a dedicated VPC with public and private subnets, employing security groups and network ACLs for layered security.

VPC and Subnets

• VPC CIDR Block: 10.0.0.0/16 (customizable for Enterprise customers)
• Public Subnets (2 AZs):
  • 10.0.1.0/24 in AZ A
  • 10.0.2.0/24 in AZ B
• Private Subnets (2 AZs):
  • 10.0.10.0/24 in AZ A
  • 10.0.20.0/24 in AZ B
• Database Subnets (2 AZs):
  • 10.0.30.0/24 in AZ A
  • 10.0.40.0/24 in AZ B

Internet Gateway and NAT Gateway

• Internet Gateway: Attached to the VPC for public subnet egress/ingress
• NAT Gateway: Deployed in each public subnet, with Elastic IPs for outbound internet access from private subnets

Route Tables

Security Groups

Network ACLs

• Public NACL: Allows inbound 80/443, all outbound
• Private NACL: Allows outbound 80/443, ephemeral port range 1024–65535 inbound
• Stateless Rules: Explicit DENY for all other traffic

Network ACLs

• Public NACL: Allows inbound 80/443, all outbound
• Private NACL: Allows outbound 80/443, ephemeral port range 1024–65535 inbound
• Stateless Rules: Explicit DENY for all other traffic

Costs and Billing Overview

Below is a list of AWS services used by autobotAI Workspace, with guidance on which are core (mandatory) and which are optional based on feature usage.

Software Upgrades and Patch Management

autobotAI operates on a fully serverless AWS infrastructure, leveraging AWS managed services for compute, storage, and networking. Consequently, manual system-level patching or hardening is not required.

Workspace Version Upgrades

• autobotAI releases new workspace versions periodically, containing backend code, runtime updates, container images, and database schema changes if necessary.
• Customers initiate workspace upgrades via the autobotAI portal, selecting the desired version.
• The upgrade process includes automated deployment of new AWS Lambda functions, ECS Fargate tasks, and database migrations.
• autobotAI manages version rollbacks and staged rollouts internally to ensure stability.

Workspace Health Monitoring

Workspace health can be effectively monitored through the following methods:

1. autobotAI Activity Notification

• The workspace provides an Activity Tab that tracks bot execution events, success/failure rates, and operational anomalies.
• Monitor workflow execution outcomes in near real-time to identify failed runs or workflow bottlenecks.
• Configurable alerting mechanisms allow email or webhook notifications on critical failure events.

2. AWS Native Logs and Metrics

• Amazon CloudWatch Logs capture detailed logs for Lambda functions, ECS tasks, and API Gateway.
• Key CloudWatch metrics include:
  • Lambda invocation count, duration, error rate
  • ECS CPU and memory utilization
  • DynamoDB read/write capacity and throttling
  • API Gateway request count, latency, and errors

Monitoring these metrics provides insight into the operational health of autobotAI components and identifies potential infrastructure or integration issues.