Deploy in your own AWS account¶

Deploy Caution enclaves in your own AWS infrastructure while Caution handles the build and deployment orchestration.

What is bring your own cloud?¶

Bring your own cloud (BYOC) lets you run confidential enclaves in your own AWS account. A one-time setup script creates isolated AWS infrastructure and a role that can only interact with resources tagged for Caution, then Caution manages deployments within that environment. For full details, see the bring your own cloud reference.

What you need¶

Before you begin, ensure you have the following:

AWS credentials should use a least-privilege IAM role when possible. Admin credentials can be used as an alternative. See bring-your-own-cloud-setup for guidance.

Install the CLI¶

Follow the installation instructions in the CLI README.

Create an account¶

To create an account, you'll need a valid access code and a passkey. You can register in the browser or with the CLI.

If you do not have an access code, request one at info@caution.co.

caution register --alpha-code <your_code>

Add an SSH key¶

Add an SSH key so you can authenticate your Caution deployments:

caution ssh-keys add --from-agent

Select an application¶

Deploy your own containerized application, or start with one of the Caution demo apps. For this guide, use hello-world-enclave:

git clone https://codeberg.org/caution/demo-hello-world-enclave.git
cd demo-hello-world-enclave

Set up your AWS environment¶

Choose how you want to provision the AWS environment for bring your own cloud deployments. Both paths continue through the Caution CLI for app registration, Git-based deployment, and verification.

CLI-guided provisioning (recommended)¶

Use this path if you want Caution to provision AWS infrastructure and register deployment credentials automatically.

From your application directory, run:

caution init --byoc

This command detects your AWS credentials, provisions the required AWS infrastructure, creates your app on Caution, and registers the deployment credentials automatically.

Manual provisioning¶

Use this path if you want more control over the AWS infrastructure setup before registering the deployment configuration with Caution.

From a working directory, run:

git clone https://codeberg.org/caution/bring-your-own-cloud-setup.git
cd bring-your-own-cloud-setup

cp .env.example .env
# Edit .env with your AWS credentials

docker build -t caution-provisioner-setup .

docker run --rm \
  --env-file .env \
  -v "$(pwd)/out:/out" \
  caution-provisioner-setup

This provisions the required AWS infrastructure and writes credentials.json.gpg to the out/ directory.

To use the generated encrypted credentials, return to your application directory and run:

caution init --byoc --config /path/to/credentials.json.gpg

What the setup creates¶

The setup flow creates an isolated environment for running enclaves in your AWS account:

Deploy the application¶

From your application directory, push the code to Caution:

git push caution main

Caution builds a reproducible enclave image and deploys it into the AWS environment you provisioned.

Verify the deployment¶

From your application directory, run the following command to rebuild the image, compare hashes, and confirm exactly what the enclave is running:

caution verify

Cleanup¶

To tear down a BYOC deployment from the CLI, run:

caution teardown --byoc

Run this from your application directory (or ensure local BYOC state exists in ~/.caution/<app>/bring-your-own-cloud.json) and make sure your AWS credentials are available.

If you need manual cleanup details, see the cleanup instructions in the BYOC repo.

Next steps¶

Your application is now running in a verified enclave in your own AWS account. Here's what to explore next: