Install Patient Journey Intelligence from AWS Marketplace

This guide deploys the Patient Journey Intelligence container product from AWS Marketplace to Amazon EKS using the release-supplied interactive installer. Follow the installation steps in order, then configure HTTPS, verify login and metering, and review the operating and removal instructions.

Quick help · AWS Marketplace listing · Support: support@johnsnowlabs.com

What the installer provisions

The installer runs on your administration machine and provisions resources in your AWS account. It can create a new EKS cluster or connect to an existing one.

Resource	Purpose
EKS cluster and managed node group	Kubernetes runtime for application workloads.
IAM OIDC provider	IAM Roles for Service Accounts (IRSA).
EFS filesystem, security group, and mount targets	Shared document and pipeline storage.
EBS and EFS CSI drivers	Persistent-volume provisioning and mounting.
pj-app-efs / pj-app-gp3 StorageClasses	EFS / gp3 storage, both with Retain reclaim policy.
nginx ingress controller and LoadBalancer Service	External application access.
ECK operator	Elasticsearch and Kibana management.
Scheduler IAM role and policy	AWS Marketplace usage metering.
Helm release pj-app	Application workloads, Secrets, and persistent-volume claims.

Existing resources may be reused; review the limitations below before installing on a shared cluster. AWS infrastructure charges are separate from your product subscription.

Before you begin

Subscription and release bundle

• Subscribe to the Patient Journey Intelligence container product and note the exact published Helm chart tag from its fulfillment instructions. The application version and chart tag need not match; do not guess a release suffix.
• Obtain the release-supplied marketplace-installer.sh and matching pj-app-updater.sh. The installer requires a build-injected SPARK_NLP_SECRET; older bundles can read it from the matching updater beside the installer. Repository templates contain unresolved tokens and cannot install by themselves. This token is release configuration, not a customer license to enter.
• Obtain the listing's AWS Marketplace product code from the fulfillment instructions, release owner, or Support before starting. The script refers to the seller's Marketplace Management Portal; subscribers without portal access should ask Support. A prodview-... listing ID is not the product code.

Required tools and connectivity

• Use a Linux host with an interactive terminal, Bash 4+, AWS CLI v2, kubectl, Helm 3.10+ in the Helm 3 series, eksctl, jq, OpenSSL, and standard GNU tools (tar, sed, awk, sort, find, tr, mktemp, etc.). The script checks only Helm 3.7.1, but its product-code configuration uses --set-json, requiring 3.10+.
• Allow access to AWS APIs, the Kubernetes API, Marketplace ECR, and the nginx/Elastic Helm repositories; worker nodes also need image-registry access. Metering uses the JSL license usage endpoint at https://license.johnsnowlabs.com. Use x86-64 (amd64) nodes for the Marketplace image set.

Tool	Installation reference
AWS CLI v2	AWS CLI installation
kubectl	kubectl installation; use a version compatible with the cluster
Helm 3.10+	Helm installation
eksctl	eksctl installation; use a release supporting your chosen EKS version
Bash, jq, OpenSSL, GNU utilities	Your Linux distribution's packages

Verify tools:

aws --version
kubectl version --client
helm version --short
eksctl version
jq --version
openssl version

Configure AWS credentials

Authenticate with an attached IAM role, aws configure, temporary AWS environment credentials, or IAM Identity Center:

aws configure sso
aws sso login --profile <profile>
export AWS_PROFILE=<profile>

Run aws sts get-caller-identity and confirm the account. The installer uses these credentials locally; it does not copy them into Kubernetes.

IAM permissions

Use the eksctl IAM policy baseline for EKS, CloudFormation, EC2, IAM/OIDC, node groups, and add-ons. It includes AmazonEC2FullAccess, AWSCloudFormationFullAccess, and custom EKS/IAM policies. Scope permissions to your account and cluster; organization policies and permission boundaries may require adjustments.

Additional installer access:

Resource	Required access
EFS	Create/describe/tag filesystems and create/describe mount targets; delete permissions for cleanup.
EC2 networking	Discover VPCs/subnets/security groups; create/tag the EFS security group and allow NFS.
Resource discovery	tag:GetResources for EFS lookup; sts:GetCallerIdentity for identity verification.
Marketplace ECR	ecr:GetAuthorizationToken on *; ecr:BatchCheckLayerAvailability, ecr:BatchGetImage, and ecr:GetDownloadUrlForLayer on arn:aws:ecr:us-east-1:709825985650:repository/john-snow-labs/pj-app*. Worker-node roles also need image-pull access.
Scheduler IAM resources	iam:GetPolicy, iam:CreatePolicy, iam:GetRole, iam:CreateRole, iam:UpdateAssumeRolePolicy, and iam:AttachRolePolicy for policy pj-app-marketplace-metering and role pj-app-airflow-scheduler-metering. The baseline's eksctl-* resource scope does not cover these names.
Kubernetes	Manage namespaces, CRDs, ClusterRoles/bindings, StorageClasses, service accounts, Secrets, workloads, PVCs, and LoadBalancer Services.

The Airflow scheduler's metering permission (aws-marketplace:MeterUsage) is created automatically during installation. The current metering implementation does not require a separate Marketplace role on pj-app-api or License Manager permissions. The IAM action prefix for tag discovery is tag, although its CLI command is aws resourcegroupstaggingapi.

New clusters

Installer defaults/options (not a capacity guarantee):

Setting	Value
Region / cluster / namespace	us-east-1 / pji / pji; region environment variables override the region default.
Kubernetes	Choose 1.33, 1.34, or 1.35 (default).
Nodes	Two by default; t3.2xlarge, m5.2xlarge, g4dn.xlarge, or custom instance type.
Node storage	200 GiB gp3 per node.
Network	VPC in <region>a and <region>b; nodes in <region>a, public networking, no NAT gateway; EKS Auto Mode disabled.

Size capacity for the complete stack, including individual pod requests, and check EC2 quotas, zone availability, and EKS version availability. Selecting a GPU instance does not add GPU images or services absent from the Marketplace release. Installation time depends on cluster creation, image downloads, storage, and workload readiness; the script's estimate is not a readiness guarantee. AWS infrastructure charges are separate from the product subscription.

Existing clusters

Confirm capacity, Kubernetes access, OIDC, and compatibility with platform-managed components before running:

• Storage setup is skipped when pj-app-efs and pj-app-gp3 exist; their configuration and driver health are not validated. A legacy pji-efs also triggers the skip, but the application still requires pj-app-efs.
• If storage setup runs, it attempts to create the EBS CSI add-on; an existing add-on can cause failure. Reconcile partial storage installations before retrying.
• The installer reuses the first detected nginx controller Service. It expects ingress class nginx and an accessible LoadBalancer address.
• ECK installation is skipped when both Elasticsearch and Kibana CRDs exist. Confirm a compatible operator is running; resolve partial/conflicting CRDs before installation.
• The scheduler role name, pj-app-airflow-scheduler-metering, is account-wide and fixed. Installation updates its trust policy for the selected cluster and namespace; coordinate multiple deployments so one installation does not replace another's trust.
• If storage setup runs, pj-app-gp3 becomes a cluster default. Review other default StorageClasses on a shared cluster.

The installer uses community ingress-nginx, whose maintenance ended in March 2026. Review the Kubernetes retirement guidance with your administrator and obtain a release-compatible ingress plan from Support before a new production deployment.

Installation

Step 1: Start the installer

Use a dedicated directory: the script replaces ./awsmp-chart/ and writes ./credentials.txt.

chmod 700 marketplace-installer.sh
./marketplace-installer.sh --product-code "<listing-product-code>" --time

Replace the product-code placeholder first, or omit --product-code to enter it interactively. Follow the prompts:

Step 2: Confirm the AWS identity and region

Confirm the account ID and ARN displayed by the installer. Select the deployment region; Marketplace ECR authentication later still uses us-east-1.

Step 3: Create or connect an EKS cluster and namespace

Choose Create a new EKS cluster or Use an existing EKS cluster. For a new cluster, enter the name, instance type, node count, and Kubernetes version, then review the summary before confirming creation. For an existing cluster, enter its name and verify the listed nodes.

The installer updates kubeconfig and associates the IAM OIDC provider. Select the application namespace (default pji); it is created or reused and becomes the current kubectl context's default namespace.

Step 4: Set up EFS and CSI storage

Let storage setup run unless skipped as described above. It creates/reuses encrypted EFS, mount targets, an NFS TCP/2049 security-group rule from the VPC CIDR, CSI drivers, and Retain StorageClasses. pj-app-gp3 is marked as a cluster default.

Step 5: Pull the Marketplace Helm chart

Enter the published chart version. Helm authenticates to 709825985650.dkr.ecr.us-east-1.amazonaws.com in us-east-1, regardless of cluster region, and extracts the chart to ./awsmp-chart/pj-app/.

Step 6: Configure ingress and the base URL

Enter the final base URL (origin only, no path), or leave it blank for http://<LoadBalancer-address>. Approve nginx installation if missing; address detection waits up to 10 minutes.

Step 7: Provision the scheduler metering role

The script creates a least-privilege IAM role scoped to the Airflow scheduler's service account only (pj-app-airflow-scheduler), with aws-marketplace:MeterUsage. This is the only permission the metering DAG needs, because the DAG runs only in the scheduler pod. This step needs no input; it associates an OIDC provider with the cluster if one isn't already present.

Step 8: Supply the Marketplace product code

If you did not supply it with --product-code, enter the listing's product code. The code is required, and blank input is rejected. The metering DAG needs an explicit code for this container deployment; do not rely on an AMI product code being present on your own EKS nodes.

Step 9: Install Patient Journey Intelligence and save credentials

The script installs ECK 3.4.0 if required, generates service/admin secrets and encryption keys, and installs Helm release pj-app with a 60-minute timeout, including the scheduler's IAM role ARN and the product code. It saves the admin password after successful Helm installation.

Installer options and included services

--modes registry,deid,curation,journey selects product modes (omitted means all). It does not supply services or images absent from the release. --enable-naaccr-services enables Edits60 API and NAACCR XML Service only when the release includes their image artifacts. --product-code CODE supplies the required code; --time reports elapsed time; --help lists options. NLP Station, Custom NLP, Resolver, and Kibana are enabled; Data Curation services are disabled. Agentic Search, Agentic De-identification, and Patient Registry services are unavailable in the current Marketplace image set.

--dry-run skips provision/install commands but still performs live checks and prompts, replaces the local chart directory, and may fail because no chart was downloaded. If reached, credential saving still writes a file. It is not an offline or side-effect-free preview.

Do not run concurrent installers or rerun against an existing pj-app release. Helm installation does not use --wait; follow After installation to verify readiness.

Verify the Marketplace runtime role

The installer creates or reuses the scheduler's pj-app-airflow-scheduler-metering IAM role with policy pj-app-marketplace-metering, granting only aws-marketplace:MeterUsage. Its OIDC trust is scoped to system:serviceaccount:<namespace>:pj-app-airflow-scheduler. Helm attaches the role ARN; no manual API Marketplace IAM attachment is needed.

Set these variables for this and subsequent commands:

export CLUSTER_NAME="<cluster-name>"
export REGION="<aws-region>"
export NAMESPACE="<namespace>"
export CHART_DIR="./awsmp-chart/pj-app"

kubectl config current-context
kubectl get serviceaccount pj-app-airflow-scheduler -n "$NAMESPACE" \
  -o jsonpath='{.metadata.annotations.eks\.amazonaws\.com/role-arn}{"\n"}'

The last command must return the scheduler's IAM role ARN. IRSA (IAM Roles for Service Accounts) supplies temporary pod credentials; do not put static AWS keys in Kubernetes. IRSA uses projected service-account tokens and does not require disabling IMDSv2. Metering separately attempts EC2 metadata access for region discovery; if metadata is unavailable to pods, verify runtime AWS region configuration and metering logs while preserving your cluster's metadata security policy.

Application URL and HTTPS

An https:// base URL does not configure TLS

Entering an https:// URL does not configure TLS. The installer disables chart-managed cert-manager integration. Configure DNS and TLS before sensitive or production use.

Find the ingress controller's namespace, Service name, and external address:

kubectl get svc -A \
  -l app.kubernetes.io/name=ingress-nginx,app.kubernetes.io/component=controller

A newly installed controller is ingress-nginx/ingress-nginx-controller; a reused one may differ.

Fix a pending or changed HTTP origin

If address detection timed out, the chart uses http://pending. Wait for a non-empty LoadBalancer address, then set it below. Use the downloaded chart from this installation to preserve the version.

export PJI_HOST="<LoadBalancer-hostname>"
helm upgrade pj-app "$CHART_DIR" -n "$NAMESPACE" --reuse-values \
  --set-string "global.baseUrl=http://${PJI_HOST}" \
  --set-string "ingress.hostname=${PJI_HOST}" \
  --set ingress.noHost=false --timeout 60m

HTTPS with existing cert-manager

Point your DNS hostname at the LoadBalancer and have your platform administrator provide cert-manager and a ready ClusterIssuer. Then run:

export PJI_HOST="pji.example.com"
export CLUSTER_ISSUER="<cluster-issuer-name>"
helm upgrade pj-app "$CHART_DIR" -n "$NAMESPACE" --reuse-values \
  --set-string "global.baseUrl=https://${PJI_HOST}" \
  --set-string "ingress.hostname=${PJI_HOST}" \
  --set ingress.noHost=false --set certManager.enabled=true \
  --set-string "certManager.clusterIssuer.name=${CLUSTER_ISSUER}" \
  --timeout 60m
kubectl get certificate,ingress -n "$NAMESPACE"
curl -I "https://${PJI_HOST}"

This enables ingress certificate configuration; it does not install cert-manager or create an issuer. Alternatively, use your organization's TLS gateway and keep the public origin, global.baseUrl, ingress hostname, and Keycloak configuration consistent. Recheck login after URL changes; credentials.txt retains the original URL.

After installation

helm status pj-app -n "$NAMESPACE"
kubectl get pods,pvc,ingress -n "$NAMESPACE"
kubectl get deployments,statefulsets,jobs -n "$NAMESPACE"
kubectl get storageclass pj-app-efs pj-app-gp3

Require Helm status deployed, active pods Running/Ready, PVCs Bound, and an external ingress address. Completed jobs are normal. Verify the scheduler's role annotation, then open the base URL and sign in as admin using ./credentials.txt. Complete onboarding and confirm the authenticated application loads.

Monitor application health and metering

Repeat these checks after maintenance. In Airflow, verify the marketplace_metering DAG is enabled and inspect its hourly send_aws_metering_data task logs for successful reports and failed/pending usage. A Running scheduler or deployed Helm release alone does not prove billing reports were accepted.

Sensitive information and handling

• Credentials: credentials.txt is mode 600; it contains the application admin password, also used initially by the Keycloak administrator (user). Vault it, verify access, then delete the local file. Restrict Kubernetes Secrets, Helm release data, the licensed installer bundle, and logs; never share decoded secrets or patient data.
• Seeded users: the chart also creates demo and john with default passwords. Secure or disable these accounts in Keycloak before production and coordinate Helm user configuration so later upgrades do not restore defaults.

Credential and key rotation

Manage user passwords in Keycloak. Coordinate privileged, database, OAuth, service, and encryption-key changes through a backed-up Helm maintenance procedure and workload restarts; changing a Secret alone may break stateful services. Ask Support for the release-specific sequence. EKS rotates IRSA tokens; rotate TLS through the configured certificate manager/provider.

Data encryption

• EFS: newly created filesystems are encrypted at rest; the installer supplies no custom KMS key. Verify reused filesystems. The EFS CSI driver enables mount encryption in transit by default; verify the installed driver's effective settings.
• EBS: the gp3 class/node configuration does not force encryption. Enable EBS encryption by default in the target region before provisioning if required; this does not encrypt existing volumes.
• Kubernetes API: EKS 1.28+ provides default envelope encryption. The installer does not configure a customer-managed KMS key. The control-plane connection uses TLS; application ingress defaults to HTTP.
• Internal connections: the installer does not configure TLS for every service-to-service connection; review your deployment's network controls.
• Network: review the public-node topology and VPC-wide NFS rule. The installer also enables PostgreSQL host port 5432; restrict node access accordingly.

How the application accesses AWS

Runtime AWS access uses the scheduler's IRSA role and temporary credentials, CSI drivers' configured IAM identities, and worker-node roles for image pulls. The hourly marketplace_metering DAG runs with Airflow's LocalExecutor in the scheduler; the API does not need a separate Marketplace role. Static AWS keys are not required in application Secrets. Customer-configured AWS integrations can require separate permissions and credentials.

Troubleshooting and support

Symptom	Check
AWS authentication fails	aws sts get-caller-identity, aws configure list; refresh the intended profile/session.
Cluster creation fails	eksctl/CloudFormation events, IAM permissions, EC2 quotas, zones, and Kubernetes version availability.
Chart access denied / ImagePullBackOff	Active subscription, exact published version, ECR permissions and network access for the installing identity/nodes. Registry login uses us-east-1. Inspect kubectl describe pod <pod> -n "$NAMESPACE".
jq missing / unknown Helm flag	Install jq and use Helm 3.10+; the installer's older minimum-version check is insufficient.
Pods try to pull registry.johnsnowlabs.com/pj-app/*:v1	The installed chart rendered normal source defaults. Check its tag with helm list -n "$NAMESPACE" and obtain the correct Marketplace revision. Preserve user values privately and follow Support's release-specific recovery procedure; do not add a source-registry pull secret or rerun helm install.
Missing build-injected secret	Use the installer and updater from the same release bundle. If neither contains the injected value, obtain a corrected bundle; do not substitute an arbitrary value or a customer license.
PVC Pending / storage setup fails	kubectl describe pvc -n "$NAMESPACE"; CSI pods in kube-system, StorageClasses, EFS mount targets/NFS access, capacity, and the existing-cluster limitations above.
LoadBalancer Pending	kubectl describe svc <service> -n <ingress-namespace>; service events, subnet tags/routing, and AWS permissions.
ECK conflict	Reconcile operator ownership and both required CRDs before retrying.
Missing scheduler IRSA annotation	Check cluster/namespace, OIDC trust, and the stored Helm scheduler annotation. Have your administrator repair the role and Helm values, then restart the scheduler. Do not rerun the first-install script or source it to call an internal function.
Metering fails or has no product code	Check Airflow task logs, listing product code, scheduler IRSA policy/trust, runtime AWS region, AWS API connectivity, and JSL license usage connectivity.
Wrong URL / redirects	Follow Application URL and HTTPS; verify DNS, TLS, and public origin.

Collect status and events:

aws eks describe-cluster --name "$CLUSTER_NAME" --region "$REGION" \
  --query 'cluster.{name:name,status:status,version:version}'
helm status pj-app -n "$NAMESPACE"
kubectl get pods,pvc,ingress -n "$NAMESPACE"
kubectl get events -n "$NAMESPACE" --sort-by=.lastTimestamp

Send support@johnsnowlabs.com the failing step/error, region, cluster, namespace, chart/Kubernetes/Helm versions, and sanitized output. Exclude credentials, patient data, and licensed-service configuration.

Upgrading

Do not rerun the first-install script. Back up persistent data, preserve generated secrets/encryption keys, check entitlement and compatibility, and follow the release-specific Marketplace upgrade procedure from Support. The URL-only upgrades above are not a version-upgrade procedure. The general Patient Journey Intelligence deployment scripts can use different registry and environment defaults.

Uninstalling

Back up required data and confirm the namespace before removal.

helm uninstall pj-app -n "$NAMESPACE"
kubectl get pvc -n "$NAMESPACE"
kubectl get pv

Installer-created StorageClasses use Retain. Helm does not remove all PVCs/data or the separately provisioned EFS/mount targets/security group, retained EBS volumes, CSI add-ons, nginx load balancer, ECK operator, IAM roles, namespace, or EKS cluster. Review remaining resources to avoid ongoing charges; preserve shared components.

Only for a dedicated namespace whose remaining data is no longer needed:

kubectl delete pvc --all -n "$NAMESPACE"
kubectl delete namespace "$NAMESPACE"

Only for a dedicated cluster no longer needed:

eksctl delete cluster --name "$CLUSTER_NAME" --region "$REGION"

Deletion can permanently destroy data. Review retained storage/backups first, then verify EFS, EBS, load balancers, and IAM resources separately in AWS after cluster deletion. Remove only deployment-owned resources, including the scheduler role/policy when no longer used. Marketplace subscription cancellation is a separate action in the Marketplace console.

Next steps

Use Getting Started to choose your first Patient Journey Intelligence workflow. Keep Marketplace quick help available for routine installation and operational checks.

Frequently asked questions

It can create a new EKS cluster or connect to an existing one, then provisions the IAM OIDC provider, an EFS filesystem with its security group and mount targets, the EBS and EFS CSI drivers, the pj-app-efs and pj-app-gp3 StorageClasses, an nginx ingress controller, the ECK operator, the scheduler IAM role and policy for metering, and the Helm release pj-app. AWS infrastructure charges are separate from the product subscription.

Obtain it from the fulfillment instructions, the release owner, or Support before starting. A prodview-... listing ID is not the product code, and the installer rejects blank input.

Use Helm 3.10 or later in the Helm 3 series. The script checks only for Helm 3.7.1, but its product-code configuration uses --set-json, which requires 3.10 or later.

The hourly marketplace_metering DAG runs in the Airflow scheduler and uses the pj-app-airflow-scheduler-metering IAM role through IRSA, with only the aws-marketplace:MeterUsage permission. Check the send_aws_metering_data task logs in Airflow to confirm that reports were accepted.

No. The installer disables chart-managed cert-manager integration. Configure DNS and TLS with an existing cert-manager ClusterIssuer or your organization's TLS gateway before sensitive or production use.

Do not rerun the first-install script. Back up persistent data, preserve generated secrets and encryption keys, check entitlement and compatibility, and follow the release-specific Marketplace upgrade procedure from Support.