On-Premises

Some workloads cannot move. Latency to a machine on a factory floor, a regulator’s view on where data sits, or hardware that is already paid for and not going anywhere all produce the same requirement: AWS services, or AWS management, reaching infrastructure AWS does not own.

AWS answers this in four different ways, and the right one depends on what has to stay put — the hardware, the virtualisation layer, the orchestrator, or only the management plane. The canonical page for each option is elsewhere in this section; this page is the map.

AWS-owned hardware in your data centre. AWS Outposts delivers AWS-managed infrastructure on-premises, running EC2, S3 on Outposts, RDS and other services locally while connected to the parent Region. It is the option that changes the least about how a workload is built: the same APIs, the same console, a different physical location. It is ordered as a rack — a self-contained 42U unit, or several compute racks behind a network rack for larger deployments. The small 1U and 2U Outposts servers are no longer sold; AWS has said it is instead bringing rack capability into smaller power and space envelopes, so check the current form factors before sizing a site. See services and strategies.

Your virtualisation stack, running on AWS. Amazon Elastic VMware Service runs a VMware Cloud Foundation environment on EC2 bare metal inside your own VPC, so vSphere, the runbooks, the third-party tooling and the IP addressing survive the move. It is the inverse trade: the hardware moves, the operating model does not. See hybrid cloud architectures.

Containers on your own machines. ECS Anywhere registers your servers as capacity for an ECS control plane that stays in AWS. EKS Anywhere does the opposite, running the whole Kubernetes cluster — control plane included — on your infrastructure using the EKS Distro. The first needs connectivity to AWS to schedule work; the second does not. Both are covered under containers.

Management only. AWS Systems Manager manages machines that are not on AWS at all. The SSM Agent installs on Linux, Windows and macOS hosts anywhere, communicates outbound only, and is registered through a hybrid activation rather than an instance profile. Once registered, an on-premises server is a managed node like any EC2 instance: Session Manager for shell access without an inbound port, Run Command for fleet-wide execution, Patch Manager for patching, and Inventory for what is installed.

Two neighbouring topics are worth knowing about. Storage that spans the boundary — presenting S3, EBS snapshots or virtual tape to on-premises applications over standard protocols — is Storage Gateway. The network underneath all of this is Direct Connect or a Site-to-Site VPN, covered under networking.