// Module included in the following assemblies:
//
// * hosted_control_planes/hcp-manage/hcp-manage-aws.adoc

:_mod-docs-content-type: CONCEPT
[id="hcp-unmanaged-aws-hc-prereq_{context}"]
= Unmanaged infrastructure requirements for a management {aws-short} account

[role="_abstract"]
When your infrastructure is prerequired and unmanaged in a hosted cluster {aws-first} account, ensure that you are familiar with the infrastructure requirements for all access modes.

* One VPC
* One DHCP Option
* Two subnets
** A private subnet that is an internal data plane subnet
** A public subnet that enables access to the internet from the data plane
* One internet gateway
* One elastic IP
* One NAT gateway
* One security group (worker nodes)
* Two route tables (one private and one public)
* Two Route 53 hosted zones
* Enough quota for the following items:
** One Ingress service load balancer for public hosted clusters
** One private link endpoint for private hosted clusters

[NOTE]
====
For private link networking to work, the endpoint zone in the hosted cluster {aws-short} account must match the zone of the instance that is resolved by the service endpoint in the management cluster {aws-short} account. In {aws-short}, the zone names are aliases, such as us-east-2b, which do not necessarily map to the same zone in different accounts. As a result, for private link to work, the management cluster must have subnets or workers in all zones of its region.
====
