Running indx on AWS, Azure, and GCP

indx ships cloud defaults out of the box and can run the entire pipeline on your own hardware with nothing leaving the network. This guide covers the third path: running every slot on a single cloud vendor’s managed services, with credentials taken from each cloud’s standard environment and no configuration beyond a flag.

Three self-contained cloud profiles are available:

pip install "indx[aws]"    # Textract → Bedrock → Titan → S3 Vectors
pip install "indx[azure]"  # Document Intelligence → Azure OpenAI → AI Search
pip install "indx[gcp]"    # Document AI → Gemini → gemini-embedding → BigQuery

After installing, a single flag selects the entire stack:

indx ./docs --out ./ai-ready.indx --aws
indx ./docs --out ./ai-ready.indx --azure
indx ./docs --out ./ai-ready.indx --gcp

The promise: one install + one flag = a fully managed, single-vendor knowledge-space build, with every backend still individually swappable. The --aws preset is a convenience, not a coupling: you can mix --parser textract --store qdrant freely, and the per-backend path (indx[cloud], indx[local]) is still the route for minimalists or mixed stacks.

Presets are mutually exclusive with --offline

--aws, --azure, --gcp, and --offline are sibling “fill-the-unset-slots” profiles. Passing more than one is a usage error. If you need to combine, select backends explicitly through flags or indx.toml instead.

Note

indx requires Python 3.11+ (supports 3.11–3.13) and is Apache-2.0 licensed. See Installation for the full matrix and Extras reference for every pip install "indx[...]" target.

The slot × cloud matrix

Each preset fills every pipeline slot with that cloud’s managed service. VLM is off by default in every preset (opt in with --vlm bedrock, --vlm azure, or --vlm vertex). Any slot you set explicitly wins over the preset.

Slot	AWS — indx[aws]	Azure — indx[azure]	GCP — indx[gcp]
Parser	textract — Amazon Textract	docintel — Azure AI Document Intelligence	docai — Google Document AI
LLM	bedrock — Bedrock Converse	azure — Azure OpenAI	vertex — Vertex AI Gemini
VLM	bedrock — Bedrock Converse (image)	azure — Azure OpenAI vision	vertex — Gemini multimodal
Embedder	bedrock — Titan v2 / Cohere	azure — Azure OpenAI embeddings	vertex — gemini-embedding-001
Store (default)	s3vectors — Amazon S3 Vectors	azure-search — Azure AI Search	bigquery — BigQuery vector search
Store (opt-in)	opensearch — OpenSearch Serverless	—	vertex-vector — Vertex Vector Search
SDK footprint	boto3	openai, azure-ai-documentintelligence, azure-search-documents, azure-identity	google-genai, google-cloud-documentai, google-cloud-bigquery

The default stores are chosen for zero-infrastructure friction: S3 Vectors and BigQuery are serverless APIs that need no endpoint deployment. See Choosing a Vector Store for the latency trade-offs and the opt-in OpenSearch and Vertex Vector Search stores.

AWS — indx[aws]

Install

pip install "indx[aws]"

The entire default AWS stack — Textract, Bedrock, Titan, and S3 Vectors — is covered by a single dependency: boto3. The opt-in OpenSearch Serverless store adds opensearch-py:

pip install "indx[aws-opensearch]"  # includes indx[aws] + opensearch-py

Run

indx ./docs --out ./ai-ready.indx --aws

To override a single slot:

# Use Textract + Bedrock, but store in Qdrant instead of S3 Vectors
indx ./docs --out ./ai-ready.indx --aws --store qdrant

Environment variables and credentials

AWS credentials are discovered automatically by boto3’s standard chain. Adapters never read or log keys directly — they pass only region and, optionally, profile to boto3.Session.

Variable	Purpose
AWS_REGION or AWS_DEFAULT_REGION	Region for all service clients (required)
AWS_ACCESS_KEY_ID	Static credentials (optional — roles / SSO preferred)
AWS_SECRET_ACCESS_KEY	Static credentials
AWS_SESSION_TOKEN	Temporary credentials
AWS_PROFILE	Named profile in ~/.aws/credentials

In production, prefer an IAM role attached to your compute (EC2 instance profile, ECS task role, Lambda execution role, or EKS IRSA) over static keys. boto3 discovers instance metadata credentials automatically with no environment variables needed.

The minimum IAM permissions for the default stack are:

• textract:DetectDocumentText (parser)
• bedrock-runtime:Converse, bedrock-runtime:InvokeModel (LLM, embedder)
• s3vectors:PutVectors, s3vectors:QueryVectors, s3vectors:DeleteVectors, s3vectors:CreateVectorIndex (store)

indx.toml configuration

Non-secret knobs only. Credentials come from the boto3 chain, never from config.

[parser]
engine = "textract"

[parser.textract]
region = "us-east-1"
# features = ["TABLES", "FORMS"]  # enable Analyze Document (off by default)

[enrich]
llm = "bedrock:us.anthropic.claude-sonnet-4-6"

[embed]
model = "bedrock:amazon.titan-embed-text-v2:0"

[embed.bedrock]
dimensions = 1024  # also accepts 512 or 256

[store]
backend = "s3vectors"

[store.s3vectors]
bucket = "indx-vectors"
index  = "handbook"
region = "us-east-1"

Textract page limits

The synchronous Textract call (detect_document_text) accepts up to 10 MB and single-page PDFs. Multi-page PDFs need the async S3-backed flow, which is out of scope for v1. indx raises a clear StageError if the limit is exceeded.

Bedrock model IDs and inference profiles

Many Bedrock models require a region-prefixed inference profile (us., eu., apac.). If a bare model ID raises a validation error, indx surfaces a StageError with the corrected prefixed form. The default us.anthropic.claude-sonnet-4-6 uses the us. prefix. The Titan embedder does not use inference profiles — use the bare ID (amazon.titan-embed-text-v2:0). Model IDs drift; keep the llm and embed.model values in your indx.toml so you can update them without touching code.

---

Azure — indx[azure]

Install

pip install "indx[azure]"

The Azure extra installs the full SDK set: openai, azure-ai-documentintelligence, azure-search-documents, azure-identity, and azure-core. If you previously installed indx[azure] for the LLM alone, re-installing picks up the new dependencies additively.

Run

indx ./docs --out ./ai-ready.indx --azure

Environment variables and credentials

Azure adapters support two credential modes, selected automatically per service. If the service’s API key environment variable is set, it is used. If not, DefaultAzureCredential is attempted (managed identity, az login, workload identity). Keys stay in environment variables and are never written to indx.toml.

Variable	Service	Purpose
AZURE_OPENAI_API_KEY	Azure OpenAI	LLM, VLM, embedder API key
AZURE_OPENAI_ENDPOINT	Azure OpenAI	Service endpoint URL
AZURE_OPENAI_DEPLOYMENT	Azure OpenAI	LLM chat deployment name
AZURE_OPENAI_EMBED_DEPLOYMENT	Azure OpenAI	Embedder deployment name
AZURE_OPENAI_VLM_DEPLOYMENT	Azure OpenAI	VLM deployment name
AZURE_OPENAI_API_VERSION	Azure OpenAI	API version (default: 2024-10-21)
AZURE_DOCUMENTINTELLIGENCE_ENDPOINT	Document Intelligence	Service endpoint URL
AZURE_DOCUMENTINTELLIGENCE_KEY	Document Intelligence	API key
AZURE_SEARCH_SERVICE_ENDPOINT	AI Search	Service endpoint URL
AZURE_SEARCH_API_KEY	AI Search	Admin key (for index create/upload)
AZURE_SEARCH_INDEX_NAME	AI Search	Index to write to / query

When no key variable is set, the adapter falls back to DefaultAzureCredential, which works automatically in Azure-hosted compute (App Service, AKS, Container Apps) and via az login on a developer machine. No azure-identity configuration is needed beyond having the package installed (it is included in indx[azure]).

The deployment name is not the model name

In Azure OpenAI, the AZURE_OPENAI_DEPLOYMENT, AZURE_OPENAI_EMBED_DEPLOYMENT, and AZURE_OPENAI_VLM_DEPLOYMENT values are the deployment names you chose in the Azure portal or Bicep/ARM — not the canonical OpenAI model identifiers. The embedder’s dim must match the vector_search_dimensions set in the AI Search index, or upload will fail.

indx.toml configuration

[parser]
engine = "docintel"

[parser.docintel]
model_id = "prebuilt-read"  # or "prebuilt-layout" for tables/structure

[enrich]
llm = "azure"

[embed]
model = "azure"

[store]
backend = "azure-search"

[store.azure-search]
index_name = "handbook"

---

GCP — indx[gcp]

Install

pip install "indx[gcp]"

The GCP extra installs google-genai (for all three model slots: LLM, VLM, embedder), google-cloud-documentai (parser), and google-cloud-bigquery (default store). The heavier google-cloud-aiplatform package is pulled only by the opt-in Vertex Vector Search store:

pip install "indx[gcp-vectorsearch]"  # includes indx[gcp] + google-cloud-aiplatform

Run

indx ./docs --out ./ai-ready.indx --gcp

Environment variables and credentials

GCP uses Application Default Credentials (ADC) for every service. Adapters never handle keys directly.

Variable	Purpose
GOOGLE_APPLICATION_CREDENTIALS	Path to a service account JSON key file
GOOGLE_CLOUD_PROJECT	GCP project ID
GOOGLE_CLOUD_LOCATION	Region / multi-region (e.g. us-central1, us)
GOOGLE_GENAI_USE_VERTEXAI	Set to true to use Vertex AI (required for production)

On GCE, Cloud Run, GKE, or Cloud Functions, the attached service account is discovered automatically with no environment variables needed. On a developer machine, run gcloud auth application-default login once. In CI, export GOOGLE_APPLICATION_CREDENTIALS pointing at a service account key file.

Document AI processor

The Document AI parser requires a processor to be created once out-of-band (in the GCP console or via the API). Reference its ID in indx.toml. The location value for Document AI is a multi-region bucket (us or eu), not a specific zone — using a zone-level value is a common misconfiguration.

Gemini model retirement dates

gemini-2.0-flash was shut down 2026-06-01. The current default is gemini-2.5-flash (retirement date 2026-10-16). Keep the llm and embed.model values in your indx.toml so you can update them without touching code. Never rely on an undocumented “latest” alias.

indx.toml configuration

[parser]
engine = "docai"

[parser.docai]
project      = "my-proj"
location     = "us"          # "us" or "eu" — multi-region bucket, not a zone
processor_id = "abc123def456"

[enrich]
llm = "vertex:gemini-2.5-flash"

[embed]
model = "vertex:gemini-embedding-001"

[embed.vertex]
output_dimensionality = 768   # native default is 3072; 768 for cost/compat
task_type             = "RETRIEVAL_DOCUMENT"

[store]
backend = "bigquery"

[store.bigquery]
project = "my-proj"
dataset = "indx"
table   = "handbook"

BigQuery query latency

BigQuery VECTOR_SEARCH is billed per query and delivers seconds-scale latency. For interactive, latency-sensitive workloads, consider pgvector (existing extra, GCP-compatible via Cloud SQL) or the opt-in vertex-vector store (indx[gcp-vectorsearch]). BigQuery is the right default for serverless, zero-infrastructure builds where query latency is not a hard requirement.

---

Mix and match

The cloud presets fill only the slots you did not set explicitly. Any slot you override wins:

# AWS parser + embedder, but keep your existing Qdrant store
indx ./docs --out ./ai-ready.indx --aws --store qdrant

# Azure OpenAI LLM only, with Docling parser and bge-m3 embedder
indx ./docs --out ./ai-ready.indx --llm azure --parser docling --embedder bge-m3

The same mixing works in indx.toml. See Configuring indx for the full resolution order.

Manifest records the resolved stack

Every run writes its resolved slot names into the .indx manifest:

// manifest.json (illustrative — AWS run)
{
  "indx_version": "1.0",
  "tool_version": "indx 0.5.0",
  "slots": {
    "parser":   "textract",
    "llm":      "bedrock:us.anthropic.claude-sonnet-4-6",
    "vlm":      "none",
    "embedder": "bedrock:amazon.titan-embed-text-v2:0",
    "store":    "s3vectors",
    "output":   "indx"
  },
  "embedder": { "name": "bedrock:amazon.titan-embed-text-v2:0", "dim": 1024 }
}

Use indx inspect ./ai-ready.indx to view the manifest and confirm which backends were active.

Related

• Running Fully Local & Air-Gapped — the --offline and indx[local] paths.
• Enrichment: LLMs & VLMs — per-model configuration and prompt tuning.
• Choosing an Embedder — dimension, batch, and cost trade-offs.
• Choosing a Vector Store — latency, cost, and operational trade-offs.
• Choosing a Parser — when to prefer Textract, Document Intelligence, or Document AI.
• Extras reference — every pip install "indx[...]" target.
• Configuration guide — full indx.toml reference and resolution order.