feat(aws): add Marketplace one-click deployment

README.md

@@ -380,6 +380,10 @@ PostgreSQL migration guidance, see
 [Installation troubleshooting](docs/deployment/INSTALL_TROUBLESHOOTING.md) and the
 [cloud deployment guide](docs/deployment/CLOUD_DEPLOYMENT_EN.md).
 
+For the free AWS Marketplace single-node delivery option, including first
+launch, upgrades, backup, rollback, and cost notes, see the
+[AWS Marketplace deployment guide](docs/deployment/AWS_MARKETPLACE_DEPLOYMENT.md).
+
 ## Production deployment
 
 Validate secrets before starting a production stack:
@@ -747,6 +751,7 @@ The maintained documentation index is available at [`docs/README.md`](docs/READM
 | Indicator development | [Indicator guide](docs/trading/INDICATOR_DEV_GUIDE.md) |
 | MCP and agents | [Agent documentation](docs/agent/README.md) |
 | Cloud deployment | [Cloud deployment](docs/deployment/CLOUD_DEPLOYMENT_EN.md) |
+| AWS Marketplace | [One-click deployment and upgrade](docs/deployment/AWS_MARKETPLACE_DEPLOYMENT.md) |
 | Installation problems | [Troubleshooting](docs/deployment/INSTALL_TROUBLESHOOTING.md) |
 
 ## Contributing

README_CN.md

@@ -339,6 +339,9 @@ docker compose ps
 [安装故障排查](docs/deployment/INSTALL_TROUBLESHOOTING_CN.md)和
 [云部署指南](docs/deployment/CLOUD_DEPLOYMENT_CN.md)。
 
+如需使用免费的 AWS Marketplace 单机交付方案，以及查看首次部署、升级、备份、回滚和费用说明，
+请参阅 [AWS Marketplace 一键部署指南](docs/deployment/AWS_MARKETPLACE_DEPLOYMENT_CN.md)。
+
 ## 生产环境部署
 
 启动生产环境服务栈前，先验证密钥：
@@ -674,6 +677,7 @@ Web 与移动端仓库分别发布自己的 GHCR 镜像。只有从源码构建
 | 指标开发 | [指标指南](docs/trading/INDICATOR_DEV_GUIDE.md) |
 | MCP 与 Agent | [Agent 文档](docs/agent/README.md) |
 | 云部署 | [云部署](docs/deployment/CLOUD_DEPLOYMENT_EN.md) |
+| AWS Marketplace | [一键部署与升级](docs/deployment/AWS_MARKETPLACE_DEPLOYMENT_CN.md) |
 | 安装问题 | [故障排查](docs/deployment/INSTALL_TROUBLESHOOTING.md) |
 
 ## 参与贡献

backend_api_python/tests/test_aws_marketplace_template.py

@@ -0,0 +1,56 @@
+from pathlib import Path
+
+
+REPOSITORY_ROOT = Path(__file__).resolve().parents[2]
+TEMPLATE = REPOSITORY_ROOT / "deploy" / "aws-marketplace" / "quantdinger-single-node.yaml"
+GUIDE = REPOSITORY_ROOT / "docs" / "deployment" / "AWS_MARKETPLACE_DEPLOYMENT.md"
+
+
+def _template_text() -> str:
+    return TEMPLATE.read_text(encoding="utf-8")
+
+
+def test_marketplace_template_uses_immutable_artifacts() -> None:
+    template = _template_text()
+
+    assert ":latest" not in template
+    assert "raw.githubusercontent.com/OpenByteInc/QuantDinger/" in template
+    assert "[0-9a-f]{40}/docker-compose" in template
+    for component in ("backend", "frontend", "mobile", "postgres", "redis", "kafka"):
+        assert f"2026.10.26-{component}" in template
+
+
+def test_marketplace_template_does_not_open_administration_ports() -> None:
+    template = _template_text()
+
+    assert "FromPort: 22" not in template
+    assert "FromPort: 5432" not in template
+    assert "FromPort: 6379" not in template
+    assert "FromPort: 29092" not in template
+    assert "Default: 0.0.0.0/0" not in template
+    assert "AssociatePublicIpAddress: false" in template
+    assert "AmazonSSMManagedInstanceCore" in template
+    assert "DeletionPolicy: Retain" in template
+    assert "UpdateReplacePolicy: Retain" in template
+
+
+def test_marketplace_template_generates_secrets_and_backs_up_before_update() -> None:
+    template = _template_text()
+
+    assert "POSTGRES_PASSWORD=$(openssl rand -hex 24)" in template
+    assert "SECRET_KEY=$(openssl rand -hex 32)" in template
+    assert "CREDENTIAL_ENCRYPTION_KEY=$(openssl rand -hex 32)" in template
+    assert "--type SecureString" in template
+    assert "pg_dump" in template
+    assert "BACKUP_PATH=" in template
+
+
+def test_marketplace_guide_warns_about_data_deletion_and_aws_costs() -> None:
+    guide = GUIDE.read_text(encoding="utf-8")
+
+    assert "software price is zero" in guide
+    assert "Deleting the CloudFormation stack" in guide
+    assert "retains the encrypted data volume" in guide
+    assert "continue to incur normal AWS charges" in guide
+    assert "six images" in guide
+    assert "one EC2" in guide

deploy/aws-marketplace/README.md

@@ -0,0 +1,38 @@
+# AWS Marketplace deployment assets
+
+This directory contains the deployment template used by the QuantDinger AWS
+Marketplace delivery option.
+
+## Delivery model
+
+`quantdinger-single-node.yaml` creates one Amazon Linux 2023 EC2 instance in a
+dedicated VPC and runs the complete QuantDinger container stack on that host.
+The six container images are application components, not six EC2 instances.
+
+The stack:
+
+- exposes the desktop and mobile web clients only to the configured CIDR;
+- keeps PostgreSQL, Redis, Kafka, and the backend port on loopback interfaces;
+- uses Systems Manager Session Manager instead of opening SSH;
+- generates deployment secrets and stores the initial administrator password
+  as a SecureString in Systems Manager Parameter Store;
+- creates a PostgreSQL logical backup before each version update; and
+- uses immutable Marketplace image tags and a commit-pinned Compose file.
+
+## Release procedure
+
+1. Update the image tags, `ReleaseVersion`, and `ComposeUrl` in the template.
+2. Validate the template and perform an end-to-end deployment in a disposable
+   AWS account or isolated test VPC.
+3. Verify first install, administrator login, service health, backup creation,
+   in-place update, and documented rollback.
+4. Upload the validated template to the public, versioned release bucket.
+5. Attach that immutable object URL as the AWS Marketplace deployment resource.
+6. Never overwrite a previously published template object. Publish a new
+   versioned key for every Marketplace release.
+
+The customer guides are:
+
+- [English](../../docs/deployment/AWS_MARKETPLACE_DEPLOYMENT.md)
+- [简体中文](../../docs/deployment/AWS_MARKETPLACE_DEPLOYMENT_CN.md)
+