diff --git a/.gitignore b/.gitignore
index 3652e61..e54f557 100644
--- a/.gitignore
+++ b/.gitignore
@@ -113,3 +113,8 @@ node_modules/
 
 # Demo files to ignore
 demo/cmip6/CMIP6_daily_*stac_items.ndjson
+
+
+# browser compiled code and default config
+infrastructure/aws/stac-browser
+infrastructure/aws/browser_config.js
\ No newline at end of file
diff --git a/README.md b/README.md
index bdc5df2..371b62a 100644
--- a/README.md
+++ b/README.md
@@ -32,6 +32,8 @@
 
 - **OGC Features and Vector Tiles** API built on top of [https://github.com/developmentseed/tipg](https://github.com/developmentseed/tipg)
 
+- **A STAC Catalog browsing UI** based on the radiant earth browser : [https://github.com/radiantearth/stac-browser](https://github.com/radiantearth/stac-browser)
+
 ---
 
 ## 🌍 eoAPI: An Open-Source Community Project
@@ -57,22 +59,19 @@ Then you can start exploring your dataset with:
 
   - the STAC Metadata service [http://localhost:8081](http://localhost:8081)
   - the Raster service [http://localhost:8082](http://localhost:8082)
+  - the browser UI [http://localhost:8085](http://localhost:8085)
 
 If you've added a vector dataset to the `public` schema in the Postgres database, they will be available through the **Vector** service at [http://localhost:8083](http://localhost:8083).
 
-## Deployment
+## Deployment with standard runtimes
 
 This repository has current runtimes that are consistently updated with new functionality.
 
-The services can be deployed locally via docker with `docker compose up`.
-
-Two Infrastructure as Code (IaC) repositories are available:
-- [eoapi-cdk](https://github.com/developmentseed/eoapi-cdk): A set of AWS CDK constructs to deploy eoAPI services
-- [eoapi-k8s](https://github.com/developmentseed/eoapi-k8s): IaC and Helm charts for deploying eoAPI services on AWS and GCP
+### Local deployment
 
-Finally, [eoapi-template](https://github.com/developmentseed/eoapi-template) is an AWS CDK app that shows how to configure the eoapi-cdk constructs.
+The services can be deployed altogether locally with `docker compose up`.
 
-Alternatively, you may install the libraries locally:
+Alternatively, you may install the libraries and launch the applications manually : 
 
 <details>
 
@@ -109,7 +108,19 @@ Note: python libraries might have incompatible dependencies, which you can resol
 
 </details>
 
-## Custom runtimes
+### Deployment on the cloud
+
+#### Kubernetes 
+
+[eoapi-k8s](https://github.com/developmentseed/eoapi-k8s) contains IaC and Helm charts for deploying eoAPI services on AWS and GCP.
+
+#### AWS CDK
+
+[eoapi-cdk](https://github.com/developmentseed/eoapi-cdk) defines a set of AWS CDK constructs that can be used to deploy eoAPI services on AWS. This repository itself makes use of these in `infrastructure/aws`. An official example usage of these constructs can be found at [eoapi-template](https://github.com/developmentseed/eoapi-template).
+
+
+
+## Deployment with custom runtimes
 
 The eoAPI repository hosts customized versions of each base service which can work in parallel or in combination with each other.
 
diff --git a/docker-compose.custom.yml b/docker-compose.custom.yml
index 8e257f1..64343bc 100644
--- a/docker-compose.custom.yml
+++ b/docker-compose.custom.yml
@@ -1,6 +1,18 @@
 version: '3'
 
 services:
+  stac-browser:
+    profiles:
+      - gunicorn
+    build:
+      context: dockerfiles
+      dockerfile: Dockerfile.browser
+    ports:
+      - "${MY_DOCKER_IP:-127.0.0.1}:8085:8085"
+    depends_on:
+      - stac
+      - database
+      - raster
   stac:
     container_name: eoapi.stac
     profiles:
diff --git a/docker-compose.yml b/docker-compose.yml
index a29863d..f43fec0 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -1,6 +1,19 @@
 version: '3'
 
 services:
+
+  # change to official image when available https://github.com/radiantearth/stac-browser/pull/386
+  stac-browser:
+    build:
+      context: dockerfiles
+      dockerfile: Dockerfile.browser
+    ports:
+      - "${MY_DOCKER_IP:-127.0.0.1}:8085:8085"
+    depends_on:
+      - stac-fastapi
+      - titiler-pgstac
+      - database
+      
   stac-fastapi:
     # Note:
     # the official ghcr.io/stac-utils/stac-fastapi-pgstac image uses python 3.8 and uvicorn
diff --git a/dockerfiles/Dockerfile.browser b/dockerfiles/Dockerfile.browser
new file mode 100644
index 0000000..0aa9932
--- /dev/null
+++ b/dockerfiles/Dockerfile.browser
@@ -0,0 +1,34 @@
+# Copyright Radiant Earth Foundation
+
+FROM node:lts-alpine3.18 AS build-step
+ARG DYNAMIC_CONFIG=true
+
+WORKDIR /app
+
+RUN apk add --no-cache git
+RUN git clone https://github.com/radiantearth/stac-browser.git .
+# remove the default config.js
+RUN rm config.js
+RUN npm install
+# replace the default config.js with our config file
+COPY ./browser_config.js ./config.js
+RUN \[ "${DYNAMIC_CONFIG}" == "true" \] && sed -i 's/<!-- <script defer="defer" src=".\/config.js"><\/script> -->/<script defer="defer" src=".\/config.js"><\/script>/g' public/index.html
+RUN npm run build
+
+
+FROM nginx:1-alpine-slim
+
+COPY --from=build-step /app/dist /usr/share/nginx/html
+COPY --from=build-step /app/config.schema.json /etc/nginx/conf.d/config.schema.json
+
+# change default port to 8084
+RUN apk add jq pcre-tools && \
+    sed -i 's/\s*listen\s*80;/    listen 8084;/' /etc/nginx/conf.d/default.conf && \
+    sed -i 's/\s*location \/ {/    location \/ {\n        try_files $uri $uri\/ \/index.html;/' /etc/nginx/conf.d/default.conf
+
+EXPOSE 8084
+
+STOPSIGNAL SIGTERM
+
+# override entrypoint, which calls nginx-entrypoint underneath
+COPY --from=build-step /app/docker/docker-entrypoint.sh ./docker-entrypoint.d/40-stac-browser-entrypoint.sh
\ No newline at end of file
diff --git a/dockerfiles/browser_config.js b/dockerfiles/browser_config.js
new file mode 100644
index 0000000..89844ca
--- /dev/null
+++ b/dockerfiles/browser_config.js
@@ -0,0 +1,39 @@
+module.exports = {
+    catalogUrl: "http://0.0.0.0:8081",
+    catalogTitle: "eoAPI STAC Browser",
+    allowExternalAccess: true, // Must be true if catalogUrl is not given
+    allowedDomains: [],
+    detectLocaleFromBrowser: true,
+    storeLocale: true,
+    locale: "en",
+    fallbackLocale: "en",
+    supportedLocales: [
+        "de",
+        "es",
+        "en",
+        "fr",
+        "it",
+        "ro"
+    ],
+    apiCatalogPriority: null,
+    useTileLayerAsFallback: true,
+    displayGeoTiffByDefault: false,
+    buildTileUrlTemplate: ({href, asset}) => "http://0.0.0.0:8082/cog/tiles/{z}/{x}/{y}@2x?url=" + encodeURIComponent(asset.href.startsWith("/vsi") ? asset.href : href),
+    stacProxyUrl: null,
+    pathPrefix: "/",
+    historyMode: "history",
+    cardViewMode: "cards",
+    cardViewSort: "asc",
+    showThumbnailsAsAssets: false,
+    stacLint: true,
+    geoTiffResolution: 128,
+    redirectLegacyUrls: false,
+    itemsPerPage: 12,
+    defaultThumbnailSize: null,
+    maxPreviewsOnMap: 50,
+    crossOriginMedia: null,
+    requestHeaders: {},
+    requestQueryParameters: {},
+    preprocessSTAC: null,
+    authConfig: null
+};
diff --git a/docs/src/services.md b/docs/src/services.md
index b547fc7..06db839 100644
--- a/docs/src/services.md
+++ b/docs/src/services.md
@@ -109,4 +109,25 @@ It enables vector Features/Features Collection exploration and visualization for
 
     - https://vector.eoapi.dev/collections/public.landsat_wrs/viewer shows the `landsat_wrs` Table on a Map client using vector tiles
 
-    - https://vector.eoapi.dev/tileMatrixSets/WebMercatorQuad `WebMercatorQuad` TileMatrixSet information
\ No newline at end of file
+    - https://vector.eoapi.dev/tileMatrixSets/WebMercatorQuad `WebMercatorQuad` TileMatrixSet information
+
+
+## Browsing UI
+
+The browsing UI deployed in eoAPI is built on [the radiant earth STAC browser](https://github.com/radiantearth/stac-browser), and provides a configurable, user-friendly interface to search across and within collections and quickly visualize single items assets.
+
+
+<p align="center">
+<img alt="stac-fastapi" src="https://github.com/developmentseed/eoAPI/assets/45140658/fae75d99-44c5-4899-8185-d003cd3c2c6a"/>
+</p>
+
+!!! example
+
+    - http://eoapi-dev-stac-browser.s3-website-us-east-1.amazonaws.com landing page
+
+    - http://eoapi-dev-stac-browser.s3-website-us-east-1.amazonaws.com/collections display available **Collection**
+
+    - http://eoapi-dev-stac-browser.s3-website-us-east-1.amazonaws.com/collections/MAXAR_southafrica_flooding22/items display available **Items** for the `MAXAR_southafrica_flooding22` collection
+
+    - http://eoapi-dev-stac-browser.s3-website-us-east-1.amazonaws.com/collections/MAXAR_southafrica_flooding22/items/36_213131033000_1040010076566100 show the `36_213131033000_1040010076566100` **Item** in the `MAXAR_southafrica_flooding22` collection and visualize its "visual" asset. 
+---
\ No newline at end of file
diff --git a/infrastructure/aws/browser_config.example.js b/infrastructure/aws/browser_config.example.js
new file mode 100644
index 0000000..6c8f9de
--- /dev/null
+++ b/infrastructure/aws/browser_config.example.js
@@ -0,0 +1,39 @@
+module.exports = {
+    catalogUrl: null,
+    catalogTitle: "eoAPI STAC Browser",
+    allowExternalAccess: true, // Must be true if catalogUrl is not given
+    allowedDomains: [],
+    detectLocaleFromBrowser: true,
+    storeLocale: true,
+    locale: "en",
+    fallbackLocale: "en",
+    supportedLocales: [
+        "de",
+        "es",
+        "en",
+        "fr",
+        "it",
+        "ro"
+    ],
+    apiCatalogPriority: null,
+    useTileLayerAsFallback: true,
+    displayGeoTiffByDefault: false,
+    buildTileUrlTemplate: ({href, asset}) => "https://raster.dev/cog/tiles/{z}/{x}/{y}@2x?url=" + encodeURIComponent(asset.href.startsWith("/vsi") ? asset.href : href),
+    stacProxyUrl: null,
+    pathPrefix: "/",
+    historyMode: "history",
+    cardViewMode: "cards",
+    cardViewSort: "asc",
+    showThumbnailsAsAssets: false,
+    stacLint: true,
+    geoTiffResolution: 128,
+    redirectLegacyUrls: false,
+    itemsPerPage: 12,
+    defaultThumbnailSize: null,
+    maxPreviewsOnMap: 50,
+    crossOriginMedia: null,
+    requestHeaders: {},
+    requestQueryParameters: {},
+    preprocessSTAC: null,
+    authConfig: null
+};
\ No newline at end of file
diff --git a/infrastructure/aws/cdk/app.py b/infrastructure/aws/cdk/app.py
index b327440..cf14874 100644
--- a/infrastructure/aws/cdk/app.py
+++ b/infrastructure/aws/cdk/app.py
@@ -1,124 +1,38 @@
 """
 CDK Stack definition code for EOAPI
 """
-import json
 import os
 from typing import Any
 
-from aws_cdk import App, CfnOutput, CustomResource, Duration, RemovalPolicy, Stack, Tags
-from aws_cdk import aws_apigatewayv2_alpha as apigw
+import boto3
+from aws_cdk import App, CfnOutput, Duration, RemovalPolicy, Stack, Tags
 from aws_cdk import aws_ec2 as ec2
 from aws_cdk import aws_iam as iam
 from aws_cdk import aws_lambda
 from aws_cdk import aws_logs as logs
 from aws_cdk import aws_rds as rds
-from aws_cdk import aws_secretsmanager as secretsmanager
-from aws_cdk.aws_apigatewayv2_integrations_alpha import HttpLambdaIntegration
+from aws_cdk import aws_s3 as s3
 from config import (
     eoAPISettings,
     eoDBSettings,
     eoRasterSettings,
+    eoStacBrowserSettings,
     eoSTACSettings,
     eoVectorSettings,
 )
 from constructs import Construct
+from eoapi_cdk import (
+    PgStacApiLambda,
+    PgStacDatabase,
+    StacBrowser,
+    StacIngestor,
+    TiPgApiLambda,
+    TitilerPgstacApiLambda,
+)
 
 eoapi_settings = eoAPISettings()
 
 
-class BootstrappedDb(Construct):
-    """
-    Given an RDS database, connect to DB and create a database, user, and
-    password
-    """
-
-    def __init__(
-        self,
-        scope: Construct,
-        id: str,
-        db: rds.DatabaseInstance,
-        new_dbname: str,
-        new_username: str,
-        secrets_prefix: str,
-        pgstac_version: str,
-        enable_context: bool = False,
-        enable_mosaic_index: bool = False,
-        context_dir: str = "../../",
-    ) -> None:
-        """Update RDS database."""
-        super().__init__(scope, id)
-
-        # TODO: Utilize a singleton function.
-        handler = aws_lambda.Function(
-            self,
-            "DatabaseBootstrapper",
-            handler="handler.handler",
-            runtime=aws_lambda.Runtime.PYTHON_3_10,
-            code=aws_lambda.Code.from_docker_build(
-                path=os.path.abspath(context_dir),
-                file="infrastructure/aws/dockerfiles/Dockerfile.db",
-                build_args={"PYTHON_VERSION": "3.10", "PGSTAC_VERSION": pgstac_version},
-                platform="linux/amd64",
-            ),
-            timeout=Duration.minutes(5),
-            vpc=db.vpc,
-            allow_public_subnet=True,
-            log_retention=logs.RetentionDays.ONE_WEEK,
-        )
-
-        self.secret = secretsmanager.Secret(
-            self,
-            id,
-            secret_name=os.path.join(
-                secrets_prefix, id.replace(" ", "_"), self.node.addr
-            ),
-            generate_secret_string=secretsmanager.SecretStringGenerator(
-                secret_string_template=json.dumps(
-                    {
-                        "dbname": new_dbname,
-                        "engine": "postgres",
-                        "port": 5432,
-                        "host": db.instance_endpoint.hostname,
-                        "username": new_username,
-                    },
-                ),
-                generate_string_key="password",
-                exclude_punctuation=True,
-            ),
-            description=f"Deployed by {Stack.of(self).stack_name}",
-        )
-
-        self.resource = CustomResource(
-            scope=scope,
-            id="BootstrappedDbResource",
-            service_token=handler.function_arn,
-            properties={
-                # By setting pgstac_version in the properties assures
-                # that Create/Update events will be passed to the service token
-                "pgstac_version": pgstac_version,
-                "context": enable_context,
-                "mosaic_index": enable_mosaic_index,
-                "conn_secret_arn": db.secret.secret_arn,
-                "new_user_secret_arn": self.secret.secret_arn,
-            },
-            # We do not need to run the custom resource on STAC Delete
-            # Custom Resource are not physical resources so it's OK to `Retain` it
-            removal_policy=RemovalPolicy.RETAIN,
-        )
-
-        # Allow lambda to...
-        # read new user secret
-        self.secret.grant_read(handler)
-        # read database secret
-        db.secret.grant_read(handler)
-        # connect to database
-        db.connections.allow_from(handler, port_range=ec2.Port.tcp(5432))
-
-    def is_required_by(self, construct: Construct):
-        """Register required services."""
-        return construct.node.add_dependency(self.resource)
-
-
 class eoAPIconstruct(Stack):
     """Earth Observation API CDK application"""
 
@@ -134,8 +48,6 @@ def __init__(  # noqa: C901
         """Define stack."""
         super().__init__(scope, id, **kwargs)
 
-        # vpc = ec2.Vpc(self, f"{id}-vpc", nat_gateways=0)
-
         vpc = ec2.Vpc(
             self,
             f"{id}-vpc",
@@ -144,23 +56,8 @@ def __init__(  # noqa: C901
                     name="ingress",
                     cidr_mask=24,
                     subnet_type=ec2.SubnetType.PUBLIC,
-                ),
-                ec2.SubnetConfiguration(
-                    name="application",
-                    cidr_mask=24,
-                    subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS,
-                ),
-                ec2.SubnetConfiguration(
-                    name="rds",
-                    cidr_mask=28,
-                    subnet_type=ec2.SubnetType.PRIVATE_ISOLATED,
-                ),
+                )
             ],
-            nat_gateways=1,
-        )
-        print(
-            """The eoAPI stack use AWS NatGateway for the Raster service so it can reach the internet.
-This might incurs some cost (https://docs.aws.amazon.com/vpc/latest/userguide/vpc-nat-gateway.html)."""
         )
 
         interface_endpoints = [
@@ -181,62 +78,79 @@ def __init__(  # noqa: C901
             vpc.add_gateway_endpoint(key, service=service)
 
         eodb_settings = eoDBSettings()
-        db = rds.DatabaseInstance(
+
+        pgstac_db = PgStacDatabase(
             self,
-            f"{id}-postgres-db",
+            "pgstac-db",
             vpc=vpc,
-            engine=rds.DatabaseInstanceEngine.POSTGRES,
+            engine=rds.DatabaseInstanceEngine.postgres(
+                version=rds.PostgresEngineVersion.VER_14
+            ),
+            vpc_subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PUBLIC),
+            allocated_storage=eodb_settings.allocated_storage,
             instance_type=ec2.InstanceType.of(
                 ec2.InstanceClass.BURSTABLE3,
                 ec2.InstanceSize(eodb_settings.instance_size),
             ),
             database_name="postgres",
-            # should set the subnet to `PRIVATE_ISOLATED` but then we need either a bastion host to connect to the db
-            # or an API to ingest/delete data in the DB
-            vpc_subnets=ec2.SubnetSelection(subnet_type=ec2.SubnetType.PUBLIC),
             backup_retention=Duration.days(7),
             deletion_protection=eoapi_settings.stage.lower() == "production",
             removal_policy=RemovalPolicy.SNAPSHOT
             if eoapi_settings.stage.lower() == "production"
             else RemovalPolicy.DESTROY,
-        )
-
-        setup_db = BootstrappedDb(
-            self,
-            "STAC DB for eoapi",
-            db=db,
-            new_dbname=eodb_settings.dbname,
-            new_username=eodb_settings.user,
+            custom_resource_properties={
+                "pgstac_version": eodb_settings.pgstac_version,
+                "context": eodb_settings.context,
+                "mosaic_index": eodb_settings.mosaic_index,
+            },
+            bootstrapper_lambda_function_options={
+                "handler": "handler.handler",
+                "runtime": aws_lambda.Runtime.PYTHON_3_10,
+                "code": aws_lambda.Code.from_docker_build(
+                    path=os.path.abspath(context_dir),
+                    file="infrastructure/aws/dockerfiles/Dockerfile.db",
+                    build_args={
+                        "PYTHON_VERSION": "3.10",
+                        "PGSTAC_VERSION": eodb_settings.pgstac_version,
+                    },
+                    platform="linux/amd64",
+                ),
+                "timeout": Duration.minutes(5),
+                "allow_public_subnet": True,
+                "log_retention": logs.RetentionDays.ONE_WEEK,
+            },
+            pgstac_db_name=eodb_settings.dbname,
+            pgstac_username=eodb_settings.user,
             secrets_prefix=os.path.join(stage, name),
-            pgstac_version=eodb_settings.pgstac_version,
-            enable_context=eodb_settings.context,
-            enable_mosaic_index=eodb_settings.mosaic_index,
-            context_dir=context_dir,
         )
 
+        # allow connections from anywhere to the DB
+        pgstac_db.db.connections.allow_default_port_from_any_ipv4()
+
         CfnOutput(
             self,
             f"{id}-database-secret-arn",
-            value=db.secret.secret_arn,
+            value=pgstac_db.pgstac_secret.secret_arn,
             description="Arn of the SecretsManager instance holding the connection info for Postgres DB",
         )
 
         # eoapi.raster
         if "raster" in eoapi_settings.functions:
+
             db_secrets = {
-                "POSTGRES_HOST": setup_db.secret.secret_value_from_json(
+                "POSTGRES_HOST": pgstac_db.pgstac_secret.secret_value_from_json(
                     "host"
                 ).to_string(),
-                "POSTGRES_DBNAME": setup_db.secret.secret_value_from_json(
+                "POSTGRES_DBNAME": pgstac_db.pgstac_secret.secret_value_from_json(
                     "dbname"
                 ).to_string(),
-                "POSTGRES_USER": setup_db.secret.secret_value_from_json(
+                "POSTGRES_USER": pgstac_db.pgstac_secret.secret_value_from_json(
                     "username"
                 ).to_string(),
-                "POSTGRES_PASS": setup_db.secret.secret_value_from_json(
+                "POSTGRES_PASS": pgstac_db.pgstac_secret.secret_value_from_json(
                     "password"
                 ).to_string(),
-                "POSTGRES_PORT": setup_db.secret.secret_value_from_json(
+                "POSTGRES_PORT": pgstac_db.pgstac_secret.secret_value_from_json(
                     "port"
                 ).to_string(),
             }
@@ -245,76 +159,52 @@ def __init__(  # noqa: C901
             env = eoraster_settings.env or {}
             if "DB_MAX_CONN_SIZE" not in env:
                 env["DB_MAX_CONN_SIZE"] = "1"
+            env.update(db_secrets)
 
-            eoraster_function = aws_lambda.Function(
+            eoraster = TitilerPgstacApiLambda(
                 self,
                 f"{id}-raster-lambda",
-                runtime=aws_lambda.Runtime.PYTHON_3_11,
-                code=aws_lambda.Code.from_docker_build(
-                    path=os.path.abspath(context_dir),
-                    file="infrastructure/aws/dockerfiles/Dockerfile.raster",
-                    build_args={
-                        "PYTHON_VERSION": "3.11",
-                    },
-                    platform="linux/amd64",
-                ),
-                vpc=vpc,
-                vpc_subnets=ec2.SubnetSelection(
-                    subnet_type=ec2.SubnetType.PRIVATE_WITH_EGRESS
-                ),
-                allow_public_subnet=True,
-                handler="handler.handler",
-                memory_size=eoraster_settings.memory,
-                timeout=Duration.seconds(eoraster_settings.timeout),
-                environment=env,
-                log_retention=logs.RetentionDays.ONE_WEEK,
-            )
-            for k, v in db_secrets.items():
-                eoraster_function.add_environment(key=k, value=str(v))
-
-            eoraster_function.add_to_role_policy(
-                iam.PolicyStatement(
-                    actions=["s3:GetObject"],
-                    resources=[
-                        f"arn:aws:s3:::{bucket}/{eoraster_settings.key}"
-                        for bucket in eoraster_settings.buckets
-                    ],
-                )
-            )
-
-            db.connections.allow_from(eoraster_function, port_range=ec2.Port.tcp(5432))
-
-            raster_api = apigw.HttpApi(
-                self,
-                f"{id}-raster-endpoint",
-                default_integration=HttpLambdaIntegration(
-                    f"{id}-raster-integration",
-                    eoraster_function,
-                ),
+                db=pgstac_db.db,
+                db_secret=pgstac_db.pgstac_secret,
+                api_env=env,
+                lambda_function_options={
+                    "code": aws_lambda.Code.from_docker_build(
+                        path=os.path.abspath(context_dir),
+                        file="infrastructure/aws/dockerfiles/Dockerfile.raster",
+                        build_args={
+                            "PYTHON_VERSION": "3.11",
+                        },
+                        platform="linux/amd64",
+                    ),
+                    "allow_public_subnet": True,
+                    "handler": "handler.handler",
+                    "runtime": aws_lambda.Runtime.PYTHON_3_11,
+                    "memory_size": eoraster_settings.memory,
+                    "timeout": Duration.seconds(eoraster_settings.timeout),
+                    "log_retention": logs.RetentionDays.ONE_WEEK,
+                },
+                buckets=eoraster_settings.buckets,
             )
-            CfnOutput(self, "eoAPI-raster", value=raster_api.url.strip("/"))
-
-            setup_db.is_required_by(eoraster_function)
 
         # eoapi.stac
         if "stac" in eoapi_settings.functions:
             db_secrets = {
-                "POSTGRES_HOST_READER": setup_db.secret.secret_value_from_json(
+                "POSTGRES_HOST_READER": pgstac_db.pgstac_secret.secret_value_from_json(
                     "host"
                 ).to_string(),
-                "POSTGRES_HOST_WRITER": setup_db.secret.secret_value_from_json(
+                "POSTGRES_HOST_WRITER": pgstac_db.pgstac_secret.secret_value_from_json(
                     "host"
                 ).to_string(),
-                "POSTGRES_DBNAME": setup_db.secret.secret_value_from_json(
+                "POSTGRES_DBNAME": pgstac_db.pgstac_secret.secret_value_from_json(
                     "dbname"
                 ).to_string(),
-                "POSTGRES_USER": setup_db.secret.secret_value_from_json(
+                "POSTGRES_USER": pgstac_db.pgstac_secret.secret_value_from_json(
                     "username"
                 ).to_string(),
-                "POSTGRES_PASS": setup_db.secret.secret_value_from_json(
+                "POSTGRES_PASS": pgstac_db.pgstac_secret.secret_value_from_json(
                     "password"
                 ).to_string(),
-                "POSTGRES_PORT": setup_db.secret.secret_value_from_json(
+                "POSTGRES_PORT": pgstac_db.pgstac_secret.secret_value_from_json(
                     "port"
                 ).to_string(),
             }
@@ -325,65 +215,82 @@ def __init__(  # noqa: C901
                 env["DB_MAX_CONN_SIZE"] = "1"
             if "DB_MIN_CONN_SIZE" not in env:
                 env["DB_MIN_CONN_SIZE"] = "1"
+            env.update(db_secrets)
+            # If raster is deployed we had the TITILER_ENDPOINT env to add the Proxy extension
+            if "raster" in eoapi_settings.functions:
+                env["TITILER_ENDPOINT"] = eoraster.url.strip("/")
 
-            eostac_function = aws_lambda.Function(
+            eostac = PgStacApiLambda(
                 self,
-                f"{id}-stac-lambda",
-                runtime=aws_lambda.Runtime.PYTHON_3_11,
-                code=aws_lambda.Code.from_docker_build(
-                    path=os.path.abspath(context_dir),
-                    file="infrastructure/aws/dockerfiles/Dockerfile.stac",
-                    build_args={
-                        "PYTHON_VERSION": "3.11",
-                    },
-                    platform="linux/amd64",
-                ),
-                vpc=vpc,
-                handler="handler.handler",
-                memory_size=eostac_settings.memory,
-                timeout=Duration.seconds(eostac_settings.timeout),
-                environment=env,
-                log_retention=logs.RetentionDays.ONE_WEEK,
+                id=f"{id}-stac-lambda",
+                db=pgstac_db.db,
+                db_secret=pgstac_db.pgstac_secret,
+                api_env=env,
+                lambda_function_options={
+                    "runtime": aws_lambda.Runtime.PYTHON_3_11,
+                    "code": aws_lambda.Code.from_docker_build(
+                        path=os.path.abspath(context_dir),
+                        file="infrastructure/aws/dockerfiles/Dockerfile.stac",
+                        build_args={
+                            "PYTHON_VERSION": "3.11",
+                        },
+                        platform="linux/amd64",
+                    ),
+                    "handler": "handler.handler",
+                    "memory_size": eostac_settings.memory,
+                    "timeout": Duration.seconds(eostac_settings.timeout),
+                    "log_retention": logs.RetentionDays.ONE_WEEK,
+                },
             )
-            for k, v in db_secrets.items():
-                eostac_function.add_environment(key=k, value=str(v))
 
-            # If raster is deployed we had the TITILER_ENDPOINT env to add the Proxy extension
-            if "raster" in eoapi_settings.functions:
-                eostac_function.add_environment(
-                    key="TITILER_ENDPOINT", value=raster_api.url.strip("/")
+            if "browser" in eoapi_settings.functions:
+                eobrowser_settings = eoStacBrowserSettings()
+
+                stac_browser_bucket = s3.Bucket(
+                    self,
+                    "stac-browser-bucket",
+                    bucket_name=f"{id.lower()}-stac-browser",
+                    removal_policy=RemovalPolicy.DESTROY,
+                    auto_delete_objects=True,
+                    website_index_document="index.html",
+                    public_read_access=True,
+                    block_public_access=s3.BlockPublicAccess(
+                        block_public_acls=False,
+                        block_public_policy=False,
+                        ignore_public_acls=False,
+                        restrict_public_buckets=False,
+                    ),
+                    object_ownership=s3.ObjectOwnership.OBJECT_WRITER,
                 )
 
-            db.connections.allow_from(eostac_function, port_range=ec2.Port.tcp(5432))
-
-            stac_api = apigw.HttpApi(
-                self,
-                f"{id}-stac-endpoint",
-                default_integration=HttpLambdaIntegration(
-                    f"{id}-stac-integration",
-                    eostac_function,
-                ),
-            )
-            CfnOutput(self, "eoAPI-stac", value=stac_api.url.strip("/"))
+                # need to build this manually, the attribute eostac.url is not resolved yet.
 
-            setup_db.is_required_by(eostac_function)
+                StacBrowser(
+                    self,
+                    "stac-browser",
+                    github_repo_tag=eobrowser_settings.stac_browser_github_tag,
+                    stac_catalog_url=eobrowser_settings.stac_catalog_url,
+                    website_index_document="index.html",
+                    bucket_arn=stac_browser_bucket.bucket_arn,
+                    config_file_path=eobrowser_settings.config_file_path,
+                )
 
         # eoapi.vector
         if "vector" in eoapi_settings.functions:
             db_secrets = {
-                "POSTGRES_HOST": setup_db.secret.secret_value_from_json(
+                "POSTGRES_HOST": pgstac_db.pgstac_secret.secret_value_from_json(
                     "host"
                 ).to_string(),
-                "POSTGRES_DBNAME": setup_db.secret.secret_value_from_json(
+                "POSTGRES_DBNAME": pgstac_db.pgstac_secret.secret_value_from_json(
                     "dbname"
                 ).to_string(),
-                "POSTGRES_USER": setup_db.secret.secret_value_from_json(
+                "POSTGRES_USER": pgstac_db.pgstac_secret.secret_value_from_json(
                     "username"
                 ).to_string(),
-                "POSTGRES_PASS": setup_db.secret.secret_value_from_json(
+                "POSTGRES_PASS": pgstac_db.pgstac_secret.secret_value_from_json(
                     "password"
                 ).to_string(),
-                "POSTGRES_PORT": setup_db.secret.secret_value_from_json(
+                "POSTGRES_PORT": pgstac_db.pgstac_secret.secret_value_from_json(
                     "port"
                 ).to_string(),
             }
@@ -396,41 +303,96 @@ def __init__(  # noqa: C901
             if "DB_MIN_CONN_SIZE" not in env:
                 env["DB_MIN_CONN_SIZE"] = "1"
 
-            eovector_function = aws_lambda.Function(
+            env.update(db_secrets)
+
+            TiPgApiLambda(
                 self,
                 f"{id}-vector-lambda",
-                runtime=aws_lambda.Runtime.PYTHON_3_11,
-                code=aws_lambda.Code.from_docker_build(
-                    path=os.path.abspath(context_dir),
-                    file="infrastructure/aws/dockerfiles/Dockerfile.vector",
-                    build_args={
-                        "PYTHON_VERSION": "3.11",
-                    },
-                    platform="linux/amd64",
-                ),
-                vpc=vpc,
-                handler="handler.handler",
-                memory_size=eovector_settings.memory,
-                timeout=Duration.seconds(eovector_settings.timeout),
-                environment=env,
-                log_retention=logs.RetentionDays.ONE_WEEK,
+                db=pgstac_db.db,
+                db_secret=pgstac_db.pgstac_secret,
+                api_env=env,
+                lambda_function_options={
+                    "runtime": aws_lambda.Runtime.PYTHON_3_11,
+                    "code": aws_lambda.Code.from_docker_build(
+                        path=os.path.abspath(context_dir),
+                        file="infrastructure/aws/dockerfiles/Dockerfile.vector",
+                        build_args={
+                            "PYTHON_VERSION": "3.11",
+                        },
+                        platform="linux/amd64",
+                    ),
+                    "handler": "handler.handler",
+                    "memory_size": eovector_settings.memory,
+                    "timeout": Duration.seconds(eovector_settings.timeout),
+                    "log_retention": logs.RetentionDays.ONE_WEEK,
+                },
             )
-            for k, v in db_secrets.items():
-                eovector_function.add_environment(key=k, value=str(v))
 
-            db.connections.allow_from(eovector_function, port_range=ec2.Port.tcp(5432))
+        if "ingestor" in eoapi_settings.functions:
+
+            data_access_role = self._create_data_access_role()
 
-            vector_api = apigw.HttpApi(
+            stac_ingestor = StacIngestor(
                 self,
-                f"{id}-vector-endpoint",
-                default_integration=HttpLambdaIntegration(
-                    f"{id}-vector-integration",
-                    eovector_function,
-                ),
+                "stac-ingestor",
+                stac_url=eostac.url,
+                stage=eoapi_settings.stage,
+                data_access_role=data_access_role,
+                stac_db_secret=pgstac_db.pgstac_secret,
+                stac_db_security_group=pgstac_db.db.connections.security_groups[0],
+                api_env={"REQUESTER_PAYS": "True"},
+            )
+
+            data_access_role = self._grant_assume_role_with_principal_pattern(
+                data_access_role, stac_ingestor.handler_role.role_name
             )
-            CfnOutput(self, "eoAPI-vector", value=vector_api.url.strip("/"))
 
-            setup_db.is_required_by(eovector_function)
+    def _create_data_access_role(self) -> iam.Role:
+
+        """
+        Creates an IAM role with full S3 read access.
+        """
+
+        data_access_role = iam.Role(
+            self,
+            "data-access-role",
+            assumed_by=iam.ServicePrincipal("lambda.amazonaws.com"),
+        )
+
+        data_access_role.add_managed_policy(
+            iam.ManagedPolicy.from_aws_managed_policy_name("AmazonS3FullAccess")
+        )
+
+        return data_access_role
+
+    def _grant_assume_role_with_principal_pattern(
+        self,
+        role_to_assume: iam.Role,
+        principal_pattern: str,
+        account_id: str = boto3.client("sts").get_caller_identity().get("Account"),
+    ) -> iam.Role:
+        """
+        Grants assume role permissions to the role of the given
+        account with the given name pattern. Default account
+        is the current account.
+        """
+
+        role_to_assume.assume_role_policy.add_statements(
+            iam.PolicyStatement(
+                effect=iam.Effect.ALLOW,
+                principals=[iam.AnyPrincipal()],
+                actions=["sts:AssumeRole"],
+                conditions={
+                    "StringLike": {
+                        "aws:PrincipalArn": [
+                            f"arn:aws:iam::{account_id}:role/{principal_pattern}"
+                        ]
+                    }
+                },
+            )
+        )
+
+        return role_to_assume
 
 
 app = App()
diff --git a/infrastructure/aws/cdk/config.py b/infrastructure/aws/cdk/config.py
index 0450bf9..3e1ab49 100644
--- a/infrastructure/aws/cdk/config.py
+++ b/infrastructure/aws/cdk/config.py
@@ -12,6 +12,8 @@ class functionName(str, Enum):
     stac = "stac"
     raster = "raster"
     vector = "vector"
+    ingestor = "ingestor"
+    browser = "browser"  # not actually a function, but this keeps things clean.
 
 
 class eoAPISettings(BaseSettings):
@@ -42,7 +44,7 @@ class eoDBSettings(BaseSettings):
     instance_size: str = "SMALL"
     context: bool = True
     mosaic_index: bool = True
-
+    allocated_storage: int = 20
     model_config = {
         "env_prefix": "CDK_EOAPI_DB_",
         "env_file": ".env",
@@ -56,7 +58,6 @@ class eoSTACSettings(BaseSettings):
 
     timeout: int = 10
     memory: int = 256
-
     model_config = {
         "env_prefix": "CDK_EOAPI_STAC_",
         "env_file": ".env",
@@ -90,9 +91,6 @@ class eoRasterSettings(BaseSettings):
     # ref: https://docs.aws.amazon.com/AmazonS3/latest/userguide/s3-arn-format.html
     buckets: List = ["*"]
 
-    # S3 key pattern to limit the access to specific items (e.g: "my_data/*.tif")
-    key: str = "*"
-
     timeout: int = 10
     memory: int = 3008
 
@@ -114,3 +112,15 @@ class eoVectorSettings(BaseSettings):
         "env_prefix": "CDK_EOAPI_VECTOR_",
         "env_file": ".env",
     }
+
+
+class eoStacBrowserSettings(BaseSettings):
+    """STAC browser settings"""
+
+    stac_browser_github_tag: None | str = "v3.1.0"
+    stac_catalog_url: None | str = None
+    config_file_path: None | str = "browser_config.js"
+    model_config = {
+        "env_prefix": "CDK_EOAPI_BROWSER_",
+        "env_file": ".env",
+    }
diff --git a/infrastructure/aws/requirements-cdk.txt b/infrastructure/aws/requirements-cdk.txt
index c134c87..867a9f7 100644
--- a/infrastructure/aws/requirements-cdk.txt
+++ b/infrastructure/aws/requirements-cdk.txt
@@ -1,9 +1,10 @@
 # aws cdk
-aws-cdk-lib==2.94.0
-aws_cdk-aws_apigatewayv2_alpha==2.94.0a0
-aws_cdk-aws_apigatewayv2_integrations_alpha==2.94.0a0
+aws-cdk-lib==2.99.1
+aws_cdk-aws_apigatewayv2_alpha==2.99.1a0
+aws_cdk-aws_apigatewayv2_integrations_alpha==2.99.1a0
 constructs>=10.0.0
-
+boto3==1.28.71
 # pydantic settings
 pydantic~=2.0
 pydantic-settings~=2.0
+eoapi-cdk==6.1.0
\ No newline at end of file