Service inventory

The AWS Baseline provisions or configures the AWS services below, grouped by governance, identity, networking, security, evidence and delivery. Most run by default; the ones with a material fixed or per-resource cost are built into the code and switched off until a deployment needs them. Each name below links to its explainer in the AWS services reference.

How the services group

Governance

Service	What the Baseline does with it	Default
AWS Organizations	One Organization, the core and plat OUs, 13 member accounts, trusted access and delegated administrators	On
Service control policies	Three SCPs on both OUs, plus an organization tag policy that reports before it enforces	On
AWS RAM	Shares the Transit Gateway and the IPAM pools with the Organization	On

Identity and access

Service	What the Baseline does with it	Default
IAM Identity Center	All human access: role-based permission sets assigned to groups per account, administered from core-identity	On
IAM	Deployer, state-access, cross-account DNS and parameter roles; no IAM users	On
STS and role assumption	CI chains from its per-repository role into a deployer role in each target account	On

Networking

Service	What the Baseline does with it	Default
Amazon VPC	Hub VPC, four spoke VPCs and a runner VPC, three AZs each, Flow Logs to the audit bucket, S3 gateway endpoints in the spokes	On
VPC IPAM	Pools per organization, region and OU, built from the VPC map	On
AWS Transit Gateway	The hub for every VPC, with one route table per isolation domain; inter-region peering available	On (peering off)
AWS Network Firewall	Stateful egress inspection in the hub VPC	Off
AWS Client VPN	One endpoint for the Organization, SAML sign-in through Identity Center, per-group access	Off
Amazon Route 53	Public apex and per-stage zones, one private zone, DNSSEC and query logging on the apex, prod and staging zones	On
AWS Certificate Manager	Holds the server certificate the Client VPN endpoint presents	With Client VPN

Security

Service	What the Baseline does with it	Default
Amazon GuardDuty	Detector with S3 data events, EKS audit logs and EBS malware protection, delegated to core-security	On
AWS Security Hub	Finding aggregation and product integrations; four standards available	On (standards off)
IAM Access Analyzer	Organization external-access analyzer and an unused-access analyzer	On
Amazon Inspector	EC2, ECR and Lambda vulnerability scanning	Off
Amazon Macie	Sensitive-data discovery in S3	Off
AWS Firewall Manager	Applies one WAF policy to every load balancer in the workload accounts	On
AWS WAF	Four AWS managed rule groups: common threats, known bad inputs, SQL injection, IP reputation	On
AWS Shield	Shield Standard applies automatically; Shield Advanced is built and switched off ($3,000/month)	Advanced off
AWS KMS	Keys for the audit trail, DNSSEC signing and per-stage SOPS secrets	On
Amazon EventBridge	Rules that route findings and start automatic remediation	On
Amazon SNS	The encrypted security alerts topic	On
Systems Manager Parameter Store	Publishes VPC, subnet and account identifiers for the blueprints; Systems Manager Automation blocks public S3 buckets	On

Logging, compliance and observability

Service	What the Baseline does with it	Default
AWS CloudTrail	One multi-region organization trail with log file validation	On
AWS Config	Recorder in every account, organization aggregator, the SOC 2 baseline conformance pack and 28 optional packs	On
Amazon S3	The state bucket, the audit log bucket and shared artifact storage	On
Amazon CloudWatch	Log groups, the seven CIS metric filters and alarms	On
CloudWatch cross-account observability	A sink in core-security, linked from core-root, core-audit, core-network and the workload accounts	On
AWS X-Ray	Traces from linked accounts are shared to the monitoring sink	On

Delivery

Service	What the Baseline does with it	Default
Amazon ECR	Container registries in core-artifacts with immutable tags and lifecycle rules	On
Amazon EC2	Default EBS encryption in every account; ephemeral Spot runner instances when the optional runners are deployed	On (runners optional)
AWS Lambda	The webhook and scaling functions of the self-hosted runners	With runners

The Baseline is written and run with OpenTofu, Terragrunt, GitHub Actions with GitHub OIDC, pre-commit, Checkov, Trivy and tflint and Infracost, which prices each pull request when the INFRACOST_API_KEY secret is set. The pinned versions are on the versions page, and the architecture overview shows where each service sits.