Service inventory
The Web App Blueprint deploys seventeen AWS services and eight Kubernetes components into each stage, and relies on three more services in the Baseline's shared accounts. Everything below is created by the blueprint's own code unless the table says it comes from the Baseline.
How the pieces group
AWS services
| Service | What it does in the blueprint |
|---|---|
| EKS | One cluster per stage with a managed node group, access entries, managed add-ons and EKS Pod Identity |
| EC2 | The node group's instances, the instances Karpenter launches, and the security groups for DocumentDB, Redis and runner access |
| Elastic Load Balancing | An internet-facing ALB for the API and an internal one for ArgoCD, created from their Kubernetes Ingress resources |
| DocumentDB | The application database, encrypted, with automated backups and audit log export |
| ElastiCache | A Redis replication group that caches item reads, encrypted at rest and in transit |
| CloudFront | Serves the React app over HTTPS from the private bucket, with client-side routes answered by index.html |
| S3 | A private, versioned bucket per stage for the built front end, readable only by its distribution |
| ACM | Wildcard certificates for the stage's public domain (regional and us-east-1) and its internal domain, validated through DNS |
| Route 53 | Records for the API, the front end, ArgoCD and certificate validation, written into the Baseline's public and private zones |
| IAM | Roles for the in-cluster controllers and the application, and the cluster's OIDC provider |
| STS | Cross-account role assumption for DNS records and for reading shared parameters |
| SSM Parameter Store | Reads the network values the Baseline publishes; publishes data store endpoints, the database password and front end ids for the next layer |
| Secrets Manager | Generates the DocumentDB master password without storing it |
| KMS | Encrypts DocumentDB storage and the password parameter |
| CloudWatch Logs | Application log groups with per-stage retention, EKS control plane logs and DocumentDB audit logs |
| EventBridge | Routes EC2 spot interruption, rebalance and instance-state notices to Karpenter's queue |
| SQS | One queue per cluster, where Karpenter reads those notices and drains the affected node |
Used from the Baseline
| Service | Where it lives | Use |
|---|---|---|
| ECR | Artifacts account | The API image repository, with immutable tags |
| GitHub OIDC | Automation account | Short-lived AWS credentials for every workflow, with no stored keys |
| Firewall Manager | Security account | Attaches the web application firewall policy to the API's load balancer |
Kubernetes components
| Component | Role |
|---|---|
| ArgoCD | Syncs the application's Helm chart from the GitOps repository into the cluster |
| Karpenter | Launches and removes EC2 capacity for the application pods |
| Cluster Autoscaler | Moves the managed node group's desired size between its minimum and maximum |
| AWS Load Balancer Controller | Turns Ingress resources into ALBs |
| ExternalDNS | Two releases: one for the public zone, one for the private zone |
| External Secrets Operator | Copies endpoints and the database password from SSM Parameter Store into a Kubernetes Secret |
| Fluent Bit | Runs on every node and ships container logs to CloudWatch Logs |
| VPC CNI network policy agent | Enforces the application's default-deny NetworkPolicy |
Delivery tooling
The repositories are built with OpenTofu and Terragrunt, the application is packaged as a Docker image and a Helm chart, and every pipeline runs on GitHub Actions. Checkov and Trivy scan the infrastructure code in pre-commit hooks, and Trivy scans every API image before a pull request can merge.
The exact versions of all of these are on the versions page. The full catalog of services across BuiltForProd products is in AWS services used.