The Web App Blueprint pins the same tools as the AWS Baseline (OpenTofu 1.12.6, Terragrunt 1.1.5, AWS provider ~> 6.65) and runs EKS 1.36, DocumentDB 5.0.0 and Redis 7.1. Every registry module, Helm chart and GitHub Action is pinned to an exact version in the code, so a plan or a build means the same thing on every machine.
Where the pins live
root.hcl pins OpenTofu and the AWS provider for every unit. Modules that also need the Helm or Kubernetes provider carry their own version file that repeats the same AWS pin; a guard script checks this in pre-commit and in the plan workflow.
| Component | Version |
|---|
| OpenTofu | 1.12.6 |
| Terragrunt | 1.1.5 |
| AWS provider | ~> 6.65 |
| Helm provider | ~> 3.3 |
| Kubernetes provider | ~> 3.2 |
| Component | Version |
|---|
| Kubernetes on EKS | 1.36 |
| DocumentDB engine | 5.0.0 |
| ElastiCache Redis | 7.1 |
| EKS managed add-ons | Most recent: vpc-cni, kube-proxy, coredns, eks-pod-identity-agent, metrics-server |
Registry modules
| Module | Version | Used for |
|---|
terraform-aws-modules/eks/aws | 21.25.1 | The EKS cluster and its node group |
terraform-aws-modules/eks/aws//modules/karpenter | 21.25.1 | Karpenter's IAM roles, access entry and interruption queue |
terraform-aws-modules/eks-pod-identity/aws | 2.9.0 | Pod Identity roles for the controllers and the application |
terraform-aws-modules/elasticache/aws | 1.11.1 | The Redis replication group |
terraform-aws-modules/s3-bucket/aws | 5.16.1 | The front end bucket |
terraform-aws-modules/cloudfront/aws | 6.7.1 | The front end distribution |
Helm charts
| Chart | Version |
|---|
aws-load-balancer-controller | 3.4.0 |
external-dns | 1.21.1 |
external-secrets | 2.6.0 |
argo-cd | 9.5.22 |
aws-for-fluent-bit | 0.2.0 |
karpenter | 1.14.1 |
cluster-autoscaler | 9.59.0 |
blueprint-app (the application chart) | 0.1.0, app version 1.0.0 |
Application runtime
| Component | Version |
|---|
| Base image | python:3.12-slim |
| Python libraries (minimum) | Flask 3.1.3, flask-cors 6.0.5, Gunicorn 26.0.0, PyMongo 4.17.0, redis 8.0.0 |
| Front end | React ^19.2.7, React Router ^7.17.0, axios ^1.17.0, Vite ^8.0.16, TypeScript ^6.0.3 |
| Node.js in the build | 22 |
GitHub Actions
| Action | Version |
|---|
actions/checkout | v7.0.1 |
actions/setup-python | v7.0.0 |
actions/setup-node | v7.0.0 |
aws-actions/configure-aws-credentials | v6.3.0 |
aws-actions/amazon-ecr-login | v2.1.7 |
docker/build-push-action | v7.4.0 |
actions/create-github-app-token | v3.2.0 |
aquasecurity/trivy-action | v0.36.0 |
opentofu/setup-opentofu | v2.0.2 |
gruntwork-io/terragrunt-action | v3.4.1 |
actions/upload-artifact | v7.0.1 |
actions/github-script | v9.0.0 |
Each is referenced by its full commit SHA with the version in a comment, so a moved tag cannot change what runs.
How versions change
A version change is its own pull request. For the infrastructure it is planned against all three stages before it merges; for the application it goes through the normal build and promotion path. The policy is on the versioning policy page, and the versions across all BuiltForProd repositories are in the release notes.