Prerequisites

Before the BuiltForProd team deploys the Baseline into your accounts and hands over the repositories, your organization needs to own six things: an AWS management account, a mailbox for root email aliases, a domain, a GitHub organization, the people who will hold the platform roles, and a handful of decisions that cannot be changed cheaply later. This page lists them so handover is not the first time you hear about them.

AWS Organization ownership

The Baseline builds one AWS Organization: a management account plus 13 member accounts created as code. You provide the management account. Two facts about it matter:

• The default Organizations account quota allows fewer accounts than the 13 members, so a quota increase is requested from the management account before the member accounts are created.
• The management account is exempt from service control policies by AWS design, so access to it is limited to Platform Leads through a dedicated permission set. Keep workloads out of it.

Every member account gets a root email of the form aws+acme-core-audit@company.com: plus-addressing onto one team-owned mailbox, so no root access is lost when a person leaves. That mailbox must exist and must be owned by a team, not an individual.

A domain

The Baseline creates public Route 53 zones in the dns account: the apex (company.com) plus prod., staging., dev. and sandbox. subdomain zones. Your registrar delegates the apex to Route 53. The private zone internal.company.com is created in the network account and needs nothing from you. The apex, prod and staging zones are signed with DNSSEC; the apex DS record is published at your registrar. The Route 53 explainer covers the zone layout.

A GitHub organization

The repositories are forked into your GitHub organization (your-github-org) and customized per deployment. CI authenticates to AWS with GitHub OpenID Connect and never holds AWS keys, so the trust is between your GitHub organization and your auto account. You need:

• GitHub Environments named dev, staging and prod on each infrastructure and code repository, with required reviewers on prod;
• GitHub teams that match the CODEOWNERS rules (platform-leads, infra-admins, security-team and, for the secrets repository, developers), so reviews route by blast radius;
• for the Web App Blueprint, a GitHub App (acme-runner) installed on the GitOps repository, which is how deploy pull requests are opened without a personal token.

The GitHub OIDC explainer shows the trust chain.

People and roles

Human access goes only through IAM Identity Center. Groups are created in your identity provider or in Identity Center before the code assigns permission sets to them; the code looks them up by name and never creates users. The group names carry your namespace prefix:

Group	Role	Typical members
ACME_PlatformLeads	Platform Lead: administrator everywhere, production approval, SCP and IAM review	1
ACME_PlatformEngineers	Platform Engineer: PowerUser on core and lower stages, read-only on prod	2 to 3
ACME_DevOpsLeads	DevOps Lead: administrator on the workload accounts, pipeline ownership, incident command	1
ACME_DevOpsEngineers	DevOps Engineer: PowerUser on lower stages, drift and pipeline maintenance	2 to 4
ACME_LeadAppDevelopers, ACME_AppDevelopers	Web application teams	1 to 2, 3 to 8
ACME_LeadETLEngineers, ACME_ETLEngineers	Data engineering teams	1, 2 to 4
ACME_LeadAIEngineers, ACME_AIEngineers	AI and ML teams	1, 2 to 4
ACME_LeadSecurityAuditors, ACME_SecurityAuditors	Read-only audit access with an explicit deny on data (S3 objects, parameters, secrets, log events)	1, 1 to 2

The Team Roles workbook sizes the minimum team at ten people across these roles; the AI roles are optional. MFA is enforced in Identity Center and backed by an SCP. You also nominate a security alert email that receives high-severity findings and CIS alarms.

Decisions to make before the first deployment

Decision	Why it is hard to change
Namespace: a 3 to 4 letter abbreviation (acme)	It prefixes every resource, bucket, role and SSO group name
Home region (us-west-2)	Set once; global singletons and the state bucket key off it
Address plan: the container-optimized /8 map or the compact /11 map	Every address differs between them; switching later means rebuilding the network
Which paid switches start on	Network Firewall, Transit Gateway peering, Inspector, Macie, Shield Advanced, Security Hub standards and Client VPN are off by default, each with its price beside its switch
Which compliance packs run	The SOC 2 baseline pack is on; 28 further packs cover HIPAA, PCI DSS, NIST, CMMC, CIS and more

Tooling

The team that will own the repositories uses the versions the code pins, so local plans match CI:

Tool	Version
OpenTofu	1.12.6
Terragrunt	1.1.5
AWS provider	~> 6.65
tflint	v0.64.0
SOPS	3.13.3

Engineers also need the AWS CLI with SSO profiles, pre-commit for the local guardrail hooks, and the AWS VPN Client if the Client VPN is switched on. The OpenTofu and Terragrunt explainers introduce the two tools.

What BuiltForProd does with these

The BuiltForProd team customizes the base repositories with your namespace, domain, emails, GitHub organization and group ids (every such value is marked TODO: in the code), deploys the environment, and hands over the repositories and the documentation. The Baseline product page lists the three deployment tiers; the shared responsibility model states what is yours from that point on.