AWS
On AWS, BuiltForProd ships the AWS Enterprise Baseline and three blueprints, all production-ready today. The Baseline is a production-ready AWS foundation engineered around the AWS Well-Architected Framework; the blueprints are working workloads on top of it. Each has a public overview and a full documentation set for customers who hold it.
What ships
| Product | Repositories | Overview |
|---|---|---|
| AWS Enterprise Baseline | acme-aws-platform-baseline | AWS Baseline overview |
| Web App Blueprint | acme-aws-blueprint-webapp-infra, -code, -gitops | Web App Blueprint overview |
| Data and ETL Blueprint | acme-aws-blueprint-etl-infra, -code | Data and ETL Blueprint overview |
| Secrets Blueprint | acme-aws-blueprint-secrets | Secrets Blueprint overview |
The acme prefix is the namespace and changes per customer.
The Baseline on AWS
Fourteen accounts in two organizational units: core holds the management account and nine single-purpose shared accounts (security, audit, identity, network, dns, artifacts, auto, corp, public); plat holds sandbox, dev, staging and prod. A Transit Gateway in the network account connects every spoke VPC to a hub with centralized NAT egress, with prod and nonprod isolation domains. Every security service is delegated to the security account and switched from one file. People sign in through IAM Identity Center; pipelines through GitHub OIDC. The architecture overview has the diagram and the account table; the Baseline product page has the deployment tiers.
The blueprints on AWS
- Web App: EKS with a managed node group plus Karpenter and Cluster Autoscaler, DocumentDB, ElastiCache Redis, the AWS Load Balancer Controller, ExternalDNS, External Secrets Operator, Fluent Bit, ArgoCD, ACM and CloudFront; a Flask API and React front end; a GitOps repository ArgoCD syncs.
- Data and ETL: a zoned S3 data lake, Glue Data Catalog and PySpark job, Lake Formation governance, and a Lambda trigger in a container image.
- Secrets: SOPS-encrypted files per application per stage, KMS keys per stage, and a sync to SSM Parameter Store.
The blueprints page explains how each reads the Baseline through SSM Parameter Store and how to customize it.
AWS services and tools used
The Baseline and blueprints use AWS Organizations, IAM and IAM Identity Center, STS, KMS, S3, CloudTrail, CloudWatch and cross-account observability, AWS Config, GuardDuty, Security Hub, Inspector, Macie, IAM Access Analyzer, Firewall Manager, WAF, Shield, Network Firewall, VPC, IPAM, Transit Gateway, Client VPN, Route 53, ACM, EC2, SSM Parameter Store, ECR, EKS, Elastic Load Balancing, CloudFront, DocumentDB, ElastiCache, Lambda, Glue, Lake Formation, Athena, X-Ray, SNS, EventBridge and RAM. Around them: OpenTofu, Terragrunt, GitHub Actions with OIDC, SOPS, ArgoCD, Helm, Kubernetes, Karpenter, Cluster Autoscaler, the External Secrets Operator, Checkov, Trivy, tflint, Infracost, pre-commit and Docker. The AWS services used index links every one to a short explainer of what it does and where the platform uses it.
Tooling versions
| Tool | Pinned version |
|---|---|
| OpenTofu | 1.12.6 |
| Terragrunt | 1.1.5 |
| AWS provider | ~> 6.65 |
| tflint | v0.64.0 |
Every registry module and every GitHub Action is pinned to an exact version or commit SHA; the release notes list them.
Purchasing
The AWS products are purchased directly from BuiltForProd or through a private offer on AWS Marketplace, which lets you pay with your AWS account under consolidated billing and count the purchase toward AWS spending commitments. The steps are on purchasing and licensing.