BuiltForProd Baseline
BuiltForProd Baseline is a ready-to-deploy, multi-account cloud foundation written in OpenTofu and Terragrunt. The BuiltForProd team customizes it from the base repositories, deploys it into your accounts, and hands over the repositories and the documentation. From that point it is yours: infrastructure as code in your own Git organization and your own accounts, ready for workloads and ready to grow to more accounts, regions and environments.
What it is
The Baseline is the starting point for building production the right way, and the organization standard every later environment is based on. On AWS it is one repository, acme-aws-platform-baseline, that defines:
- the AWS Organization, two organizational units and 14 accounts, with service control policies and a tag policy;
- hub-and-spoke networking: IPAM, a hub VPC with centralized egress, a Transit Gateway with isolation domains, a spoke VPC per workload account, private DNS and a Client VPN endpoint;
- security services delegated to a security account, an organization CloudTrail, a log archive and AWS Config conformance packs;
- IAM Identity Center for people and GitHub OIDC for pipelines;
- the state backend and the plan, apply and drift-detection workflows.
The offerings note lists the capabilities as a fully automated CI/CD GitOps workflow with self-hosted runners and OIDC federation; multi-region scaling with a hub-and-spoke VPC architecture, Transit Gateway routing and IPAM; centrally managed IAM Identity Center and Client VPN; compliance readiness for SOC 2, HIPAA, PCI DSS 4.0, CMMC, NIST CSF and the CIS AWS Foundations Benchmark; and centralized audit, logging, compliance monitoring and drift detection. The architecture overview draws it; the AWS Baseline overview opens the full set.
What a customer receives
| Deliverable | Contents |
|---|---|
| Repositories | The landing-zone repository, customized with your namespace, domain, root emails, GitHub organization and SSO group ids, in your GitHub organization. With Tier 2, the blueprint repositories as well |
| A deployed environment | The 14 accounts, the network, the security services, identity and the pipelines, applied by the BuiltForProd team and handed over working |
| Documentation | Architecture decision records, how-to guides, troubleshooting manuals, FAQs and scaling best practices: the deployment workbooks, plus access to this site for your organization |
Every value that had to be set for your deployment carries a TODO: comment in the code and every optional choice an @optional: comment, so your team can find both at any time.
The three deployment tiers
| Tier | Name | What it includes |
|---|---|---|
| 1 | Standard Deployment | The complete multi-account environment set up by the BuiltForProd team; full handover of the customized repositories and infrastructure code; the extensive documentation handover |
| 2 | Full Deployment with Blueprints | Everything in Tier 1 plus any two blueprints: the Web App Blueprint (a fully deployed working web application, front end and back end, mapped to the infrastructure), the Data and ETL Blueprint (a complete data engineering environment with working pipelines and a data lake), or the Secrets Blueprint (SOPS and AWS KMS to SSM Parameter Store). The purpose is a tangible, working reference architecture that guides your teams' own workload deployments |
| 3 | Blueprint Deployment | For existing customers who already run the Baseline and want an additional blueprint deployed |
Every tier is fully executed by the BuiltForProd team. Blueprints are described on the blueprints page; purchase paths and the license are on purchasing and licensing.
Clouds
| Cloud | Status |
|---|---|
| AWS Enterprise Baseline | Production-ready today, with three blueprints |
| Azure Enterprise Baseline | Next phase |
| GCP Enterprise Baseline | Next phase |
Why a baseline rather than a build
Every engineering team eventually solves the same problems: how to structure cloud accounts, manage environments, secure access, deploy reliably, handle secrets, monitor everything, recover from failure and satisfy an audit. The Baseline is those answers, already made and already reviewed, measured against the BuiltForProd Standard. Your competitive advantage is your application, not your VPC design.