BuiltForProd Blueprints
A BuiltForProd Blueprint is an opinionated, production-ready reference architecture for a real-world workload, delivered as repositories and deployed into the workload accounts of the Baseline. The Blueprint gives you the production architecture for the use case; your team builds the application. Three exist today, and each is a working system, not a diagram.
How a blueprint sits on the Baseline
A blueprint never creates what the landing zone owns. It reads VPC ids, CIDRs, subnet ids, the Transit Gateway attachment id and the account id from SSM Parameter Store, published by the Baseline under /acme/usw2/<stage>/..., and it publishes its own outputs (database endpoints, certificate ARNs, CloudFront ids) the same way. Each blueprint has its own deployer role in the auto account that can reach only the workload accounts, its own state prefix in the shared state bucket, and its own plan and apply workflows. Spoke repositories can therefore be planned and applied independently of the landing zone.
The three blueprints
| Blueprint | Repositories | What it deploys per stage |
|---|---|---|
| Web App Blueprint | acme-aws-blueprint-webapp-infra, acme-aws-blueprint-webapp-code, acme-aws-blueprint-webapp-gitops | An EKS cluster with a managed node group, Karpenter and Cluster Autoscaler; DocumentDB and ElastiCache Redis; the AWS Load Balancer Controller, ExternalDNS (public and internal), External Secrets Operator, Fluent Bit and ArgoCD; ACM certificates; a private S3 bucket behind CloudFront for the React front end. The code repository holds a Flask API, its Dockerfile and the build-once, promote-by-tag pipelines; the GitOps repository holds the Helm chart and per-stage values ArgoCD syncs |
| Data and ETL Blueprint | acme-aws-blueprint-etl-infra, acme-aws-blueprint-etl-code | A zoned S3 data lake (raw, processed, curated) with SSE-KMS and versioning; Glue Data Catalog databases per zone; a PySpark Glue job and crawler; Lake Formation governance with LF-Tags; a VPC-attached Lambda trigger that starts the job when a file lands in the raw bucket. The code repository holds the Glue script, the Lambda container and its pipelines |
| Secrets Blueprint | acme-aws-blueprint-secrets | One SOPS-encrypted YAML per application per stage, encrypted with that stage's KMS key from the security account; a validation workflow on pull requests and a sync workflow that writes SSM Parameter Store SecureStrings in the target account on merge. Access is enforced by KMS key policy: leads can use every stage key, engineers only sandbox and dev |
The Web App Blueprint's fourteen units are grouped by the webapp-stage template and the ETL Blueprint's six by etl-stage; each stage file instantiates its template with only the values that differ per stage. Staging and prod run the high-availability layout (multi-AZ data stores, ArgoCD HA, three-node minimum), dev the minimal one.
Delivery inside a blueprint
Application images are built once on merge to main, pushed to ECR in the artifacts account under an immutable main-<short sha> tag, given a vX.Y.Z tag at release, and rolled out by pull request against the GitOps repository: dev and staging merge themselves and ArgoCD auto-syncs; prod is merged by a person and synced manually. The ETL Lambda records the tag it deployed in an SSM parameter the infrastructure reads back. The GitOps and immutable artifacts pages describe the mechanism.
Using a blueprint as-is
Tier 2 of the Baseline includes any two blueprints deployed by the BuiltForProd team; Tier 3 adds a blueprint to an existing Baseline. What you receive is a working system in dev, staging and prod: the web application answers on its public domain behind WAF, the data pipeline processes a file dropped into the raw bucket, the secrets sync writes parameters an application can read. Your teams use it as the reference for their own workloads: the same repository layout, the same pipelines, the same conventions.
Customizing a blueprint
Blueprints are templates, so every deployment-specific value is a tagged setting rather than an assumption in code:
git grep "TODO: "lists what must be set: domains, ECR registry, GitHub variables and secrets, the stage VPC CIDRs mirrored in the chart's NetworkPolicy.git grep "@optional: "lists what may change: node counts, DocumentDB instance count and deletion protection, Redis nodes and multi-AZ, ArgoCD HA and auto-sync, log retention, Glue worker type and count, Lambda memory and timeout, HPA and PDB settings.- Adding a resource follows the module extensibility guide: a module named by resource type that accepts the standard inputs, a unit definition with its dependencies mocked, a
unitblock in the stage template, and a per-stage value in each stage file. Security groups are separate units injected into the resources that use them. - Creating a new blueprint copies the structure of an existing one (the ETL blueprint is the smallest) and registers its deployer role, ECR repositories and Identity Center groups in the landing zone first.
The Baseline page lists the tiers; BuiltForProd Managed is the option when you want BuiltForProd engineers to do the customizing.