AWS services used
This page lists every AWS service and every tool the platform uses, with a link to the explainer for each. Each explainer says what the service does in general and then exactly how BuiltForProd uses it: which account runs it, which unit or module creates it, and what it is connected to.
The Used in column names the product whose repositories create or configure the service. "All four products" means the AWS Baseline and the Web App, Data and ETL, and Secrets blueprints. Services that are switched off by default, such as Inspector, Macie and Network Firewall, are listed because the code for them ships and one setting turns them on.
How the areas fit together
Identity comes first because every other service is reached through a role. The network carries the workloads, the security services watch everything, and the delivery tooling is the only path by which any of it changes. The architecture overview shows the same pieces laid out across the 14 accounts.
Accounts and identity
Who and what can act in each account, and how credentials are issued.
| Service | What the page covers | Used in |
|---|---|---|
| AWS Organizations | How the AWS Baseline uses AWS Organizations to create 14 accounts in two organizational units and attach policies to them. | AWS Baseline |
| Service Control Policies | The three service control policies the AWS Baseline attaches to its organizational units, and what each one blocks. | AWS Baseline |
| IAM | How AWS Identity and Access Management is used in the platform: no IAM users, purpose-built roles, and where each role lives. | All four products |
| IAM Identity Center | How people sign in to the AWS accounts through IAM Identity Center, the eleven permission sets, and how access narrows toward production. | AWS Baseline |
| STS and Role Assumption | How the platform obtains temporary credentials with AWS STS, and the role chain that carries a pipeline from GitHub into each account. | All four products |
| GitHub OIDC | How GitHub Actions workflows obtain AWS credentials through OpenID Connect federation and per-repository deployer roles, with no stored keys. | All four products |
| RAM | How AWS Resource Access Manager shares the Transit Gateway and IPAM pools from the network account with the whole organization. | AWS Baseline |
Security and threat detection
The detective, preventive and responsive controls, and the keys that encrypt data.
| Service | What the page covers | Used in |
|---|---|---|
| GuardDuty | How GuardDuty is delegated to the security account, which detection features are on, and where high-severity findings go. | AWS Baseline |
| Security Hub | How Security Hub collects findings from every security service into the security account, which standards are available, and what is automated. | AWS Baseline |
| Inspector | What Amazon Inspector scans for, how the platform wires it to the security account, and why it is switched off by default. | AWS Baseline |
| Macie | What Amazon Macie discovers in S3, how the platform delegates it to the security account, and the cost that keeps it off by default. | AWS Baseline |
| Access Analyzer | How IAM Access Analyzer finds resources shared outside the organization and roles nobody uses, and which account runs each analyzer. | AWS Baseline |
| Firewall Manager | How AWS Firewall Manager attaches a baseline WAF policy to every application load balancer in the workload accounts without per-team setup. | AWS Baseline |
| WAF | What AWS WAF inspects on the platform, the four managed rule groups in the baseline web ACL, and how it reaches every load balancer. | AWS Baseline |
| Shield | The difference between Shield Standard and Shield Advanced, what the platform relies on, and the switch that turns Shield Advanced on. | AWS Baseline |
| Network Firewall | How AWS Network Firewall inspects all outbound traffic from the hub VPC when it is switched on, what the stateful policy allows, and what it costs. | AWS Baseline |
| KMS | Which encryption keys the platform creates in AWS Key Management Service, where AWS-managed keys are used instead, and why. | AWS Baseline, Secrets Blueprint |
| EventBridge | How the AWS Baseline uses EventBridge rules in the security account to alert on findings and auto-block public S3 buckets. | AWS Baseline |
Audit, logging and observability
Where every API call, configuration change, log line, metric and trace ends up.
| Service | What the page covers | Used in |
|---|---|---|
| CloudTrail | How the organization CloudTrail records every API call in every account, where the logs go, and what protects them from tampering. | AWS Baseline |
| AWS Config | How AWS Config records every resource change in every account, aggregates the history in the audit account, and evaluates conformance packs. | AWS Baseline |
| CloudWatch | Where the platform sends logs and metrics in Amazon CloudWatch, how long each log group is kept, and which alarms exist. | AWS Baseline, Web App Blueprint, Data and ETL Blueprint |
| CloudWatch OAM | How CloudWatch OAM gives the security account one view of logs, metrics and traces from the management, audit, network and workload accounts. | AWS Baseline |
| X-Ray | How AWS X-Ray traces the ETL trigger Lambda and how traces are shared with the security account through CloudWatch OAM. | Data and ETL Blueprint |
| SNS | How the AWS Baseline delivers security alerts through one SNS topic fed by EventBridge rules and CIS alarms. | AWS Baseline |
| Fluent Bit | How Fluent Bit ships container logs from every EKS node to one CloudWatch log group per stage, with retention set per stage. | Web App Blueprint |
Networking and DNS
How traffic moves between VPCs, to the internet and to remote engineers, and how names resolve.
| Service | What the page covers | Used in |
|---|---|---|
| VPC | The three kinds of VPC the AWS Baseline creates, their subnet tiers, where internet access exists, and where every CIDR comes from. | AWS Baseline |
| IPAM | How Amazon VPC IP Address Manager records the address plan for the whole organization, and how one file feeds every VPC its CIDR. | AWS Baseline |
| Transit Gateway | How one Transit Gateway connects every VPC, routes all private egress through the hub, and gives production and non-production separate route tables. | AWS Baseline |
| Client VPN | How the single AWS Client VPN endpoint gives remote engineers access to private networks, authenticated by Identity Center and scoped per group. | AWS Baseline |
| Easy-RSA and the AWS VPN client | How the Client VPN server certificate is produced with Easy-RSA and how engineers connect with the AWS VPN client and single sign-on. | AWS Baseline |
| Route 53 | How the platform lays out public and private DNS in Route 53, which zones are signed and logged, and how workload accounts write records. | AWS Baseline, Web App Blueprint |
| ACM | How AWS Certificate Manager issues and renews the TLS certificates behind every load balancer, CloudFront distribution and the Client VPN. | AWS Baseline, Web App Blueprint |
| Elastic Load Balancing | How an internet-facing Application Load Balancer fronts the Web App Blueprint API and an internal one fronts ArgoCD, and who creates them. | Web App Blueprint |
| CloudFront | How the Web App Blueprint serves its React front end from a private S3 bucket through CloudFront. | Web App Blueprint |
Compute, containers and data
What runs the workloads and where their data lives.
| Service | What the page covers | Used in |
|---|---|---|
| EC2 | Where virtual machines appear in the platform: EKS worker nodes and optional CI runners, plus the account-wide EC2 settings the Baseline enforces. | AWS Baseline, Web App Blueprint |
| EKS | What Amazon EKS is and how the Web App Blueprint runs one managed Kubernetes cluster per stage on it. | Web App Blueprint |
| Kubernetes | What runs inside the Web App Blueprint EKS cluster and how the application pods are hardened, scaled and isolated. | Web App Blueprint |
| Helm | What Helm is, how the Web App Blueprint chart is structured, and which cluster add-ons are installed as Helm releases. | Web App Blueprint |
| Karpenter | How Karpenter launches EC2 capacity for the Web App Blueprint application pods, which instances it may buy and what caps the bill. | Web App Blueprint |
| Cluster Autoscaler | How Cluster Autoscaler moves the EKS managed node group between its per-stage bounds and why it never contends with Karpenter. | Web App Blueprint |
| AWS Load Balancer Controller | How the AWS Load Balancer Controller creates Application Load Balancers from Kubernetes Ingress objects in the Web App Blueprint. | Web App Blueprint |
| ExternalDNS | How two ExternalDNS releases write public and private Route 53 records for Web App Blueprint Ingresses across accounts. | Web App Blueprint |
| Lambda | How the Data and ETL Blueprint uses a container-based Lambda function to start Glue jobs when raw files land in S3. | Data and ETL Blueprint |
| DocumentDB | How the Web App Blueprint runs its MongoDB-compatible database on DocumentDB and hands the password to the application. | Web App Blueprint |
| ElastiCache | How the Web App Blueprint runs a Redis replication group on ElastiCache and publishes its endpoint for the application. | Web App Blueprint |
| S3 | Every S3 bucket the platform creates, what it holds, and the controls applied to all of them: encryption, versioning, lifecycle and no public access. | AWS Baseline, Web App Blueprint, Data and ETL Blueprint |
| Glue | How the Data and ETL Blueprint uses Glue Data Catalog databases, a PySpark job and a crawler to move data from raw to processed. | Data and ETL Blueprint |
| Lake Formation | How the Data and ETL Blueprint governs data lake access with Lake Formation instead of S3 bucket policies alone. | Data and ETL Blueprint |
| Athena | What Athena is and how it queries the Data and ETL Blueprint data lake through the Glue Data Catalog and Lake Formation. | Data and ETL Blueprint |
Secrets and configuration
How values and secrets travel from Git and the landing zone to the applications.
| Service | What the page covers | Used in |
|---|---|---|
| Systems Manager Parameter Store | How Parameter Store carries values between the landing zone, the blueprints and Kubernetes: the path convention, who writes, and who reads. | All four products |
| Secrets Manager | What AWS Secrets Manager is, why the platform keeps its secrets in Parameter Store instead, and the few places Secrets Manager still appears. | Web App Blueprint |
| SOPS | How the Secrets Blueprint keeps application secrets encrypted in Git with SOPS and per-stage KMS keys, then syncs them to Parameter Store. | Secrets Blueprint |
| External Secrets Operator | How the External Secrets Operator turns Parameter Store values into Kubernetes Secrets for the Web App Blueprint. | Web App Blueprint |
Delivery and tooling
The tools that turn a pull request into a planned, scanned and applied change.
| Service | What the page covers | Used in |
|---|---|---|
| OpenTofu | What OpenTofu is, which version the platform pins, and how modules, providers and state are organized around it. | AWS Baseline, Web App Blueprint, Data and ETL Blueprint |
| Terragrunt | What Terragrunt adds on top of OpenTofu and how the Stacks layout of units, templates and stage files works in every repository. | AWS Baseline, Web App Blueprint, Data and ETL Blueprint |
| GitHub Actions | How every repository plans, applies, builds, scans and promotes through GitHub Actions workflows, with optional self-hosted runners. | All four products |
| ArgoCD | How ArgoCD in each EKS cluster syncs the Web App Blueprint Helm chart from the GitOps repository, automatically in dev and staging and by hand in prod. | Web App Blueprint |
| Docker | How the blueprint applications are built as container images, hardened in the Dockerfile, scanned, and pushed to ECR under immutable tags. | Web App Blueprint, Data and ETL Blueprint |
| ECR | How Amazon Elastic Container Registry holds the platform's container images with immutable tags, scanning, encryption and cross-account pull access. | AWS Baseline, Web App Blueprint, Data and ETL Blueprint |
| Checkov, Trivy and tflint | Which static scanners run on the infrastructure code and container images, where they run, and how findings are suppressed with a reason. | AWS Baseline, Web App Blueprint, Data and ETL Blueprint |
| pre-commit | Which pre-commit hooks run in each repository, from formatters and scanners to the guard scripts that keep the Terragrunt layout consistent. | AWS Baseline, Web App Blueprint, Data and ETL Blueprint |
| Infracost | What Infracost is and how the AWS Baseline plan workflow prices a change and posts one cost comment on the pull request. | AWS Baseline |
Purchasing
How the products are bought.
| Service | What the page covers | Used in |
|---|---|---|
| AWS Marketplace | What AWS Marketplace is and how a customer buys the BuiltForProd Baseline and Blueprints through a private offer. | Purchasing |
Terms used on these pages
The explainers use a small vocabulary consistently: account, organizational unit, unit, stack, permission set, delegated administrator and a few more. The glossary defines each one. The security posture summary reads the security rows of this page as one control set.