Glossary

The terms below are used the same way on every page of this site and in the repositories. Each definition is one or two sentences with a link to the page that explains the term in full. The key concepts page covers the ten ideas to learn first. The AWS services used page indexes the service explainers.

How the core terms relate

A to D

Account. An AWS account, the hard boundary for access, billing and blast radius. The AWS Baseline creates 14: the management account and 13 member accounts. See landing zones.

Account baseline. The settings every account receives: default EBS encryption, an account-wide S3 public access block, AWS Config recording and the deployer role that pipelines use. See AWS Organizations.

Baseline node group. The EKS managed node group that carries Kubernetes and the system-critical workloads, tainted so that nothing else lands on it and sized by Cluster Autoscaler. Application pods run on Karpenter capacity instead. See EKS.

Blueprint. A production-ready reference architecture for a real workload, delivered as its own repositories and deployed into the platform accounts. Three exist: Web App, Data and ETL, and Secrets. See the blueprints.

Conformance pack. A bundle of AWS Config rules evaluated together against a standard such as CIS, NIST or HIPAA. The Baseline ships the pack files and deploys the ones switched on. See AWS Config.

core OU. The organizational unit that holds shared, single-purpose accounts: security, audit, identity, network, dns, artifacts, auto, corp and public. See landing zones.

Delegated administrator. A member account that AWS Organizations allows to administer a service for the whole organization, so the management account does not have to. The security services are delegated to the security account. See GuardDuty.

Deployer role. The IAM role a pipeline assumes in each account to apply changes. GitHub Actions first assumes a per-repository deployer role in the automation account through OIDC, then the deployer role in the target account. See STS and role assumption.

Drift. A difference between what the code declares and what exists in the account. A scheduled workflow plans the core-critical and active platform accounts Tuesday to Friday and every account on Monday, and reports any difference. See drift.

E to L

Entitlement. The products an organization holds, which decide the documentation sets its members can open. See how to use these docs.

Environment. The region slug a folder deploys to: usw2 for us-west-2, or glob for the global folders that hold organization-wide singletons. See environments and promotion.

Generated tree. The git-ignored .terragrunt-stack/ folder that Terragrunt produces from a stack file. Nothing in it is hand-written. See Terragrunt units and stacks.

GitOps. Keeping the desired state of a system in Git and letting a controller reconcile the running system to it. In the Web App Blueprint the controller is ArgoCD. See GitOps.

Guard script. A small Python check in a repository's scripts/ folder that enforces a layout or configuration rule before merge, such as no hard-coded CIDRs or mocked outputs on every dependency. See policy as code.

Home region. The region that holds the global units and the organization-wide resources. It is set once in common.hcl before the first deployment; the sample is us-west-2. See environments and promotion.

Hub VPC. The VPC in the network account that holds the shared NAT gateways, the Client VPN endpoint and the DNS resolver. Every spoke reaches the internet through it. See hub-and-spoke networking.

Immutable artifact. A build output, such as a container image tag, that is never overwritten. The same artifact moves from dev to prod unchanged. See immutable artifacts.

Isolation domain. A named group of platform stages that share one Transit Gateway route table. Two domain tables never learn each other's routes and each blackholes the other's address ranges, so cross-domain traffic is dropped at the Transit Gateway; every spoke reaches the hub and the runner VPC. See hub-and-spoke networking.

Landing zone. The multi-account foundation applications run on: accounts, network, security services, identity, and the delivery machinery that manages them. The AWS Baseline is a landing zone. See landing zones.

Least privilege. Granting each person and pipeline only the access its job needs, and narrowing it toward production. See least privilege.

M to R

Management account. The account that owns the AWS Organization and billing. The Baseline calls it core-root and keeps workloads out of it. See AWS Organizations.

Mock outputs. Placeholder values a unit declares for each dependency, so a new environment can be planned end to end before its dependencies exist. See Terragrunt.

Module. An OpenTofu module: a folder of resources with inputs and outputs. A unit instantiates one module. See OpenTofu.

Namespace. The short organization abbreviation that starts every resource name, such as acme in acme-usw2-prd-vpc. See how to use these docs.

Permission set. An IAM Identity Center template that becomes an IAM role in each account it is assigned to. People sign in through permission sets, never as IAM users. See IAM Identity Center.

Placeholder value. A sample such as acme, company.com or 111111111111 that stands for a value your organization sets. Signed-in readers see their own values. See how to use these docs.

plat OU. The organizational unit that holds one workload account per stage: sandbox, dev, staging and prod. See landing zones.

Promotion. Moving a change from dev through staging to prod without rebuilding it. See environments and promotion.

Remediation. An automated response to a finding. The Baseline blocks public access on an S3 bucket that becomes public outside the public account. See EventBridge.

S to Z

Service control policy (SCP). An AWS Organizations policy that sets the maximum permissions for every identity in the accounts it is attached to. The Baseline attaches three. See service control policies.

SSM parameter. A value in Systems Manager Parameter Store. The landing zone publishes VPC, subnet, Transit Gateway attachment and account values under /acme/<environment>/<stage>/ and the blueprints read them. See Systems Manager Parameter Store.

Spoke VPC. A workload VPC in a platform account, attached to the Transit Gateway and reaching the internet through the hub. See VPC.

Stack file. A terragrunt.stack.hcl file in an environment folder that lists the units the folder deploys and their values. See Terragrunt units and stacks.

Stage. The role of a workload account and its short code: sbx, dev, stg and prd. See environments and promotion.

State file. The record OpenTofu keeps of what it created for one unit. State lives in an S3 bucket in the management account. See OpenTofu and Terraform.

Template. A reusable stack under stacks/ that a stack file includes, such as plat-account for every platform account. See Terragrunt units and stacks.

Unit. One deployable module instance with one state file, defined once in units/<unit>/terragrunt.hcl. See Terragrunt units and stacks.

Values. The per-instance inputs a stack file passes to a unit, so one unit definition serves every account that lists it. See Terragrunt units and stacks.