Release notes
The current release of the BuiltForProd AWS repositories is version 1.0.0, as stated in each repository's README, and its layout is Terragrunt Stacks: every unit is defined once under units/, every account, region or stage is described by a terragrunt.stack.hcl, and Terragrunt generates the deployable tree. This page lists what ships in that release and the exact versions it pins.
What ships
| Repository | Version | Contents |
|---|---|---|
acme-aws-platform-baseline | 1.0.0 | The landing zone: Organization, 14 accounts in two OUs, SCPs and tag policy, hub-and-spoke network with IPAM, security services, identity, GitHub OIDC, state backend, three workflows |
acme-aws-blueprint-webapp-infra | 1.0.0 | Web platform per stage: EKS with Karpenter and Cluster Autoscaler, DocumentDB, ElastiCache, load balancer controller, CloudFront, ArgoCD, External Secrets, Fluent Bit (16 units per stage) |
acme-aws-blueprint-webapp-code | 1.0.0 | Flask API and React frontend, Dockerfile, CI and the three delivery workflows |
acme-aws-blueprint-webapp-gitops | 1.0.0 | Helm chart and per-stage values ArgoCD syncs |
acme-aws-blueprint-etl-infra | 1.0.0 | Data platform per stage: S3 data lake, Lake Formation, Glue, Lambda trigger (6 units per stage) |
acme-aws-blueprint-etl-code | 1.0.0 | Glue job script and Lambda container with CI and CD |
acme-aws-blueprint-secrets | 1.0.0 | SOPS-encrypted secrets per stage, synced to SSM Parameter Store |
The Terragrunt Stacks layout
This release replaces per-account and per-stage unit copies with one definition per unit type and a stack file per folder. Templates group the units a workload account or a stage always has: stacks/plat-account (seven units), stacks/webapp-stage (sixteen), stacks/etl-stage (six); stacks/includes/account-common adds account-baseline to every core account. Terragrunt generates the units into git-ignored .terragrunt-stack/ folders. The generated paths keep the former folder names, so every state key is unchanged by construction, and the migration was verified by rendering all 83, 42 and 18 generated units and comparing them with the former files. scripts/check-stack-layout.py guards the layout in pre-commit and CI, and the plan and apply workflows upload a JSON run report per run. The concept is explained under Terragrunt units and stacks.
Pinned versions
Tools and providers
| Component | Version | Where it is pinned |
|---|---|---|
| OpenTofu | 1.12.6 | root.hcl (>= 1.12.6, < 2.0.0); TF_VERSION in every workflow |
| Terragrunt | 1.1.5 | root.hcl (>= 1.1.5); TG_VERSION in every workflow |
| AWS provider | ~> 6.65 | root.hcl generate "versions", repeated in module versions.tf files that need aliases or extra providers |
| Helm provider | ~> 3.3 | Module versions.tf (web platform) |
| Kubernetes provider | ~> 3.2 | Module versions.tf (web platform) |
| tflint | v0.64.0 | plan.yml (landing zone) |
| tflint AWS ruleset | 0.48.0 | .tflint.hcl |
| SOPS | 3.13.3 | SOPS_VERSION in the secrets workflows |
| GitHub Actions | Commit SHA per action, version in the trailing comment | .github/workflows/*.yml in every repository |
Registry modules
| Module | Version | Where it is used |
|---|---|---|
terraform-aws-modules/vpc/aws | 6.7.3 | units/vpc-hub, units/vpc-spoke, units/vpc-runner; modules/vpc-endpoints submodule (landing zone) |
terraform-aws-modules/transit-gateway/aws | 3.3.1 | units/transit-gateway (landing zone) |
terraform-aws-modules/ecr/aws | 3.2.1 | modules/ecr (landing zone) |
terraform-aws-modules/s3-bucket/aws | 5.16.1 | modules/s3 (landing zone, ETL); modules/frontend-cdn (web platform) |
github-aws-runners | 7.11.0 | modules/github-runner (landing zone) |
terraform-aws-modules/eks/aws | 21.25.1 | modules/eks and its karpenter submodule in modules/karpenter (web platform) |
terraform-aws-modules/eks-pod-identity/aws | 2.9.0 | modules/alb-controller, app-namespace, cluster-autoscaler, external-dns, external-secrets (web platform) |
terraform-aws-modules/elasticache/aws | 1.11.1 | modules/elasticache (web platform) |
terraform-aws-modules/cloudfront/aws | 6.7.1 | modules/frontend-cdn (web platform) |
terraform-aws-modules/lambda/aws | 8.8.2 | modules/lambda (ETL) |
The design decisions record every pin as the latest release as of 2026-09-19. The landing zone pins vpc and transit-gateway in the unit definitions; every other registry module is pinned in the module's main.tf.
Runtime versions set in the units
| Component | Version | Where |
|---|---|---|
| Kubernetes (EKS) | 1.36 | units/eks (web platform) |
| DocumentDB engine | 5.0.0 | units/documentdb |
| ElastiCache Redis engine | 7.1 | units/elasticache |
| Glue | 4.0, PySpark | modules/glue-job (ETL) |
How versions change
Pins are updated one component at a time, planned in dev before staging and prod, with a risk level and an approver per kind of change; see the versioning policy. Layouts and conventions that this release replaced are listed under deprecation notices, and the procedures for already-applied deployments under upgrade guides.