Shared responsibility model
Three parties are responsible for a BuiltForProd deployment. AWS runs the cloud. BuiltForProd customizes, deploys and hands over the platform, and operates it only if you buy Managed. Your organization owns the accounts, the identities, the repositories and the operation from the moment of handover. The line does not move unless you move it with a Managed engagement.
The three parties
Responsibility by area
| Area | AWS | BuiltForProd (delivery) | Your organization |
|---|---|---|---|
| The cloud itself | Regions, Availability Zones, hardware, the managed services (EKS control plane, DocumentDB, Glue, KMS and the rest) | Chooses the services and how they are configured | Chooses home region, address plan and which paid switches are on |
| The AWS Organization | Organizations, SCPs and quotas as a service | Creates the Organization, OUs, 13 member accounts, SCPs and tag policy as code | Owns the management account and its root credentials; owns the root mailbox that every account's plus-addressed email lands in; requests the account quota increase |
| Identity | IAM Identity Center as a service | Creates permission sets and group assignments as code | Creates the ACME_* groups in Identity Center or your identity provider, adds and removes people, enforces MFA, runs the quarterly access audit |
| Repositories | GitHub is not AWS | Forks and customizes the repositories, sets every TODO: value, hands them over in your GitHub organization | Owns the GitHub organization, teams, Environments and reviewers; every change after handover |
| Pipelines | STS and OIDC federation | Creates the OIDC provider, deployer roles and workflows | Holds the trust: your GitHub organization is the only identity the deployer roles accept; you approve prod applies |
| Deployment | Applies changes | Executes the initial deployment of the Baseline and any purchased blueprints, in every tier | Every apply after handover runs from your pipelines under your approvals |
| Security services | Runs GuardDuty, Security Hub, Config and the others | Delegates them to the security account and sets the defaults | Triages findings, decides which paid services and standards to switch on, receives the alerts |
| Secrets | KMS and Parameter Store | Creates the per-stage keys and the sync workflow | Owns every secret value; edits them through pull requests to the secrets repository |
| Data | Storage and encryption at rest | Nothing: BuiltForProd never holds customer data | All application and customer data, backups and their restore tests |
| Documentation | AWS documentation | The workbooks and this site | Keeping your fork's documentation in step with your changes |
After handover
At handover the BuiltForProd team has deployed the environment and handed over the customized repositories and the documentation. From then on:
- Human access to your AWS accounts exists only through your IAM Identity Center groups, and only your administrators grant or revoke membership.
- Pipeline access exists only through GitHub OIDC from your GitHub organization; no AWS key was ever created for a person or a pipeline.
- BuiltForProd holds no credentials for your accounts. The privacy and data handling page states the same from the data side.
Your team operates the platform with the roles, code ownership and runbooks described on the Operable page: Platform Leads own the landing zone and approve production changes, DevOps Leads own the pipelines and command incidents, application and data teams own their blueprint repositories, and security auditors hold read-only access with an explicit deny on data.
Under a Managed engagement
BuiltForProd Managed moves part of the operating responsibility back to BuiltForProd, by tier:
| Tier | What BuiltForProd takes on |
|---|---|
| On-Demand | Consultation and support when you ask, by the hour; your team keeps operating |
| Support SLA | The same, under a response commitment defined in your agreement |
| Team Augmentation | Dedicated engineers embedded in your team, part-time or full-time, working inside your repositories, your reviews and your approvals |
Managed engineers work as members of your organization: they sign in through the Identity Center groups you grant, they change the platform through pull requests under your CODEOWNERS rules, and they apply through your pipelines. Access ends when you remove them from the group. What does not move under any tier: ownership of the accounts, the root mailbox, the repositories, the data, and the final approval on production changes.
What AWS is responsible for
AWS is responsible for the security of the cloud: the physical infrastructure, the regions and zones, and the managed services the platform builds on. The platform configures those services (encryption, logging, network boundaries, access) and that configuration is what this documentation describes. The Baseline product page lists what BuiltForProd delivers; the security posture summary lists the controls that configuration puts in place.