AWS services
This page lists the AWS services provisioned by the Terraform code under terraform/ or called by the platform, including optional integrations configured outside the stack. Use it to scope deployment permissions, service control policies, Region availability checks, and cost reviews. For how these services fit together, see Architecture.
Services are grouped by their main role in the platform. Optional features and configuration requirements are noted alongside each service.
| Service | Resources and usage | Notes |
|---|---|---|
| Compute and AI | ||
 AWS Lambda |
Functions, aliases, permissions, asynchronous invoke configuration | API handlers, WebSocket handlers, Cognito triggers, durable orchestrator |
 Amazon ECS with AWS Fargate |
Cluster, service, task definition | Yjs collaboration server |
 Amazon Bedrock AgentCore |
Agent runtime (awscc_bedrockagentcore_runtime) |
Stage executor; capacity providers and workload identities are managed at runtime through IAM |
 Amazon Bedrock |
Model discovery and invocation for Claude Code, OpenCode, and Codex | Bedrock API key or external inference role; see Model invocation |
 Application Auto Scaling |
Scaling target and policies | Yjs worker scaling (yjs_scaling) |
| Data and storage | ||
 Amazon S3 |
Frontend, artifacts, code snapshots, access logs, and build context buckets, with policies, versioning, lifecycle, CORS, and event notifications | |
 Amazon DynamoDB |
Operational state tables | |
 Amazon Neptune |
Cluster, instance, cluster parameter group, subnet group | Graph reads and writes over Gremlin with SigV4 (neptune-db) |
| Networking and delivery | ||
 Amazon VPC |
VPC, public and private subnets, internet gateway, NAT gateway, Elastic IP, route tables, security groups | Gateway VPC endpoints for Amazon S3 and Amazon DynamoDB |
 Elastic Load Balancing |
Internal Application Load Balancer, listener, target group | Fronts the Yjs collaboration server |
 Amazon API Gateway |
|
API Gateway Management API: execute-api:ManageConnections to push application WebSocket events |
 Amazon CloudFront |
Distribution, origin access control, CloudFront Function, VPC origin | VPC origin only when the Yjs server is enabled |
 Amazon Route 53 |
Application, authentication, and certificate validation records | Optional, only when hosted zones are configured |
| Security and identity | ||
 AWS Identity and Access Management |
Roles, inline policies, managed policy attachments | |
 AWS Security Token Service |
Role assumption and caller identity | |
 Amazon Cognito |
User pool, app client, domains, groups, identity providers | Identity providers only for Enterprise SSO |
 AWS WAF |
CloudFront and Regional web ACLs, associations | Optional (enable_waf = true) |
 AWS Certificate Manager |
Certificate issuance, DNS validation, and supplied certificate checks | Optional custom domains; supplied certificates require acm:DescribeCertificate in us-east-1 |
 AWS Key Management Service |
DynamoDB encryption with a customer-managed key | Optional (kms_key_arn); access scoped through kms:ViaService |
 AWS Secrets Manager |
Secrets | Provider OAuth application credentials, GitHub App private key |
 AWS Systems Manager Parameter Store |
SecureString and String parameters |
Agent credentials, provider tokens, realtime and credential-grant secrets |
 Amazon Inspector |
inspector2:ListFindings and inspector2:ListCoverage for managed environment image scan results |
|
| Application integration | ||
 Amazon EventBridge |
Rules and targets | Scheduled maintenance passes and S3 object-created events |
 Amazon SQS |
One dead-letter queue and its queue policy | See Amazon SQS |
| Build and operations | ||
| AWS Cloud Control API | AgentCore runtime lifecycle through Terraform's awscc provider |
Deployment Region; Cloud Control resource and request-status permissions (cloudformation IAM prefix) |
 AWS CodeBuild |
Two projects | Managed environment and managed tool image builds |
 AWS CodeCommit |
Repository, Git, and pull-request operations | Optional; assumed external role in the repository's Region. See CodeCommit setup |
 Amazon Elastic Container Registry |
Repositories and lifecycle policies | AgentCore, Yjs, managed environment, and managed tool images |
Amazon ECR Public |
Authenticated base image pulls during container builds | Uses the deployment identity; see Prerequisites |
 Amazon CloudWatch |
Log groups and metric alarms | Alarms cover Yjs worker capacity, event loop delay, and persistence errors |
| AWS Price List | pricing:GetProducts to convert Bedrock token usage to cost |
ap-south-1 for ap-* deployments; us-east-1 otherwise |
Notes
Amazon Bedrock model invocation
Claude Code, OpenCode, and Codex support two authentication modes. Keys mode uses the Bedrock API key resolved from the credential hierarchy. IAM mode uses temporary credentials for a dedicated external inference role assumed by the credential broker. That role grants Bedrock model access, including Bedrock Mantle for Codex; the AgentCore runtime's own role has no model-invocation permissions or automatic fallback. Kiro uses its own API key in either mode. See Agent authentication and Bedrock IAM setup.
Amazon SQS
The only queue is the dead-letter queue <project_name>-intents-attachment-events-dlq-<environment>. It belongs to the intent attachment promotion flow: an S3 object-created event under intent-attachments/staging/ triggers an EventBridge rule that invokes the intents Lambda. An event lands in the queue when EventBridge cannot deliver it (12 attempts within one hour) or when the Lambda still fails after two retries. No application code reads the queue, and messages expire after 14 days. Inspect it manually when an attachment stays in staging.