Core Application Services
S3 (Simple Storage Service)
Component:s3-bucket/opennext
Purpose: Cache storage bucket for OpenNext static content
| Configuration | Value |
|---|---|
| Access | Private with public access blocked |
| Encryption | AES-256 (SSE-S3) by default, KMS optional |
| Versioning | Disabled |
| Lifecycle | Auto-expire cached objects after 30 days |
s3:ListBucket, s3:GetObject, s3:PutObject, s3:DeleteObject
DynamoDB
Component:dynamodb/opennext
Purpose: Cache metadata table for OpenNext ISR (Incremental Static Regeneration) tag cache
| Configuration | Value |
|---|---|
| Billing Mode | PAY_PER_REQUEST (on-demand) |
| Hash Key | tag (String) |
| Range Key | path (String) |
| TTL Attribute | revalidatedAt |
| Encryption | AWS-owned key by default, CMK optional |
GetItem, PutItem, UpdateItem, DeleteItem, Query, Scan, BatchGetItem, BatchWriteItem
SQS (Simple Queue Service)
Component:sqs-queue/opennext
Purpose: Revalidation queue for OpenNext ISR revalidation notifications
| Configuration | Value |
|---|---|
| Queue Type | Standard |
| Visibility Timeout | 30 seconds |
| Message Retention | 1 day (86,400 seconds) |
| Long Polling | 20 seconds |
| Encryption | SQS-managed SSE |
| Dead Letter Queue | Enabled (max receive count: 3) |
SendMessage, ReceiveMessage, DeleteMessage, GetQueueAttributes, GetQueueUrl, ChangeMessageVisibility
SSM Parameter Store
Component:ssm-parameters/opennext
Purpose: Configuration parameters for OpenNext application
Parameters Stored:
/valinor/CACHE_BUCKET_NAME- S3 bucket name/valinor/CACHE_BUCKET_REGION- S3 bucket region/valinor/CACHE_DYNAMO_TABLE- DynamoDB table name/valinor/REVALIDATION_QUEUE_URL- SQS queue URL/valinor/REVALIDATION_QUEUE_REGION- SQS region
IAM (Identity and Access Management)
Component:iam-role/opennext
Purpose: IRSA (IAM Roles for Service Accounts) for pod identity and access control
| Configuration | Value |
|---|---|
| Trust Policy | EKS OIDC provider federation |
| Service Account | valinor-opennext in valinor namespace |
| Scope | Limited to resources created by bundle |
KMS (Key Management Service)
Usage: Optional encryption for all services Supported On:- S3 buckets (SSE-KMS)
- DynamoDB tables (customer-managed CMK)
- SQS queues (KMS encryption)
- SSM Parameter Store (SecureString parameters)
- EBS volumes (Karpenter node pools)
EKS Infrastructure & Autoscaling
EKS (Elastic Kubernetes Service)
Components:eks/karpenter- Karpenter autoscaler controllereks/karpenter-node-pool- Node pool configurationeks/sysbox-runtime- Sysbox container runtimeeks/sysbox-deployment- Sysbox DaemonSet sample
EC2 (Elastic Compute Cloud)
Usage: Node provisioning via Karpenter Key Permissions:ec2:RunInstances,ec2:CreateFleet,ec2:TerminateInstancesec2:CreateTags,ec2:DeleteTagsec2:DescribeInstances,ec2:DescribeInstanceTypes,ec2:DescribeSpotPriceHistoryec2:DescribeAvailabilityZones,ec2:DescribeSecurityGroups,ec2:DescribeSubnetsec2:DescribeLaunchTemplates
CloudWatch Events (EventBridge)
Purpose: EC2 interruption handling for Karpenter Event Rules:- HealthEvent - AWS Health events
- SpotInterrupt - EC2 Spot Instance Interruption Warnings
- InstanceRebalance - EC2 Instance Rebalance Recommendations
- InstanceStateChange - EC2 Instance State-Change Notifications
ECR (Elastic Container Registry)
Purpose: Container image storage and retrieval VPC Endpoints Required:com.amazonaws.<region>.ecr.api- API endpointcom.amazonaws.<region>.ecr.dkr- Docker Registry V2
State Management
S3 (Terraform State Backend)
Purpose: Remote state storage for infrastructure code| Configuration | Value |
|---|---|
| Bucket Name | {namespace}-{environment}-tfstate |
| Default | test-namespace-usw2-tfstate |
| Region | us-west-2 |
DynamoDB (State Locking)
Purpose: Distributed lock table for Terraform stateEncryption Configuration
| Service | Default | Customer-Managed CMK Support |
|---|---|---|
| S3 | SSE-S3 (AES-256) | Yes (kms_master_key_arn) |
| DynamoDB | AWS-owned key | Yes (server_side_encryption_kms_key_arn) |
| SQS | SQS-managed SSE | Yes (kms_master_key_id) |
| SSM | None (String) | Yes for SecureString (kms_arn) |
| EBS | AWS-managed | Yes (via node pool config) |
Summary
| AWS Service | Component | Purpose | Required |
|---|---|---|---|
| S3 | s3-bucket/opennext | Cache storage | Yes |
| DynamoDB | dynamodb/opennext | Cache metadata | Yes |
| SQS | sqs-queue/opennext | Revalidation queue | Yes |
| SSM Parameter Store | ssm-parameters/opennext | Config management | Yes |
| IAM | iam-role/opennext | Pod identity (IRSA) | Yes |
| KMS | Multi-service | Encryption | No |
| EKS | eks/karpenter* | Autoscaling | Yes |
| EC2 | Karpenter nodes | Compute resources | Yes |
| CloudWatch Events | Karpenter interruption | Event routing | Yes |
| STS | OIDC federation | Token exchange | Yes |
| ECR | Container registry | Image storage | Yes |
| CloudWatch Logs | Application logging | Observability | No |