Infrastructure / AWS
Blueprint
AWS: Containers that scale to zero on AWS
How each member of the cast is served by AWS: agents run as containers that exist only while they work, behind a load balancer, with state in object storage.
| Cast member | What serves it on AWS |
|---|---|
| Gatekeeper | Application Load Balancer in front of the container services for ingress and egress; VPC with security groups and private endpoints |
| Keymaster | AWS Secrets Manager |
| Executive | Amazon Bedrock |
| Landlord | Amazon ECS on Fargate, one task definition per agent, Amazon ECR for images, Amazon S3 bucket for agent memory, an IAM role per agent |
| Auditor | Amazon S3 with Object Lock for sealed ledger checkpoints |
| Treasurer | AWS Cost Explorer and the ECS inventory, through a read-only IAM role |
| Bouncer | No provider service. Runs inside the control plane; identity comes from your OIDC provider |
| Timekeeper | No provider service. A one-minute clock inside the control plane |
| Registrar | AWS CodeBuild for agent builds and skill checks, Amazon ECR, a versioned S3 bucket for configuration |
| Inspector | Amazon EventBridge for the event bus, OpenTelemetry for metrics and traces |