Deployment
Overview

Deployment Overview

lk-wiz is deployed to two isolated AWS accounts — dev and prod — both in eu-central-1. Infrastructure is OpenTofu / Terraform (copebit modules); application code ships as Lambda ZIP packages and container images.

Stacks & order

Infrastructure is split into independent stacks, each with its own Tofu state in s3://tofu-states-${account_id}/tofu_states/<stack>/<stack>_state.json. They apply in dependency order:

account_prep → data → app → mcp → frontend → docs
  • account_prep — foundational account resources (KMS, config/log buckets, budgets, SNS, GuardDuty, and other copebit foundation modules).
  • data — DynamoDB tables and other persistent data resources.
  • app — the application: Lambdas, API Gateway (HTTP + WebSocket), Cognito, EventBridge, Secrets Manager, S3 assets, IAM, CloudWatch.
  • mcp — the AgentCore Gateway + Runtime for the MCP server (container image).
  • frontend — S3 + CloudFront hosting for the Next.js app, ACM, and (dev only) Route53.
  • docs — S3 + CloudFront hosting for this documentation site (see This Docs Site).

How it deploys

  • Atlantis runs plan/apply per stack from merge requests, enforcing the deploy order via depends_on in atlantis.yaml. Applies are manual (a human comments atlantis apply -p <stack>-<stage> after reviewing the plan).
  • GitLab CI builds container images (ECR) and, after the Tofu apply, runs manual deploy jobs that build the Next.js frontend and docs site and sync them to S3 + invalidate CloudFront (see CI/CD).
  • scripts/deploy_hybrid.sh is a hybrid path that pushes, awaits the CI build, applies all dev stacks locally in order, then triggers and awaits the manual deploy jobs — bypassing Atlantis for the apply phase.

See Infrastructure Stacks for stack conventions and CI/CD for the pipeline.

Admin MCP ToolsInfrastructure Stacks