AWS system map

Canonical live AWS inventory for Drape, taken 2026-09-17 against account 230790682930. Workloads are concentrated in us-east-1. Other US regions (us-east-2, us-west-1, us-west-2) have a default VPC only — no Amplify, ECS, ELB, RDS, ECR, Lambda, or Secrets Manager apps.

This page is the evidence map. The readable topology is Infrastructure. Deploy mechanics are Web deploys and Backend deploys.

Evidence classes

LIVE — returned by AWS APIs in this inventory. DOCS-SUPPORTED — recorded in Drape-Docs (cutover, READMEs, workflows) but not re-proven by reading secret values. STALE — contradicted by live APIs. UNKNOWN — API did not settle it. LEGACY CANDIDATE — present, likely leftover; not approved for deletion.

No secret values, passwords, connection strings, or API keys are recorded here. DATABASE_URL → RDS host mapping is DOCS-SUPPORTED from the prod cutover and backend READMEs — Stage 2A did not read secret payloads.

Account and regions

Item	Value	Class
Account	230790682930	LIVE
Primary region	us-east-1	LIVE
Other US regions	Default VPC only; empty of Drape apps	LIVE

Live architecture (us-east-1)

ECS → RDS arrows are docs-supported (cutover + README), not proven by reading secret contents. drape-postgres is probable DEV, not API-verified. Legacy drape-postgres-prod is omitted here and is not approved for deletion. ALB host routing is LIVE.

Cluster name is drape. drape-prod and drape-dev are services on that cluster, not cluster names.

Public web — Amplify

All four apps are in us-east-1. Git connections on Amplify are the org (https://github.com/drape-ai-llc/...), not KCB1099/*.

App	App ID	Platform	Git repo (Amplify)	Default domain	Custom domain
Drape-Marketing	d25a3s1rbghls0	WEB_COMPUTE	drape-ai-llc/drape-marketing	d25a3s1rbghls0.amplifyapp.com	drape.to + www on main; also branch develop
Drape-brand	du0asj4lh5zwr	WEB_COMPUTE	drape-ai-llc/drape-brand	du0asj4lh5zwr.amplifyapp.com	brand + *.drape.to
Drape-admin-v1	d2pa8ox8j0q7ch	WEB_COMPUTE	drape-ai-llc/drape-admin-v1	d2pa8ox8j0q7ch.amplifyapp.com	admin.drape.to
Drape-Docs	d2ip1x1ygwzne5	WEB	drape-ai-llc/drape-docs	d2ip1x1ygwzne5.amplifyapp.com	docs.drape.to LIVE (not amplifyapp-only)

Amplify domain-association notes (metadata, not DNS):

• Marketing apex verified=false, www verified=true.
• Brand + wildcard both verified=false even though Route 53 CNAMEs match and domainStatus is AVAILABLE. Treat this as an Amplify console quirk, not as “wildcard DNS is missing.”
• Admin and docs verified=true.

STALE: older docs claimed Amplify Git connect to KCB1099/* and that this docs site was amplifyapp-only / manual-deploy only.

CloudFront

Amplify-managed CloudFront hostnames are LIVE via Route 53 + Amplify domain associations:

Hostname	Fronts
dr97vmdco0hao.cloudfront.net	drape.to / www
d2yv7dj5tfi9vi.cloudfront.net	brand.drape.to and *.drape.to
d21ssgtyd9wiv8.cloudfront.net	admin.drape.to
d1p7il2uis0gn.cloudfront.net	docs.drape.to

ListDistributions in this account returned empty (not AccessDenied). Amplify abstracts CloudFront distribution IDs; do not treat “no distributions listed” as “no CloudFront.”

DNS — Route 53

Hosted zone drape.to. / Z00780563EFBECXPWSBK4 — LIVE. There is a Route 53 zone in this account.

Record	Target	Class
Apex A	alias → dr97vmdco0hao.cloudfront.net	LIVE
www	CNAME → same CloudFront hostname	LIVE
brand	CNAME → d2yv7dj5tfi9vi.cloudfront.net	LIVE
*.drape.to	CNAME → same brand CloudFront hostname	LIVE
admin	CNAME → d21ssgtyd9wiv8.cloudfront.net	LIVE
docs	CNAME → d1p7il2uis0gn.cloudfront.net	LIVE
api	A alias → drape-alb-1305867817.us-east-1.elb.amazonaws.com	LIVE
dev-api	A alias → same ALB	LIVE

STALE: pages that say “No Route 53 / external DNS only.”

staging.drape.to is not in this zone map. Dev API is dev-api.drape.to.

API path — ALB → ECS Fargate → RDS

Layer	Resource	Notes	Class
ALB	drape-alb / drape-alb-1305867817.us-east-1.elb.amazonaws.com / VPC vpc-0eb9cce93e675877f	internet-facing, active	LIVE
Listener :80	default → drape-dev-tg; host api.drape.to → drape-prod-tg		LIVE
Listener :443	ACM cert for api + dev-api; same host rules		LIVE
TG prod	drape-prod-tg :8000 healthy		LIVE
TG dev	drape-dev-tg :8000 healthy		LIVE
ECS cluster	drape	not named drape-prod	LIVE
ECS service prod	drape-prod Fargate, desired/running 1; public IP ENABLED; no NAT	task def drape-prod:10 at inventory time	LIVE
ECS service dev	drape-dev Fargate, desired/running 1	task def drape-dev:22 at inventory time	LIVE
ECR	drape-backend-postgres	tags include prod / dev	LIVE
VPC	default VPC vpc-0eb9cce93e675877f 172.31.0.0/16	no custom VPC	LIVE
NAT	none	matches ADR-0002	LIVE

Backend code: Drape-AI-LLC/Drape- path backend-postgres/. develop auto-deploys ECS drape-dev; prod is workflow_dispatch onto drape-prod. DOCS-SUPPORTED from repo workflows, consistent with live ECR tags and services.

Default ALB action sends unmatched Host headers to dev. Only api.drape.to is pinned to prod.

RDS classifications (do not approve deletion)

Three PostgreSQL 16.13 instances exist. Do not delete any of them from this inventory.

Instance	Exposure	Class	Evidence
drape-postgres-prod-live	db.t4g.small, private	ACTIVE PROD	Cutover record. Host not secret-read proven.
drape-postgres	db.t4g.micro, public	probable ACTIVE DEV	README shortcut. Not secret-read proven.
drape-postgres-prod	db.t4g.small, private	LEGACY CANDIDATE	Rollback leftover. Not approved for deletion.

Lightsail is documented as already gone in the cutover record (DOCS-SUPPORTED). This Stage 1 inventory did not re-query the Lightsail API.

STALE: docs that still say the API lives only on Render, or that Postgres is off-AWS. Render Mongo remains a separate non-AWS system.

ACM

Cert	SANs	Status	In use	Class
19f9816e-8896-4a4b-9a60-c03c133888ba	api.drape.to, dev-api.drape.to	ISSUED	ALB drape-alb	LIVE
0d4fa738-…	api.drape.to, dev-api.drape.to	VALIDATION_TIMED_OUT / failed lineage	none	LEGACY CANDIDATE

Amplify manages its own web certs; the ALB cert above is the user-visible ACM object in this account.

Secrets Manager (names and metadata only)

Name	Notes	Class
drape/backend/prod-keys	LastChanged ~2026-09-14	LIVE (name)
drape/backend/shared-keys	LastChanged ~2026-09-05	LIVE (name)
rds!db-994e42ac-…	RDS-managed; rotation enabled	LIVE (name)

Values were not read.

Empty in us-east-1 (LIVE)

Under the inventory role, these APIs returned empty:

• S3 buckets: 0 — object storage remains Supabase
• Lambda functions: 0
• API Gateway REST/HTTP: 0
• ElastiCache: 0
• EC2 instances: 0
• SSM parameters: 0 listed via DescribeParameters

CloudWatch log groups seen (metadata only; no events read): /aws/amplify/d25a3s1rbghls0, /aws/amplify/d2pa8ox8j0q7ch, /ecs/drape-backend-postgres.

IAM (read-only names)

Item	Value	Class
Users	Kenji, Lawrence, Wes	LIVE
Notable roles	DrapeChiefReadonly, drape-ecs-execution-role, drape-ecs-task-role, drape-github-deploy-role, Amplify SSR logging roles	LIVE

Security groups

SG	Name	Notable ingress	Class
sg-0df07f6342830f4df	drape-alb-sg	80/443 from 0.0.0.0/0	LIVE
sg-0a6616040afeaada4	drape-task-sg	8000 from ALB SG	LIVE
sg-0b2dbe806111e0702	drape-pg-db-sg	5432 from VPC CIDR + task SG + 200.72.39.18/32	LIVE

Document only — do not change

Postgres SG allowlist 200.72.39.18/32 has an UNKNOWN owner. Brand Amplify verified=false on brand + *.drape.to is a metadata quirk (DNS CNAMEs match; domainStatus AVAILABLE). Neither is an instruction to edit AWS, IAM, or DNS.

Domain → AWS map

Domain	Front door	Backend	Env	Class
drape.to / www.drape.to	Amplify Marketing → CloudFront hostname	static/SSR web	prod (main)	LIVE
brand.drape.to / *.drape.to	Amplify brand → CloudFront hostname	brand portal	prod intent; Amplify verified=false	LIVE DNS / UNKNOWN cert-trust UX
admin.drape.to	Amplify admin → CloudFront hostname	admin	prod	LIVE
docs.drape.to	Amplify Docs → CloudFront hostname	this site	prod	LIVE
api.drape.to	Route 53 → ALB host rule → prod TG → ECS drape-prod	Postgres API	prod	LIVE
dev-api.drape.to	Route 53 → ALB default → dev TG → ECS drape-dev	Postgres API	dev	LIVE

Repo → deploy

Repo	Deploy target	Class
drape-ai-llc/drape-marketing	Amplify d25a3s1rbghls0	LIVE
drape-ai-llc/drape-brand	Amplify du0asj4lh5zwr	LIVE
drape-ai-llc/drape-admin-v1	Amplify d2pa8ox8j0q7ch	LIVE
drape-ai-llc/drape-docs	Amplify d2ip1x1ygwzne5	LIVE
Drape-AI-LLC/Drape- backend-postgres/	ECR drape-backend-postgres → ECS drape-prod / drape-dev	LIVE images; Git path DOCS-SUPPORTED
Drape-AI-LLC/Drape- backend/ (Mongo)	Render (non-AWS)	DOCS-SUPPORTED

Production vs dev

Env	Evidence
Prod web	Amplify main for marketing / brand / admin / docs
Prod API	api.drape.to → drape-prod / drape-prod-tg / ECR tag prod
Dev API	dev-api.drape.to (and ALB default) → drape-dev / drape-dev-tg / ECR tag dev
Marketing develop	Amplify branch develop on Marketing (no separate custom domain in this inventory)

Legacy / orphan candidates (not approved for deletion)

1. RDS drape-postgres-prod beside drape-postgres-prod-live — cutover rollback leftover.
2. ACM cert 0d4fa738-… VALIDATION_TIMED_OUT duplicate for api/dev-api.
3. Extra Amplify SSR logging role/policy pairs beyond the four live apps.
4. Historical ECS task-definition revisions (expected; not orphan infra).

drape-postgres is probable ACTIVE DEV, not a delete candidate.

External / non-AWS (unchanged by this inventory)

• Render Mongo FastAPI backend / privacy URL hosting — separate mobile path.
• Apple / EAS / TestFlight, Stripe, Upstash Redis, Supabase Storage — out of the AWS map.

Related

• Infrastructure — current-truth topology (this inventory applied).
• System overview — surfaces and both backend generations.
• Prod cutover — 2026-08-31 Lightsail → ECS/RDS record.
• ADR-0002 — the migration decision.