# AWS system map

Canonical **live AWS inventory** for Drape, taken 2026-09-17 against account
`230790682930`. Workloads are concentrated in **us-east-1**. Other US regions
(`us-east-2`, `us-west-1`, `us-west-2`) have a default VPC only — no Amplify, ECS,
ELB, RDS, ECR, Lambda, or Secrets Manager apps.

This page is the evidence map. The readable topology is
[Infrastructure](./infrastructure.md). Deploy mechanics are
[Web deploys](../shipping/web-deploys.md) and
[Backend deploys](../shipping/backend-deploys.md).

:::note[Evidence classes]
**LIVE** — returned by AWS APIs in this inventory. **DOCS-SUPPORTED** — recorded
in Drape-Docs (cutover, READMEs, workflows) but not re-proven by reading secret
values. **STALE** — contradicted by live APIs. **UNKNOWN** — API did not settle
it. **LEGACY CANDIDATE** — present, likely leftover; **not approved for
deletion**.
:::

No secret values, passwords, connection strings, or API keys are recorded here.
`DATABASE_URL` → RDS host mapping is **DOCS-SUPPORTED** from the
[prod cutover](../shipping/prod-cutover.md) and backend READMEs — Stage 2A did
**not** read secret payloads.

## Account and regions

| Item | Value | Class |
|---|---|---|
| Account | `230790682930` | LIVE |
| Primary region | **us-east-1** | LIVE |
| Other US regions | Default VPC only; empty of Drape apps | LIVE |

## Live architecture (us-east-1)

```mermaid
graph TB
    subgraph dns [Route 53 zone drape.to]
        Apex["drape.to / www"]
        BrandHost["brand + wildcard"]
        AdminHost["admin"]
        DocsHost["docs"]
        ApiHost["api"]
        DevHost["dev-api"]
    end

    subgraph amp [Amplify]
        Mkt["Marketing WEB_COMPUTE"]
        Br["Brand WEB_COMPUTE"]
        Ad["Admin WEB_COMPUTE"]
        Dc["Docs WEB"]
    end

    subgraph api [ALB ECS RDS]
        ALB["drape-alb"]
        Prod["service drape-prod"]
        Dev["service drape-dev"]
        RDSp["RDS prod-live docs-supported"]
        RDSd["RDS drape-postgres probable DEV"]
    end

    Apex --> Mkt
    BrandHost --> Br
    AdminHost --> Ad
    DocsHost --> Dc
    ApiHost --> ALB
    DevHost --> ALB
    ALB -->|"host api LIVE"| Prod
    ALB -->|"default / dev-api LIVE"| Dev
    Prod -.->|"docs-supported not secret-read"| RDSp
    Dev -.->|"docs-supported not secret-read"| RDSd
```

*ECS → RDS arrows are **docs-supported** (cutover + README), not proven by reading
secret contents. `drape-postgres` is **probable** DEV, not API-verified. Legacy
`drape-postgres-prod` is omitted here and is **not approved for deletion**. ALB
host routing is LIVE.*

Cluster name is **`drape`**. `drape-prod` and `drape-dev` are **services** on that
cluster, not cluster names.

## Public web — Amplify

All four apps are in **us-east-1**. Git connections on Amplify are the **org**
(`https://github.com/drape-ai-llc/...`), **not** `KCB1099/*`.

| App | App ID | Platform | Git repo (Amplify) | Default domain | Custom domain |
|---|---|---|---|---|---|
| Drape-Marketing | `d25a3s1rbghls0` | WEB_COMPUTE | `drape-ai-llc/drape-marketing` | `d25a3s1rbghls0.amplifyapp.com` | `drape.to` + `www` on `main`; also branch `develop` |
| Drape-brand | `du0asj4lh5zwr` | WEB_COMPUTE | `drape-ai-llc/drape-brand` | `du0asj4lh5zwr.amplifyapp.com` | `brand` + `*.drape.to` |
| Drape-admin-v1 | `d2pa8ox8j0q7ch` | WEB_COMPUTE | `drape-ai-llc/drape-admin-v1` | `d2pa8ox8j0q7ch.amplifyapp.com` | `admin.drape.to` |
| Drape-Docs | `d2ip1x1ygwzne5` | WEB | `drape-ai-llc/drape-docs` | `d2ip1x1ygwzne5.amplifyapp.com` | **`docs.drape.to` LIVE** (not amplifyapp-only) |

Amplify domain-association notes (metadata, not DNS):

- Marketing apex `verified=false`, www `verified=true`.
- Brand + wildcard **both `verified=false`** even though Route 53 CNAMEs match
  and `domainStatus` is **AVAILABLE**. Treat this as an Amplify console quirk,
  not as “wildcard DNS is missing.”
- Admin and docs `verified=true`.

**STALE:** older docs claimed Amplify Git connect to `KCB1099/*` and that this
docs site was amplifyapp-only / manual-deploy only.

### CloudFront

Amplify-managed CloudFront **hostnames** are LIVE via Route 53 + Amplify domain
associations:

| Hostname | Fronts |
|---|---|
| `dr97vmdco0hao.cloudfront.net` | `drape.to` / `www` |
| `d2yv7dj5tfi9vi.cloudfront.net` | `brand.drape.to` and `*.drape.to` |
| `d21ssgtyd9wiv8.cloudfront.net` | `admin.drape.to` |
| `d1p7il2uis0gn.cloudfront.net` | `docs.drape.to` |

`ListDistributions` in this account returned **empty** (not AccessDenied).
Amplify abstracts CloudFront distribution IDs; do not treat “no distributions
listed” as “no CloudFront.”

## DNS — Route 53

Hosted zone **`drape.to.`** / **`Z00780563EFBECXPWSBK4`** — LIVE. There is a
Route 53 zone in this account.

| Record | Target | Class |
|---|---|---|
| Apex A | alias → `dr97vmdco0hao.cloudfront.net` | LIVE |
| www | CNAME → same CloudFront hostname | LIVE |
| brand | CNAME → `d2yv7dj5tfi9vi.cloudfront.net` | LIVE |
| `*.drape.to` | CNAME → same brand CloudFront hostname | LIVE |
| admin | CNAME → `d21ssgtyd9wiv8.cloudfront.net` | LIVE |
| docs | CNAME → `d1p7il2uis0gn.cloudfront.net` | LIVE |
| api | A alias → `drape-alb-1305867817.us-east-1.elb.amazonaws.com` | LIVE |
| dev-api | A alias → same ALB | LIVE |

**STALE:** pages that say “No Route 53 / external DNS only.”

`staging.drape.to` is **not** in this zone map. Dev API is `dev-api.drape.to`.

## API path — ALB → ECS Fargate → RDS

| Layer | Resource | Notes | Class |
|---|---|---|---|
| ALB | `drape-alb` / `drape-alb-1305867817.us-east-1.elb.amazonaws.com` / VPC `vpc-0eb9cce93e675877f` | internet-facing, active | LIVE |
| Listener :80 | default → `drape-dev-tg`; host `api.drape.to` → `drape-prod-tg` | | LIVE |
| Listener :443 | ACM cert for `api` + `dev-api`; same host rules | | LIVE |
| TG prod | `drape-prod-tg` :8000 healthy | | LIVE |
| TG dev | `drape-dev-tg` :8000 healthy | | LIVE |
| ECS cluster | **`drape`** | not named `drape-prod` | LIVE |
| ECS service prod | `drape-prod` Fargate, desired/running 1; public IP **ENABLED**; no NAT | task def `drape-prod:10` at inventory time | LIVE |
| ECS service dev | `drape-dev` Fargate, desired/running 1 | task def `drape-dev:22` at inventory time | LIVE |
| ECR | `drape-backend-postgres` | tags include `prod` / `dev` | LIVE |
| VPC | default VPC `vpc-0eb9cce93e675877f` `172.31.0.0/16` | no custom VPC | LIVE |
| NAT | none | matches [ADR-0002](../decisions/0002-lightsail-to-ecs-rds-migration.md) | LIVE |

Backend code: `Drape-AI-LLC/Drape-` path **`backend-postgres/`**. **`develop`
auto-deploys ECS `drape-dev`**; **prod is `workflow_dispatch`** onto `drape-prod`.
DOCS-SUPPORTED from repo workflows, consistent with live ECR tags and services.

Default ALB action sends unmatched Host headers to **dev**. Only
`api.drape.to` is pinned to prod.

### RDS classifications (do not approve deletion)

Three PostgreSQL 16.13 instances exist. **Do not delete any of them** from this
inventory.

| Instance | Exposure | Class | Evidence |
|---|---|---|---|
| `drape-postgres-prod-live` | `db.t4g.small`, private | **ACTIVE PROD** | [Cutover](../shipping/prod-cutover.md) record. Host **not** secret-read proven. |
| `drape-postgres` | `db.t4g.micro`, public | **probable ACTIVE DEV** | README shortcut. **Not** secret-read proven. |
| `drape-postgres-prod` | `db.t4g.small`, private | **LEGACY CANDIDATE** | Rollback leftover. **Not approved for deletion.** |

Lightsail is documented as already gone in the cutover record (DOCS-SUPPORTED).
This Stage 1 inventory did not re-query the Lightsail API.

**STALE:** docs that still say the API lives only on Render, or that Postgres is
off-AWS. Render Mongo remains a **separate non-AWS** system.

## ACM

| Cert | SANs | Status | In use | Class |
|---|---|---|---|---|
| `19f9816e-8896-4a4b-9a60-c03c133888ba` | `api.drape.to`, `dev-api.drape.to` | ISSUED | ALB `drape-alb` | LIVE |
| `0d4fa738-…` | `api.drape.to`, `dev-api.drape.to` | VALIDATION_TIMED_OUT / failed lineage | none | LEGACY CANDIDATE |

Amplify manages its own web certs; the ALB cert above is the user-visible ACM
object in this account.

## Secrets Manager (names and metadata only)

| Name | Notes | Class |
|---|---|---|
| `drape/backend/prod-keys` | LastChanged ~2026-09-14 | LIVE (name) |
| `drape/backend/shared-keys` | LastChanged ~2026-09-05 | LIVE (name) |
| `rds!db-994e42ac-…` | RDS-managed; rotation enabled | LIVE (name) |

Values were **not** read.

## Empty in us-east-1 (LIVE)

Under the inventory role, these APIs returned empty:

- S3 buckets: **0** — object storage remains **Supabase**
- Lambda functions: **0**
- API Gateway REST/HTTP: **0**
- ElastiCache: **0**
- EC2 instances: **0**
- SSM parameters: **0** listed via DescribeParameters

CloudWatch log groups seen (metadata only; no events read):
`/aws/amplify/d25a3s1rbghls0`, `/aws/amplify/d2pa8ox8j0q7ch`,
`/ecs/drape-backend-postgres`.

## IAM (read-only names)

| Item | Value | Class |
|---|---|---|
| Users | `Kenji`, `Lawrence`, `Wes` | LIVE |
| Notable roles | `DrapeChiefReadonly`, `drape-ecs-execution-role`, `drape-ecs-task-role`, `drape-github-deploy-role`, Amplify SSR logging roles | LIVE |

## Security groups

| SG | Name | Notable ingress | Class |
|---|---|---|---|
| `sg-0df07f6342830f4df` | drape-alb-sg | 80/443 from `0.0.0.0/0` | LIVE |
| `sg-0a6616040afeaada4` | drape-task-sg | 8000 from ALB SG | LIVE |
| `sg-0b2dbe806111e0702` | drape-pg-db-sg | 5432 from VPC CIDR + task SG + **`200.72.39.18/32`** | LIVE |

:::warning[Document only — do not change]
Postgres SG allowlist `200.72.39.18/32` has an **UNKNOWN owner**. Brand Amplify
`verified=false` on `brand` + `*.drape.to` is a metadata quirk (DNS CNAMEs
match; `domainStatus` AVAILABLE). Neither is an instruction to edit AWS, IAM,
or DNS.
:::

## Domain → AWS map

| Domain | Front door | Backend | Env | Class |
|---|---|---|---|---|
| `drape.to` / `www.drape.to` | Amplify Marketing → CloudFront hostname | static/SSR web | prod (`main`) | LIVE |
| `brand.drape.to` / `*.drape.to` | Amplify brand → CloudFront hostname | brand portal | prod intent; Amplify `verified=false` | LIVE DNS / UNKNOWN cert-trust UX |
| `admin.drape.to` | Amplify admin → CloudFront hostname | admin | prod | LIVE |
| `docs.drape.to` | Amplify Docs → CloudFront hostname | this site | prod | LIVE |
| `api.drape.to` | Route 53 → ALB host rule → prod TG → ECS `drape-prod` | Postgres API | prod | LIVE |
| `dev-api.drape.to` | Route 53 → ALB default → dev TG → ECS `drape-dev` | Postgres API | dev | LIVE |

## Repo → deploy

| Repo | Deploy target | Class |
|---|---|---|
| `drape-ai-llc/drape-marketing` | Amplify `d25a3s1rbghls0` | LIVE |
| `drape-ai-llc/drape-brand` | Amplify `du0asj4lh5zwr` | LIVE |
| `drape-ai-llc/drape-admin-v1` | Amplify `d2pa8ox8j0q7ch` | LIVE |
| `drape-ai-llc/drape-docs` | Amplify `d2ip1x1ygwzne5` | LIVE |
| `Drape-AI-LLC/Drape-` `backend-postgres/` | ECR `drape-backend-postgres` → ECS `drape-prod` / `drape-dev` | LIVE images; Git path DOCS-SUPPORTED |
| `Drape-AI-LLC/Drape-` `backend/` (Mongo) | **Render** (non-AWS) | DOCS-SUPPORTED |

## Production vs dev

| Env | Evidence |
|---|---|
| Prod web | Amplify `main` for marketing / brand / admin / docs |
| Prod API | `api.drape.to` → `drape-prod` / `drape-prod-tg` / ECR tag `prod` |
| Dev API | `dev-api.drape.to` (and ALB default) → `drape-dev` / `drape-dev-tg` / ECR tag `dev` |
| Marketing develop | Amplify branch `develop` on Marketing (no separate custom domain in this inventory) |

## Legacy / orphan candidates (not approved for deletion)

1. RDS `drape-postgres-prod` beside `drape-postgres-prod-live` — cutover rollback leftover.
2. ACM cert `0d4fa738-…` VALIDATION_TIMED_OUT duplicate for api/dev-api.
3. Extra Amplify SSR logging role/policy pairs beyond the four live apps.
4. Historical ECS task-definition revisions (expected; not orphan infra).

`drape-postgres` is **probable ACTIVE DEV**, not a delete candidate.

## External / non-AWS (unchanged by this inventory)

- **Render** Mongo FastAPI backend / privacy URL hosting — separate mobile path.
- Apple / EAS / TestFlight, Stripe, Upstash Redis, Supabase Storage — out of the AWS map.

## Related

- [Infrastructure](./infrastructure.md) — current-truth topology (this inventory applied).
- [System overview](./system-overview.md) — surfaces and both backend generations.
- [Prod cutover](../shipping/prod-cutover.md) — 2026-08-31 Lightsail → ECS/RDS record.
- [ADR-0002](../decisions/0002-lightsail-to-ecs-rds-migration.md) — the migration decision.