Features

Move at agent speed. Until you shouldn't.

Agents make infra fast — and unreliable. Recipes come with real guardrails, and Cloud Fabric checks every change against your live account graph — so the one change that would take production down is the one that doesn't ship.

The primitive

Recipes: one unit of production-ready infra

A Recipe is a new infra primitive — it composes IaC templates, CDK glue, and CloudFormation into a versioned, metadata-rich unit that stands up a production-ready three-tier ECS architecture, with networking, security, and observability baked in.

You deploy or import a Recipe. You don't hand-assemble IaC, CI, and IAM — and you don't start from a blank AWS console.

IaC templates
declarative modules
CDK glue
typed composition
CloudFormation
certain AWS automation
LP Recipe
the new infra primitive
Eventsdrift & changecontinuous lifecycle
All accessible from MCPthe same guardrails

01 — The ask

dev → Claude

"Tighten the ALB's TLS policy to TLS 1.2+ for SOC 2 compliance."

The change ships. Nothing maps what depends on that load balancer.

02 — Without LaunchPaaS

Outage.

The new TLS policy breaks the listener your ECS service sits behind. Tasks fall out of the target group, traffic dies — and the first one to notice is a customer.

2nd Day Ops

Cloud Fabric keeps the whole account coherent

Recipes rarely live alone. LP Cloud Fabric composes recipes that interact and runs 2nd Day Ops — reconciling against a live dependency graph of your real account, including resources you built by hand or with any IaC (Pulumi, Crossplane, CloudFormation, and more).

Change one thing and you know what it touches: updates and deletes are checked for blast radius before they run.

OR — see how it works with LaunchPaaS

02 — With LaunchPaaS

Claude issues the same change through Cloud Fabric over MCP — which checks it against the live account graph first.

VPC
Subnet · used by ECS cluster
Load Balancer
ALB · not LP-managed
affects
ECS Cluster · not affected
ECS Service
affected
runs
ECS Task
affected
blast radius — affected in graph — not affected

03 — Before apply

LP Cloud FabricCloud Fabric returns the blast radius and holds the change until it's reconciled. The ECS service and task were never at risk — and no one heard about it from a customer.

// the ALB isn't even LaunchPaaS-managed — the account graph caught it, traced the change into the ECS service and task inside the cluster, and left the cluster, subnet, and VPC themselves untouched.

Built for agents

Every capability, callable over MCP

AI agents make infra fast — but unreliable. LaunchPaaS exposes the whole primitive — deploy, import, reconcile, provision — over MCP, behind the same guardrails a person gets.

An agent gets high-context, metadata-rich infrastructure and dependency-graph checks — not a blank console and hope.

# agent → MCP
recipe.deploy({
recipe: "three-tier-ecs",
account: "customer"
})
← guardrails: blast-radius OK · drift: none
← applied · state reconciled
  • Deploys into your own AWS account
  • Real IaC — you own the code
  • Secure cross-account role, no vendor cloud
  • Import existing infra · adopt incrementally

Real ownership

Your AWS account. Real IaC. No black box.

Infrastructure lands in your own AWS account through a secure cross-account role — never a vendor-managed cloud. You own the IaC, the data, and the account.

Already on AWS? Import and manage what you have, and adopt LaunchPaaS at your own pace. Leave anytime — it's your cloud.

Grows with you

LaunchPaaS grows with your stack

Start with the foundation and add what you need, when you need it. Every service is provisioned into your own AWS account and wired into your stack automatically — no bolt-ons, no second control plane.

PostgreSQL
Amazon RDS
Redis
Amazon ElastiCache
Object storage
Amazon S3
Queues
Amazon SQS
Event buses
Amazon EventBridge
Secrets
AWS Secrets Manager
Observability
Amazon CloudWatch
Networking
Amazon VPC
PostgreSQL
Amazon RDS · commonly misconfigured
  1. 1
    Publicly accessible

    The instance sits in a public subnet with a permissive security group. Production databases belong in DB subnets with tier-scoped access only.

  2. 2
    Encryption skipped at creation

    At-rest encryption cannot be switched on later: it requires a snapshot-copy migration. Miss it on day one and the audit finds it on day 400.

  3. 3
    Untested backups

    Default retention, no restore drill. A backup that has never been restored is a hope, not a recovery plan.

The Recipe ships all three configured. And Cloud Fabric keeps them that way: drift on any of these is caught against the live account graph.

Redis
Amazon ElastiCache · commonly misconfigured
  1. 1
    No AUTH, no TLS

    In-transit encryption and the AUTH token are opt-in. Anything that can reach the subnet can read your cache.

  2. 2
    Single node, no failover

    One node with Multi-AZ off: a maintenance event or AZ blip becomes an outage instead of a failover.

  3. 3
    Default eviction policy

    noeviction under memory pressure means write errors at peak load, exactly when the cache matters most.

The Recipe ships all three configured. And Cloud Fabric keeps them that way: drift on any of these is caught against the live account graph.

Object storage
Amazon S3 · commonly misconfigured
  1. 1
    Public access block not enforced

    Block Public Access belongs at the account level, not per-bucket. One new bucket with a permissive policy is how datasets leak.

  2. 2
    No TLS-only policy

    Without a deny on insecure transport, callers can fetch objects over plain HTTP and no one notices.

  3. 3
    No lifecycle rules

    Incomplete multipart uploads and old versions accumulate forever. The bill grows; nobody can say why.

The Recipe ships all three configured. And Cloud Fabric keeps them that way: drift on any of these is caught against the live account graph.

Queues
Amazon SQS · commonly misconfigured
  1. 1
    Visibility timeout too short

    Set below the consumer timeout, messages reappear mid-processing and jobs run twice. AWS guidance for Lambda consumers: at least 6x the function timeout.

  2. 2
    No dead-letter queue

    Without a redrive policy, a poison message retries forever and failures leave no trace to debug.

  3. 3
    Short polling

    ReceiveMessage with no wait time burns API calls and money polling an empty queue.

The Recipe ships all three configured. And Cloud Fabric keeps them that way: drift on any of these is caught against the live account graph.

Event buses
Amazon EventBridge · commonly misconfigured
  1. 1
    No DLQ on targets

    When a target fails past its retries, the event is silently dropped. Order placed, email never sent, no record of either.

  2. 2
    Overbroad rule patterns

    A loose pattern matches events it was never meant to, and downstream consumers fire on traffic they should never see.

  3. 3
    No archive or replay

    Without an event archive, a consumer bug means the events processed wrong during the incident are simply gone.

The Recipe ships all three configured. And Cloud Fabric keeps them that way: drift on any of these is caught against the live account graph.

Secrets
AWS Secrets Manager · commonly misconfigured
  1. 1
    Secrets in env vars

    Credentials pasted into task definitions and .env files instead of referenced at runtime: visible in consoles, diffs, and logs.

  2. 2
    Rotation never enabled

    The database password from the first deploy is still the password. Rotation exists; nobody wired it.

  3. 3
    GetSecretValue on *

    One over-broad IAM statement gives every service read access to every secret in the account.

The Recipe ships all three configured. And Cloud Fabric keeps them that way: drift on any of these is caught against the live account graph.

Observability
Amazon CloudWatch · commonly misconfigured
  1. 1
    Log retention never set

    Log groups default to Never Expire. Years of debug logs quietly become one of the larger line items.

  2. 2
    Alarms on averages

    Average latency hides the p99 your users actually feel. Alarms that never fire are indistinguishable from no alarms.

  3. 3
    No alarms on error logs

    Metrics get dashboards; the ERROR lines in the logs get discovered by a customer.

The Recipe ships all three configured. And Cloud Fabric keeps them that way: drift on any of these is caught against the live account graph.

Networking
Amazon VPC · commonly misconfigured
  1. 1
    One NAT gateway for everything

    A single NAT in one AZ means one zone failure takes out egress for all of them. One per AZ, in the public subnets.

  2. 2
    Wide-open security groups

    All-traffic rules between tiers turn network segmentation into a diagram, not a control.

  3. 3
    No gateway endpoints

    S3 and DynamoDB traffic hairpins through the NAT at a per-GB charge for what a free gateway endpoint would carry.

The Recipe ships all three configured. And Cloud Fabric keeps them that way: drift on any of these is caught against the live account graph.

Automation + Service — Not the Other Way Around

Automation handles 95% of your infrastructure. The last 5% — migrations, edge cases, the gnarly one-offs — is a game of diminishing returns to automate, so we don't pretend to. That's where white-glove support comes in: a real team, not a ticket queue. You get a platform and people.

See how we work with you →

Stop Renting Infrastructure. Start Owning It.

Join product teams building on AWS with PaaS-level simplicity — and full control of their cloud from day one.

iac.apply — ecs-three-tier
$ launchpaas up▋
deploying
{"ts":"2026-06-28T10:00:00Z","event":"iac.apply","module":"ecs-three-tier"}
{"ts":"2026-06-28T10:02:14Z","event":"rds.provisioned","engine":"postgres","account":"customer"}
✓ stack live in your account