AWS Integration Surface
Openbox docs are strictly limited to what OpenBox itself needs. Your AWS estate (org structure, region strategy, edge protection, observability, DR tiering, compliance program) is your decision — this page enumerates the OpenBox-required interface and links out for the rest.
What this page does NOT cover
- ❌ AWS Organizations / Control Tower / OU structure / SCPs
- ❌ Region strategy (single-region vs multi-region vs multi-cloud)
- ❌ CloudFront + WAF + Shield edge protection
- ❌ Admin access (Verified Access, Client VPN, SSO federation)
- ❌ Observability stack (Datadog, Prometheus, New Relic, Loki, etc.)
- ❌ Multi-region DR tiering (your business SLA drives choice)
- ❌ SOC 2 / GDPR / HIPAA compliance program
- ❌ CI/CD pipeline (GitHub Actions vs GitLab CI vs Jenkins)
For AWS best practices on these topics, see AWS Well-Architected.
What OpenBox binds to
Required for any AWS deploy:
| Resource | Purpose | Alternative if not AWS |
|---|---|---|
| EKS cluster (Auto Mode ≥ v1.31, or vanilla K8s ≥ 1.27) | Container runtime | Self-managed K8s (kops, Rancher), AKS, GKE |
| KMS CMK | Envelope encryption for app data | Vault Transit, on-prem HSM |
| S3 bucket | OPA policy bundle storage | MinIO (S3-compatible) |
| IAM (IRSA) | Pods → AWS API access | Vault + K8s ServiceAccount tokens |
Optional but common in prod:
| Resource | Purpose | In-cluster fallback |
|---|---|---|
| RDS PostgreSQL / Aurora | Managed DB | Bitnami postgresql chart, CloudNativePG |
| ElastiCache Redis | Managed Redis | Bitnami redis chart |
| ECR | Image registry | Harbor, GAR, ACR, ghcr.io |
| Secrets Manager (via ESO) | Credential sync | HashiCorp Vault, sealed-secrets, K8s Secrets |
| ALB (via ALB Ingress Controller) | Public load balancer | Istio Gateway + NLB, NGINX Ingress |
| ACM | TLS certs | cert-manager + Let's Encrypt |
Non-AWS cloud mappings
Every "required" and "optional" AWS resource has a documented equivalent:
| AWS | Azure | GCP | On-prem |
|---|---|---|---|
| EKS | AKS | GKE | Rancher / OpenShift / Kubespray |
| KMS | Azure Key Vault | Cloud KMS | Vault Transit |
| S3 | Blob Storage | GCS | MinIO |
| RDS Aurora | Azure Database for PostgreSQL | Cloud SQL | CloudNativePG operator |
| ElastiCache | Azure Cache for Redis | Memorystore | Bitnami redis chart |
| ECR | ACR | Artifact Registry | Harbor |
| Secrets Manager | Key Vault (secrets) | Secret Manager | Vault |
| ALB | Application Gateway | Cloud Load Balancer | MetalLB + HAProxy |
| ACM | App Service Managed Cert | Managed SSL | cert-manager |
| IAM (IRSA) | Entra + Managed Identity | Workload Identity | SPIRE / OIDC federation |
Integration pattern
OpenBox is a Kubernetes application. Its only contract with the underlying cloud is:
- A conformant K8s cluster (≥ 1.27) with a StorageClass, an Ingress controller, and
metrics-serveraddon. - An object store for OPA bundles (S3 or S3-compatible).
- A KMS-like service the pods can call for envelope encryption (via IRSA on AWS, equivalent workload identity elsewhere).
Everything else — where the cluster sits, how traffic reaches it, how data is backed up, what monitors it — is your architecture, not ours.