---
title: Which DevOps Tool Owns Each Layer on AWS
description: On 19 October 2026 the CodeBuild pricing page bills its on-demand EC2 example at $0.005 a minute: 400 minutes after the 100-minute free tier is $2. The 23 September 2025 DORA report, from nearly 5,000 respondents, says 90% of organizations already run at least one internal platform.
url: https://www.factualminds.com/blog/aws-devops-automation-tools-2026/
datePublished: 2026-10-19T00:00:00.000Z
dateModified: 2026-10-20T00:00:00.000Z
author: palaniappan-p
category: DevOps & CI/CD
tags: devops, aws, cicd, aws-codebuild, aws-codepipeline, terraform, amazon-ecs, amazon-eks, aws-cloudwatch, amazon-eventbridge
---
# Which DevOps Tool Owns Each Layer on AWS
> On 19 October 2026 the CodeBuild pricing page bills its on-demand EC2 example at $0.005 a minute: 400 minutes after the 100-minute free tier is $2. The 23 September 2025 DORA report, from nearly 5,000 respondents, says 90% of organizations already run at least one internal platform.
import { Image } from 'astro:assets';
import cicdLayer from '~/assets/images/blog/aws-devops-automation-tools-2026/cicd.webp';
import iacLayer from '~/assets/images/blog/aws-devops-automation-tools-2026/iac.webp';
import containersLayer from '~/assets/images/blog/aws-devops-automation-tools-2026/containers.webp';
import configLayer from '~/assets/images/blog/aws-devops-automation-tools-2026/config.webp';
import observabilityLayer from '~/assets/images/blog/aws-devops-automation-tools-2026/observability.webp';
import orchestrationLayer from '~/assets/images/blog/aws-devops-automation-tools-2026/orchestration.webp';
On 19 October 2026, two AWS DevOps products are already closed to new customers, and the build service still publishes a worked price. Amazon CodeCatalyst stopped taking new customers on 7 November 2025. AWS App Runner stopped taking new customers on 30 April 2026 and points new container services at Amazon ECS Express Mode. The [CodeBuild pricing page](https://aws.amazon.com/codebuild/pricing/), read the same day, bills an on-demand EC2 example at $0.005 a minute: 100 builds of 5 minutes is 500 minutes, the free tier removes 100, and 400 times $0.005 is $2.
The [23 September 2025 DORA announcement](https://cloud.google.com/blog/products/ai-machine-learning/announcing-the-2025-dora-report) from Google Cloud draws on nearly 5,000 technology professionals and says 90% of organizations have adopted at least one internal platform. The same note says AI adoption in that survey tracks with higher delivery throughput and with worse delivery stability, and that teams with fast feedback loops see the gains. The tool decision is which layer that platform owns inside an AWS account. A pipeline execution, a state file, an image digest, a running task, a configuration association, and an alarm are six different objects.
Pick the tool that writes each object. For a workload that already lives in AWS accounts, CodeBuild runs the minutes, CDK or Terraform defines the account, and ECS on Fargate runs the task. A separate controller is worth adding only when a named person already owns it.
> **Reproduce this** — Copy the [layer ownership sheet](https://www.factualminds.com/examples/architecture-blog-2026/devops-automation-tools/layer-ownership.md) and fill one row per layer from the account you deploy. Leave a cell blank when you have not named the writer.
Deeper treatments already exist for the fights inside a layer: [Terraform, OpenTofu, and Ansible](https://www.factualminds.com/blog/aws-terraform-opentofu-ansible-iac-decision-guide/), [Terraform, OpenTofu, and Pulumi](https://www.factualminds.com/blog/terraform-opentofu-vs-pulumi-aws-2026/), [CodePipeline in production](https://www.factualminds.com/blog/aws-codepipeline-cicd-pipeline-patterns-for-production/), [GitHub Actions and AWS credentials](https://www.factualminds.com/blog/github-actions-aws-cicd-security-best-practices/), [Argo CD and Flux on EKS](https://www.factualminds.com/blog/aws-gitops-eks-argocd-flux-2026/), and [observability past a single CloudWatch dashboard](https://www.factualminds.com/blog/aws-observability-beyond-cloudwatch-otel-prometheus-grafana-2026/). This page is the map those posts sit on. The production-practice list is a separate article: [10 AWS DevOps practices](https://www.factualminds.com/blog/10-aws-devops-practices-production-2026/).
## How to place a tool
Ask what object the tool is allowed to write, and in which account.
Scope is the object. A CI system writes a pipeline execution and an artifact. An IaC tool writes resources or a state record. A registry writes an image digest. A config tool writes files on an instance. A monitor writes a time series and an alarm. An orchestrator writes a follow-up execution when one of those events arrives.
The account boundary is the IAM role that execution assumes. A runner outside AWS, including GitHub Actions, GitLab CI, or Jenkins, is fine when that role is assumed per job and the artifact lands in S3 or ECR in the target account. A long-lived access key on the runner is the failure mode, whatever the product brochure says.
State has one writer. CloudFormation keeps stack state in the service. Terraform, OpenTofu, and Pulumi keep a state file that needs a bucket and a lock. Two tools applying to the same security group will produce a plan that is green and an account that is not.
Failure visibility is the execution record. CodeBuild keeps the build log. CloudFormation keeps the stack events. Terraform keeps the plan output next to the locked state. An alarm that nobody routes is a metric, not a response.
## The layer map
| Tool | Layer | What it writes in AWS | Skip it when |
| --- | --- | --- | --- |
| GitHub Actions | CI/CD | A job that assumes an IAM role and pushes to S3 or ECR | The repo is not on GitHub |
| GitLab CI/CD | CI/CD | The same role-and-artifact path from a GitLab runner | The group is not on GitLab |
| Jenkins | CI/CD | A job on a controller you patch, with agents that assume a role | Nobody owns the controller |
| AWS CodePipeline | CI/CD | Stage order and the pipeline execution in the account | The team wants the runner UI to stay in GitHub or GitLab |
| AWS CodeBuild | CI/CD | Build minutes and the artifact or image | The build must run on a self-hosted GPU fleet you already operate |
| AWS CodeDeploy | CI/CD | A deployment on ECS, Lambda, or EC2 | The runtime is an EKS cluster with a GitOps controller |
| Argo CD | CI/CD | A reconcile from Git onto EKS | There is no cluster, or ECS is the runtime |
| AWS CDK | IaC | A CloudFormation template synthesized in the pipeline | The team will not own TypeScript, Python, or another CDK language |
| AWS CloudFormation | IaC | Stack state inside the service | The change is a one-off console edit you refuse to import |
| AWS SAM | IaC | A CloudFormation stack aimed at Lambda and API Gateway | The stack is a VPC, a cluster, or a database |
| Terraform | IaC | Resources plus a state object in S3 | You need CloudFormation stack events as the audit log |
| OpenTofu | IaC | The same state path, under the OpenTofu binary | You have not read the license and feature split in the IaC guide |
| Pulumi | IaC | Resources from a general-purpose language, with state in a backend | The team wanted HCL and a single state file layout |
| Docker | Containers | An image built from a Dockerfile | You expected Docker to run the production service |
| Amazon ECR | Containers | The image digest in the account | The cluster pulls from a registry you do not control and cannot mirror |
| Amazon ECS on Fargate | Containers | A service and tasks, without a node AMI | You need a DaemonSet, a device plugin, or a mesh the ECS scheduler will not host |
| Amazon EKS | Containers | A Kubernetes control plane in the account | One service is the whole workload |
| Ansible | Config | Files and packages on instances, from playbooks | Systems Manager already owns that setting |
| AWS Systems Manager | Config | Associations, Run Command, and Automation documents | The change belongs in an AMI rebuild, not a document on every boot |
| EC2 Image Builder | Config | An AMI id that launch templates pin | The workload is a container and the host image is not yours |
| Amazon CloudWatch | Observability | Metrics, logs, and the alarm event | You need a PromQL recording rule the metric filter cannot express |
| Amazon Managed Service for Prometheus | Observability | Remote-written series, with cardinality you still own | The only consumer is a single CloudWatch alarm |
| Amazon Managed Grafana | Observability | Dashboards that query Managed Prometheus | You already pay for a Grafana you operate and do not want a second |
| Prometheus | Observability | A TSDB you run, scrape, and compact | You adopted AMP so you would not run that disk |
| Datadog | Observability | A copy of telemetry that leaves the account | The alarm only needs to page from CloudWatch |
| Amazon EventBridge | Orchestration | A rule match on a pipeline or alarm event | The response is a single API call in the same build job |
| AWS Step Functions | Orchestration | A state machine with retries, waits, and branches | The response is one SSM Automation document |
## CI/CD
This layer covers GitHub Actions, GitLab CI, Jenkins, CodePipeline, CodeBuild, CodeDeploy, and Argo CD. The object is a pipeline execution plus an artifact in S3 or a digest in ECR.
_CI/CD layer. GitHub, GitLab, or Jenkins starts the pipeline. The artifact lands in S3 or ECR in the account._
### GitHub Actions
Use GitHub Actions when the repository is already on GitHub. The AWS boundary is an IAM role assumed with OIDC for that job, and the artifact still has to land in S3 or ECR in the target account. Skip it when the code lives in GitLab or in a Jenkins job the rest of the company already audits. Credential detail is in the [GitHub Actions security notes](https://www.factualminds.com/blog/github-actions-aws-cicd-security-best-practices/).
### GitLab CI/CD
Use GitLab CI when the group, the merge request, and the runner are already GitLab. The runner assumes a role the same way, and the artifact still belongs in the AWS account you deploy to. Skip it when adopting GitLab would exist only to gain a pipeline UI.
### Jenkins
Jenkins fits a pipeline shape no hosted runner will express, and only when a named person owns the controller patch cycle and the plugin set. The agents still need an IAM role, and the artifacts still belong in S3 or ECR. Skip a new controller when that person does not exist. The build can run on CodeBuild, or on GitHub Actions, until they do.
### AWS CodePipeline
CodePipeline is the stage list that lives in the account: source, build, deploy, and the execution id an auditor can open. Use it when the promotion across accounts should be an AWS resource with its own IAM role. Skip it when the team already treats the GitHub or GitLab UI as the only place a pipeline may be edited. Stage patterns are in the [CodePipeline production notes](https://www.factualminds.com/blog/aws-codepipeline-cicd-pipeline-patterns-for-production/).
### AWS CodeBuild
CodeBuild is the compute for the build. On 19 October 2026 the pricing page's on-demand EC2 example uses `build.general1.small` at $0.005 a minute. One hundred builds of five minutes is 500 minutes. The free tier of 100 minutes on `general1.small` or `arm1.small` leaves 400 billable minutes, and 400 times $0.005 is $2. That free tier does not end with the 12-month account credit. The same page prices an on-demand Lambda example at $0.00001 a second: 100 builds of 300 seconds is 30,000 seconds, the free tier removes 6,000 seconds on `lambda.arm.1GB` or `lambda.x86-64.1GB`, and 24,000 seconds cost $0.24.
Duration on EC2 compute is rounded up to the nearest minute, from submit until the build ends. A build that finishes in a few seconds still bills a minute. Read the region selector before you copy the $0.005 figure into a budget. The page also bills S3 artifacts, CloudWatch Logs, and KMS separately.
Use CodeBuild when the build should scale to zero between commits and the log should sit next to the pipeline. Skip it when the compile already runs on a self-hosted GPU fleet you operate, and moving it would idle hardware you still pay for.
### AWS CodeDeploy
CodeDeploy moves a deployment group on ECS, Lambda, or EC2. The revision it deploys is the S3 object or the ECS task definition the pipeline produced. Use it for those three compute types, including blue/green on ECS. Skip it for EKS. A cluster with Argo CD or Flux reconciles from Git. CodeDeploy does not own that loop.
### Argo CD
Argo CD writes the reconcile from a Git revision onto EKS. The image digest it applies should be the one ECR holds, published by the pipeline. Use it when the cluster is already the runtime and someone owns the controller. Skip it for ECS. Flux is the other controller, covered in the [EKS GitOps comparison](https://www.factualminds.com/blog/aws-gitops-eks-argocd-flux-2026/).
## Infrastructure as code
This layer covers CDK, CloudFormation, SAM, Terraform, OpenTofu, and Pulumi. The object is either a CloudFormation stack or a state file in S3 with a DynamoDB lock.
_Infrastructure as code. CDK synth produces a template. CloudFormation stores stack state. Terraform keeps its own state object in S3._
### AWS CDK
CDK synth, running in CodeBuild or another runner, emits a CloudFormation template. Use it when the team will own the language the app is written in and wants constructs for the account. Skip it when nobody will review TypeScript or Python that only exists to produce a template. The stack that deploys is still CloudFormation.
### AWS CloudFormation
CloudFormation is the service that stores stack state and emits stack events. Use it when the audit log you want is those events, including stacks that CDK or SAM generated. Skip a hand-written template for a one-off console change you will not import. ClickOps beside a stack is a second writer.
### AWS SAM
SAM packages a serverless application to S3 and deploys a CloudFormation stack aimed at Lambda, API Gateway, and the resources around them. Use it for that slice. Skip it for a VPC, an EKS cluster, or a database fleet. Those belong in CDK or Terraform, which can still call the same account.
### Terraform
Terraform writes resources and a state object. On AWS that object belongs in S3, with a DynamoDB lock so a second apply waits. Use it when the team already reviews HCL and the state bucket's IAM policy is tighter than the apply role. Skip it when you need CloudFormation stack events as the only audit log, or when a CDK app already owns the same resources. The [IaC decision guide](https://www.factualminds.com/blog/aws-terraform-opentofu-ansible-iac-decision-guide/) covers the split with Ansible.
### OpenTofu
OpenTofu is the other binary on the same apply path: plan, state in S3, lock in DynamoDB. Use it when you have chosen that binary on purpose, after the license and feature differences in the IaC guide. Skip a drive-by switch in a pipeline that still vendors the Terraform provider cache from last quarter.
### Pulumi
Pulumi writes resources from a general-purpose language. The state still lives in a backend. If that backend is an S3 bucket, the lock problem is the same class as Terraform. Use it when the team wants that language and will own the state backend. Skip it when the goal was a single HCL layout the on-call already knows. The [Pulumi comparison](https://www.factualminds.com/blog/terraform-opentofu-vs-pulumi-aws-2026/) is the longer version.
## Containers
This layer covers Docker, ECR, ECS on Fargate, and EKS. The object is an image digest, then a running task or pod.
_Container layer. The image is built once, stored in ECR, then run on ECS or EKS._
### Docker
Docker builds an image from a Dockerfile. Run that build in CodeBuild, and push the result to ECR. Use Docker as the build contract. Skip it as the production runtime. A laptop engine and a production service are different failure domains.
### Amazon ECR
ECR holds the digest the runtime pulls. The pipeline pushes, and ECS or EKS pulls. Use a repository per service in the account that deploys, with a lifecycle policy so untagged builds do not accumulate. If the task role pulls from your account, mirror the image into that repository. Name the digest in the task definition once the service is in production. A floating tag is a second writer.
### Amazon ECS on Fargate
ECS on Fargate runs the task without a node AMI for you to patch. Use it for services that fit the ECS scheduler. For a new container service that used to be a candidate for App Runner, use ECS Express Mode: one image and two IAM roles, and ECS provisions Fargate, a load balancer, autoscaling, and networking. AWS states there is no additional charge for Express Mode. You pay for those resources. App Runner stopped taking new customers on 30 April 2026.
Skip Fargate when the pod needs a DaemonSet, a GPU device plugin, or a sidecar shape the ECS task definition will not host. That is the EKS conversation, and only if someone owns the cluster.
### Amazon EKS
EKS is a Kubernetes control plane in the account, plus the nodes or Fargate profiles and the addons you attach. Use it when several teams already deploy to a cluster and a controller such as Argo CD reconciles Git. Skip it for a single service. ECS on Fargate is the smaller surface, and Express Mode is the path AWS names for new App Runner-shaped workloads.
## Configuration
This layer covers Ansible, Systems Manager, and EC2 Image Builder. The object is an AMI id, then the files on a running instance. Containers that do not use an instance you manage skip this layer.
_Configuration layer. Image Builder bakes the AMI. State Manager and Ansible are the two writers that can fight over the same instance._
### EC2 Image Builder
Image Builder publishes an AMI. Launch templates pin that AMI id. Use it when EC2 is the runtime and you want the golden image rebuilt on a schedule. Skip it for ECS on Fargate, where the host image is not yours. A container build belongs in the ECR path above.
### AWS Systems Manager
Systems Manager State Manager and Automation converge an instance after boot, and Run Command is the one-off. Use documents for drift you accept fixing in place. Skip them for a change that should have been a new AMI. Incident Manager and Change Manager have been in the [maintenance list](https://docs.aws.amazon.com/general/latest/gr/maintenance_services.html) since the 7 November 2025 announcement. Do not start a new incident process on those two features. Automation documents and State Manager are the live path.
### Ansible
Ansible writes the instance from a playbook, often over Session Manager so the controller does not need a public SSH path. Use it when the playbook already exists and rewriting it as SSM documents is a project you have not staffed. Skip any setting State Manager or the AMI already owns. Two writers on one package produce a green playbook and a green association with opposite file contents.
## Observability
This layer covers CloudWatch, Managed Prometheus, Managed Grafana, self-managed Prometheus, and Datadog. The object is a time series and an alarm someone routes. The wider layout is in [observability beyond CloudWatch](https://www.factualminds.com/blog/aws-observability-beyond-cloudwatch-otel-prometheus-grafana-2026/).
_Observability layer. ADOT exports once. CloudWatch, Managed Prometheus, and Datadog are the sinks._
### Amazon CloudWatch
CloudWatch holds metrics, logs, and the alarm whose state change EventBridge can match. Use it as the default sink for ECS, Lambda, and EC2, and as the alarm even when another system stores the long series. Skip it as the only store when the query you need is a PromQL recording rule a metric filter will not express.
### Amazon Managed Service for Prometheus
Managed Prometheus stores series that ADOT or a Prometheus agent remote-writes. You still own the cardinality. Use it when the dashboards are already PromQL. Skip it when a CloudWatch alarm is the only consumer. A second store with no reader is a bill.
### Amazon Managed Grafana
Managed Grafana is the dashboard over Managed Prometheus, and over other sources you add. Use it when the readers are in the AWS account and you do not want a Grafana host. Skip a second Grafana when the company already operates one and the only gap is an IAM path for the readers.
### Prometheus
Self-managed Prometheus is the TSDB you scrape, compact, and restore. Use it when a retention or recording rule you depend on does not fit AMP and you accept the disk. Skip it when the reason you looked at AMP was to stop running that disk.
### Datadog
Datadog is a sink outside the account. The agent or ADOT exports a copy of the telemetry, and the contract follows the hosts and custom metrics you send. Use it when the on-call already lives in Datadog and the export path is owned. Skip it when the alarm only needs to page from a CloudWatch alarm in the same account. Exporting every label you collect is how the invoice moves.
## The handoff between layers
A pipeline success and an alarm are events. EventBridge matches them. Step Functions runs the branchy response. Systems Manager Automation runs the single document. This is the layer that used to be a pile of webhooks between products.
_Orchestration layer. Pipeline and alarm events enter EventBridge, then a workflow or a runbook._
### Amazon EventBridge
EventBridge rules match CodePipeline state changes and CloudWatch alarm transitions on a bus in the account. Use a rule when a second system must react and the reaction should be an AWS resource you can disable. Skip a bus when the next step is one API call inside the same CodeBuild job. A rule with no target is a log line.
### AWS Step Functions
Step Functions is the state machine for a response that waits, branches, or retries. Use it when the remediation has more than one step and a person may need to approve the middle. Skip it for a single SSM document. The execution history is the record. A Lambda that calls three APIs and swallows the error is not.
Systems Manager Automation, from the configuration layer, is the other target. A rule that starts a document is enough when the response is one runbook with parameters. Use Step Functions when the runbook is only one state in a longer machine.
## When the estate is Microsoft-standard
Keep Azure DevOps when Azure Repos and Boards are the company standard and AWS is a sidecar account. The pipeline still needs an IAM role in the AWS account, and the artifact still has to land in S3 or ECR. If the repos are already on GitHub and the workloads are AWS accounts, Azure DevOps is a second control plane. Prefer the GitHub or CodePipeline path above.
If you want this map turned into the pipeline, the state bucket, and the alarm routing in your accounts, start with [DevOps pipeline setup](https://www.factualminds.com/services/devops-pipeline-setup/).
## What to Do This Week
1. Fill the [layer ownership sheet](https://www.factualminds.com/examples/architecture-blog-2026/devops-automation-tools/layer-ownership.md). If two tools write the same object, name the one that keeps the job and stop the other.
2. Open the CodeBuild usage for one account and compare build minutes with the published example: 100 free minutes on `general1.small` or `arm1.small`, then $0.005 a minute in the on-demand EC2 example on the pricing page.
3. Check that no new service is aimed at CodeCatalyst or App Runner. New container services go to ECS Express Mode or ECS on Fargate.
## What This Post Doesn't Cover
CircleCI, Buildkite, Spacelift, and Atlantis are absent. So is a full Azure DevOps rollout. The paragraph above is the whole treatment. Flux is in the [GitOps comparison](https://www.factualminds.com/blog/aws-gitops-eks-argocd-flux-2026/), not here. CodeCatalyst stays closed to new customers as of 7 November 2025, so it is not a row in the table.
This post does not cover AI coding assistants. Amazon Q Developer IDE plugins reach end of support on 30 April 2027, per the [AWS announcement](https://aws.amazon.com/blogs/devops/amazon-q-developer-end-of-support-announcement/).
The copyable artifact is the [layer ownership sheet](https://www.factualminds.com/examples/architecture-blog-2026/devops-automation-tools/layer-ownership.md). There is still no client engagement and no measured savings figure behind this page. The figures above are the CodeBuild pricing page retrieved 19 October 2026 and the DORA announcement of 23 September 2025.
## FAQ
### When should a team skip Amazon EKS?
Skip EKS when one service is the whole workload. ECS on Fargate, or ECS Express Mode for a new container service, runs that service without a cluster control plane. Add EKS when more than one team already deploys to a cluster and someone owns addons and the GitOps controller.
### When should a team not stand up Jenkins?
Do not start a Jenkins controller when nobody owns its patch cycle and plugin set. The agents still need an IAM role in the AWS account, and the build output still has to land in S3 or ECR. Use CodeBuild, or GitHub Actions with OIDC, until a person is named for the controller.
### Can one suite replace the CI, state, image, and alarm layers?
A suite can host the buttons. The objects stay separate: a pipeline execution, a state file or CloudFormation stack, an image digest, a task, a State Manager association, and an alarm. CodeCatalyst, the AWS suite that tried to hold several of those, closed to new customers on 7 November 2025.
### Where should Terraform state live for an AWS account?
Put the state object in an S3 bucket in the account the pipeline can reach, and lock it with DynamoDB so a second apply waits. CloudFormation does not use that file. CDK synth writes a template, and CloudFormation keeps stack state in the service. See the IaC decision guide linked from this post before mixing the two writers on one resource.
### What should replace AWS App Runner for a new service?
AWS closed App Runner to new customers on 30 April 2026 and points new container services at Amazon ECS Express Mode. You pass a container image and two IAM roles. ECS provisions a Fargate service, an Application Load Balancer, autoscaling, and networking. There is no extra charge for Express Mode. You pay for those resources.
### What goes wrong when Ansible and Systems Manager both configure the same instance?
Two writers fight over the same package, user, or file. The AMI from Image Builder, the State Manager association, and the playbook each look correct in their own log. Pick one owner for each setting. Keep Image Builder for the AMI, State Manager for drift after boot, and Ansible only for playbooks you are not ready to rewrite as SSM documents.
---
*Source: https://www.factualminds.com/blog/aws-devops-automation-tools-2026/*