# DevOps layer ownership sheet

Use with [Which DevOps Tool Owns Each Layer on AWS](/blog/aws-devops-automation-tools-2026/). Checked 20 October 2026.

Fill one row per layer from the account you actually deploy. Leave a cell blank when you have not named the writer. A blank cell is not a default.

| Layer | Object it writes | Tool that writes it | AWS account | IAM role the run assumes | Second writer to stop |
| --- | --- | --- | --- | --- | --- |
| CI/CD | Pipeline execution, then an S3 object or an ECR digest | | | | |
| IaC | CloudFormation stack, or a state object in S3 with a DynamoDB lock | | | | |
| Containers | Image digest, then a task or a pod | | | | |
| Configuration | AMI id, then files on an instance | | | | |
| Observability | Time series and the alarm someone routes | | | | |
| Orchestration | EventBridge rule, then a Step Functions execution or an SSM Automation document | | | | |

## Checks before you add a tool

- CodeBuild minutes last month, and the compute type. The pricing page example retrieved 19 October 2026 is 100 free minutes on `general1.small` or `arm1.small`, then $0.005 a minute in the on-demand EC2 example. Write your minutes here. Do not copy the $2 example in as your bill.
- New container services go to ECS Express Mode or ECS on Fargate. App Runner stopped taking new customers on 30 April 2026.
- New spaces do not go to CodeCatalyst. It stopped taking new customers on 7 November 2025.
- A Jenkins controller, an EKS cluster, or a Datadog export needs a named owner. If the owner cell is empty, do not add that controller.

## Stop

- Two tools writing the same security group, package, or alarm.
- A long-lived access key on a GitHub, GitLab, or Jenkins runner. The job assumes a role. The artifact lands in S3 or ECR in the target account.
- Incident Manager and Change Manager for a new process. Both have been on the AWS maintenance list since 7 November 2025. State Manager and Automation are the live Systems Manager path.