Skip to content

ADR-004: Distributed Cloud Account Provisioning

Status: Approved (target state, deferred post-v1)

Date: 2026-06-30

Decision

Cloud account provisioning (AWS Organizations, GCP Folders, Azure Subscriptions) will be handled by a Cloud Factory XRD running inside each client control plane, not by a central management plane operator.

v1 Scope

Cloud Factory is not in scope for v1. For the pilot and early clients, cloud accounts are created manually or via simple scripts. The Cloud Factory XRD will be implemented in a post-v1 release once the core platform is validated.

Rationale

  • Self-contained client clusters — no cross-cluster secret synchronization required
  • Clients can provision additional cloud accounts on-demand via Backstage
  • Failure isolation — one client's Cloud Factory does not affect others
  • Aligns with "reusability over customization" — same XRD, different parameters

Bootstrap Problem Resolution (Target State)

  • Each client cluster starts with a single 7kgroup-bootstrap ProviderConfig
  • This bootstrap config has minimal permissions (e.g., organizations:CreateAccount in AWS)
  • Cloud Factory XRD uses bootstrap credentials to create dedicated accounts
  • Dedicated accounts generate new ProviderConfigs; bootstrap config is retired

Supported Clouds (Target State)

  • AWS (Organizations + SCPs)
  • GCP (Folders + Projects)
  • Azure (Management Groups + Subscriptions)