Skip to main content
Amends 0171 (decision 2: @stackra/infra-gcp joins the infrastructure packages, which are no longer AWS-only), 0172 (decision 1: one AWS account per product and region) and 0352 (decisions 3 and 4: Runway plans and applies GCP as well as AWS), each by a Note. The region mechanism is 0353.

​
Context

0171 and 0172 assumed one cloud, AWS, with one account per product. Some jurisdictions need in-country hosting where AWS has no region yet while GCP has one (for example Saudi Arabia). The owner decided on 2026-10-25 (OS rounds 1 and 2) that Stackra supports both AWS and GCP, and that accounts are split per product and region. Which cloud region serves which Figentra region, and how KSA, Egypt and a future AWS Saudi region are handled, are Figentra’s choices, recorded in Figentra OS ADR 0001 (0259, owner round 22).

​
Decision

  1. Two clouds. Stackra deploys to AWS and GCP. No other cloud is supported without a new ADR (OS-3, round 2).
  2. One AWS account per product-region. Each product gets one AWS account in each region it runs in, plus the one shared and tooling account (OS-1). This replaces “one AWS account per product” in 0172 decision 1; the rest of that decision (environments by IAM roles, tags and service control policies, Identity Center, no IAM users) stands.
  3. @stackra/infra-gcp. A new package in the infrastructure category holds the GCP Pulumi components, beside @stackra/infra-aws (0171 decision 2). Its licensing follows 0171 decision 5: the foundation is free, an own-cloud runtime stack is @stackra-pro.
  4. A cloud dimension in runway.yaml. Each region or deployment in runway.yaml names its cloud (AWS or GCP) and its cloud region. The field names are set by the Runway schema, not here.
  5. Runway drives both clouds. stackra runway infra preview|up drives the @stackra/infra-aws and @stackra/infra-gcp components through the Pulumi Automation API (0352 decision 4). A GCP target is a Runway provider behind the same port (plan, apply, verify, rollback, 0352 decision 3). There is no second tool.

​
Consequences

  • Budgets, blast radius and residency evidence are separate per product and jurisdiction; there are more AWS accounts to create and watch (0172 decision 5 applies per account).
  • Every service that touches the cloud needs a driver for both clouds where it differs: object storage, queues, secrets sync and malware scanning (ClamAV where GuardDuty is not offered, OS-142).
  • figentra/infra holds GCP stack state and config as well as AWS (0289 decision 9).

​
Enforcement

planned — the Runway schema refuses a region or deployment without a cloud; @stackra/infra-aws creates one account per product-region through Organizations; @stackra/infra-gcp conformance tests run against the same provider port (STA-72, STA-607).

​
Open questions

  1. Runtime on GCP. 0170 decision 3 runs the OS on Encore Cloud on our AWS. Whether a GCP stack runs on Encore Cloud on our GCP or on another runtime is not decided.
  2. GCP layout. Whether GCP uses one project per product and region, mirroring decision 2, is not decided.

​
Supersedes and sources

Supersedes: none. Amends 0171 decision 2, 0172 decision 1 and 0352 decisions 3 and 4. Where each cloud runs for Figentra (AWS UAE and Frankfurt, GCP Dammam for KSA in-country, AWS Saudi when it opens), Egypt (me tenants served from AWS UAE, counsel checks Law 151 first; owner round 22) and the KSA questions are Figentra OS ADR 0001. Sources: owner decisions in chat, 2026-10-25, OS rounds 1, 2 and 22: OS-1, OS-2, OS-3 (notes/handover/os/owner-answers.md); the default OS-142 (notes/handover/os/default-applied.md); notes/handover/360/adapter-readiness-and-missing-packages.md.