The blueprint builder: composing infrastructure from bricks that know what fits

TL;DR

Before you can run an environment, someone has to compose the blueprint.

I designed the builder that lets people assemble infrastructure from reusable bricks across technologies, wire inputs and outputs, and add conditional logic, without hand-writing and stitching raw IaC. Like real LEGO, a brick only fits where it should.

The problem

Composing multi-technology infrastructure by hand is expert-only work: you juggle modules, inputs, outputs, versions, and conditionals across tools, and a small mistake surfaces late, at apply time.

That gatekept who could create infrastructure and made blueprints fragile.

The insight

A blueprint is a graph of components that each know what they need and what they give: wired inputs and outputs.

If the builder knows what fits where, it can guide composition (valid connections, allowed-value inputs, sane defaults) and catch mistakes at authoring time instead of apply time.

The solution

• A composition surface where you add bricks, wire outputs into inputs, and configure each input with the right control, including allowed-value inputs and native paths rather than free-form strings. References are picked from a list, never written by hand, so mistakes get caught while you build, not when you deploy.

terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 planstate + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { }vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9Composing a blueprint: adding bricks and wiring them together terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 planstate + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { }vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 planstate + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { }vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 planstate + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { }vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9

• Support for conditional blocks, so one blueprint can adapt across environments.
• The result is a versioned blueprint that then runs through the same plan-apply loop (see the plan-apply case). Versions are what make people brave: pin, upgrade, roll one piece back.

terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 planstate + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9 vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { }vpc deny state + ~ terraform module ingest lock 0 1 apply drift graph { } 9fa3 plan iam helm => b4f aws_s3 allow k8s == 2f9The finished blueprint: bricks wired by inputs and outputs, ready to publish and run

• The design goal throughout was to make heterogeneous composition approachable and hard to get wrong, so more of the team can build infrastructure safely.

Impact

Lowered the skill floor for creating infrastructure and moved whole classes of error from apply-time to author-time.

We measured it with one of our enterprise customers: deploying an environment used to take about a month of tickets, experts, and waiting. With published blueprints, a developer without any infrastructure knowledge did it in under two hours. Infrastructure became self-serve.

Reflection

The leverage was in teaching every brick what it needs and what it gives.

Once the builder knows what each brick expects, the UI can do the remembering so the person does not have to.