Infrastructure

Every AWS resource Morpheus uses is declared in one of two places. There is no console-created infrastructure and no Terraform.

Stack Tool Language Owns

Stack	Tool	Language	Owns
`AgentCoreStack`	AWS CDK	TypeScript	The AgentCore runtime — container image, Bedrock AgentCore runtime and memory, its IAM role, its log group
`morpheus-sam`	AWS SAM	YAML	Five Lambda functions, five layers, three queues and their dead-letter queues, every schedule, the shared secret, one alarm

AgentCoreStack

AWS CDK

TypeScript

The AgentCore runtime — container image, Bedrock AgentCore runtime and memory, its IAM role, its log group

morpheus-sam

AWS SAM

YAML

Five Lambda functions, five layers, three queues and their dead-letter queues, every schedule, the shared secret, one alarm

They deploy independently, share no CloudFormation exports, and reference each other through nothing at all. The coupling between the two halves of the platform is at the data level — the same PostgreSQL database, the same HubSpot portal — not at the infrastructure level.

Page Contents

Page	Contents
CDK stack (AgentCoreStack)	Every construct, the image asset, memory strategies, outputs
SAM template	Globals, parameters, all five functions, outputs
Queues and dead-letter queues	FIFO configuration, visibility timeouts, redrive, partial batch failure
EventBridge schedules	Every rule, its cron or rate expression, and its `Input` payload
Lambda layers	The five layers, layer order, and how they are built
Secrets Manager	The two secrets, every key, and how each unit loads them
IAM	Runtime role policies, SAM-generated roles, the permission model
Observability	Sentry, CloudWatch, X-Ray, the Bedrock token alarm

CDK stack (AgentCoreStack)

Every construct, the image asset, memory strategies, outputs

SAM template

Globals, parameters, all five functions, outputs

Queues and dead-letter queues

FIFO configuration, visibility timeouts, redrive, partial batch failure

EventBridge schedules

Every rule, its cron or rate expression, and its Input payload

Lambda layers

The five layers, layer order, and how they are built

Secrets Manager

The two secrets, every key, and how each unit loads them

IAM

Runtime role policies, SAM-generated roles, the permission model

Observability

Sentry, CloudWatch, X-Ray, the Bedrock token alarm

Deploying

make deploy-cdk       # cd cdk && npx cdk bootstrap && npm run cdk:deploy
make deploy-lambdas   # cd lambdas && make deploy

make deploy-lambdas regenerates every function’s requirements.txt with uv export --no-dev --no-hashes before running sam build --no-cached && sam deploy. That regeneration step is why a dependency change made in a pyproject.toml reaches Lambda without anyone editing a requirements.txt by hand.

Single functions can be deployed alone — make deploy-scraper, deploy-scorer, deploy-hubspot, deploy-email-agent, deploy-phone-agent — each of which syncs only that function’s requirements and builds only that function. Full details in Deployment.

There is no deployment pipeline. The only GitHub Actions workflow is .github/workflows/security-review.yml, which runs an AI security and architecture review on pull requests. It does not build, test, or deploy anything. Every deploy is a developer running make against 625663093496.

Architecture split

The two stacks target different CPU architectures, and neither is negotiable independently.

Unit Architecture Why

Unit	Architecture	Why
AgentCore container	`arm64`	`DockerImageAsset` defaults to `Platform.LINUX_ARM64`. The `LINUX_AMD64` alternative is present but commented out in `cdk/bin/cdk.ts`.
Lambda functions	`x86_64`	Set in the SAM `Globals` block. Layers declare `CompatibleArchitectures: [x86_64]` to match.

AgentCore container

arm64

DockerImageAsset defaults to Platform.LINUX_ARM64. The LINUX_AMD64 alternative is present but commented out in cdk/bin/cdk.ts.

Lambda functions

x86_64

Set in the SAM Globals block. Layers declare CompatibleArchitectures: [x86_64] to match.

A layer built for one architecture will not load on a function running the other, so changing the SAM architecture means changing all five layer declarations in the same commit.

What is not in code

Three things the stacks reference but do not create:

Resource Where it comes from

Resource	Where it comes from
The secret value of `agentcore-configs`	SAM creates an empty secret; the JSON is populated by hand. See Secrets Manager.
The SNS topic `security-operational-issues`	Referenced by `BedrockTokenAlarm` as an alarm action, created outside this repository.
The BigQuery views under `bigquery/`	Applied manually with `bq query`. See BigQuery views.

The secret value of agentcore-configs

SAM creates an empty secret; the JSON is populated by hand. See Secrets Manager.

The SNS topic security-operational-issues

Referenced by BedrockTokenAlarm as an alarm action, created outside this repository.

The BigQuery views under bigquery/

Applied manually with bq query. See BigQuery views.

Each is a place where a fresh environment will deploy cleanly and then misbehave at runtime. The bootstrap sequence for a new account is in Deployment.