Managed BYOC deployment guide

Superblocks deploys and operates Managed BYOC for you. Your team prepares an AWS account, runs a Superblocks-provided Terraform configuration, and hands off to Superblocks, who builds the platform in your account and keeps it running.

Who does what

Your team	Superblocks
Prepares the AWS account that hosts Managed BYOC	Provides the Terraform configuration for your setup
Runs the Terraform and shares the results	Deploys the full platform into your account
Chooses and provides any optional configurations	Applies your configurations as part of a deployment
Creates an SSO application in your identity provider	Configures SSO on your instance
Grants Superblocks break-glass administrative access to your AWS account	Uses that access only for break-glass purposes
Invites builders after go-live	Operates, upgrades, and supports the platform

Deployment stages

Plan your deployment

Work with your Superblocks deployment team to choose an AWS region and identify who on your team will prepare the account, review security, and administer Superblocks.Review the optional configurations and decide which ones to include from day one.

Prepare for deployment

Plan break-glass access. Managed BYOC requires administrative break-glass access to your AWS account for Superblocks. Plan how it’s granted before you run the Terraform.Set up single sign-on. Managed BYOC instances are SSO only, so no one can sign in until SSO is configured. Create an application in your identity provider by following the guide for your provider in Single sign-on.Prepare settings for any optional configurations you chose. For example, if you’re sending telemetry to your own tools, create the observability destinations secret now.

Run the Superblocks Terraform and hand off

Run the Terraform configuration that Superblocks provides in your Managed BYOC account. It sets up two things:

An in-account deployment mechanism that deploys and upgrades Managed BYOC from inside your account.
Cross-account IAM roles that Superblocks uses to trigger deployments and manage your instance.

When the Terraform finishes, tell your deployment team, including which optional configurations you’ve prepared so they’re part of the initial deployment.

Superblocks deploys Managed BYOC

Superblocks deploys the platform into your account and configures SSO and any optional configurations you prepared. Your deployment team lets you know when your instance is ready.

Go live

Sign in to your Managed BYOC instance through your identity provider, then invite your builders. Optionally, set up SCIM to provision users and groups from your identity provider.

Add configurations after go-live

You don’t have to decide everything up front. Optional configurations can be added or changed after go-live: prepare any settings described on the configuration’s page, then tell your Superblocks deployment team. Superblocks applies the change at the next deployment.

Deployment models

Architecture