Why we build SaaSLayer on top of AWS instead of hiding AWS

There's a familiar arc for infrastructure products: start as a convenience layer over a cloud, grow opinions, and end up as a wall between you and the infrastructure you're paying for. The abstraction is lovely until the day you need a VPC peering, a compliance answer, or a cost breakdown — and discover your own stack is a black box.

SaaSLayer takes the opposite position: it is an experience layer on top of AWS, not a replacement for it.

What that means concretely

Real AWS resources, in accounts you can see. A SaaSLayer Instance is a set of CloudFormation-managed stacks: Cognito pools, DynamoDB tables, Lambda functions, EventBridge buses, KMS keys. In cloud-prem mode they live in your AWS account — auditable with the tools you already use, covered by the compliance story you already have.

The hot path stays in your infrastructure. Permission checks read your DynamoDB tables. Events flow through your EventBridge. There is no SaaSLayer-shaped proxy in the middle of your request path, which is also why checks stay one read.

Modules, not a monolith. Each service — users, RBAC, event delivery — is independently deployable with its outputs recorded in a manifest registry. Your product discovers endpoints from manifests; nothing is hardcoded, and no module needs the others to exist.

Why not hide it?

Hiding the cloud is tempting because it demos well. But SaaS infrastructure is precisely the domain where teams eventually need the escape hatch: the big customer who requires data in their own account, the auditor who wants resource-level answers, the engineer who needs to trace a latency spike to a specific table.

An experience layer should make the common path effortless and leave the underlying system legible. That's the standard AWS itself set with its primitives — and the reason we describe SaaSLayer as AWS-backed rather than AWS-flavored.

If your team is weighing hosted convenience against infrastructure you can still reason about, the deployment modes doc shows the spectrum — including running everything in your own account.