Build1 publisher3 min readPublished
Nx Plugin for AWS 1.0 generates four KMS keys and three web ACLs before the first feature lands
One developer took Nx Plugin for AWS 1.0, the AWS Blocks preview and Amplify Gen 2 to the same file-portal scope, deployed all three against one FSx for ONTAP access point, then deleted everything to see what stayed behind.
The Engineer · Build desk
What happened
- Nx Plugin for AWS reached 1.0 and AWS Blocks arrived in preview, so a new AWS application now has three scaffolding front doors to choose between.
- One developer took all three to the same scope, counted the generated resources the same way, deployed each for real, built four features on each, then deleted everything.
- After teardown, log groups that never appeared in the template were still there on never-expire retention, and KMS keys reported DELETE_COMPLETE while scheduled for deletion 30 days out.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- cost The scaffold choice sets a monthly floor that low traffic cannot reduce. A demo parked on the Nx defaults bills like a production perimeter until someone deletes it.
- exposure An account whose stacks all read deleted can still be storing log data forever, so post-experiment cleanup falls on a human with the console open.
- constraint A teardown is not final for a month. Anyone auditing key inventory or rerunning the same deployment in that window is working around keys that were reported gone.
- decision Because the data path below the access point is common to all three, a team can change scaffolding tools later without touching the FSx for ONTAP side. The choice is reversible.
CloudFormation removes what the template declares. Log groups that were never in the template sit outside that contract, so they stayed after the stack came down, on never-expire retention [8]. KMS keys behave differently again: the status reads DELETE_COMPLETE while the key is scheduled for deletion after a 30-day wait [9]. All three stacks deployed without trouble, and the differences showed up only after the delete [10].
On the Nx path the perimeter is two AWS WAF web ACLs on the request path plus a third in a separate us-east-1 stack. Amazon Cognito sits on PLUS with MFA required, and there are four KMS keys [5]. That makes three web ACLs [19]. Amplify Gen 2 creates none of that by default: no WAF, no customer managed KMS keys, and Cognito on the ESSENTIALS tier [3]. The AWS Blocks production preset has no Cognito at all. Authentication moves into AuthBasic, DynamoDB plus JWTs, across four tables that all carry deletion protection, two of them for auth [4]. That leaves two tables for application data [20].
The post names those three Nx items as the fixed-cost difference and says the generated defaults imply a fixed monthly cost at zero requests [6][7]. It does not state a monthly amount [23]. The count is what carries into someone else's estimate: three web ACLs, four keys, one Cognito tier above the default.
For those counts to mean anything in another repository, the scope has to match. Here that is web, auth, API and one table, over a data path identical below the S3 Access Point in all three builds [11]. The presets also have to be taken as generated. A team that turns MFA off, drops a web ACL or picks a Blocks preset other than production is counting a different stack. The article puts "which tool is better" out of scope [21].
Functionally the three were hard to tell apart. Sign in, list, read and upload ran on each against the same prefix of 13 objects, the same 1,615-byte markdown file and the same 24-byte write, and all three returned the same values [12][13]. The visible differences were in the generated front end. The Nx build came with a shadcn sidebar, and the Amplify Gen 2 portal hands .md to an AI Assistant panel where the other two render the report in the page [14].
The exercise started from a Zenn article by an AWS solutions architect that compared the same three tools [15]. The author found that thin as a basis for a decision in an actual repository, and wrote that "you have to deploy and delete before you can say you compared anything" [16]. Nothing was created or deleted on the FSx for ONTAP side during the verification [17]. Every build reached the access point the same way: the alias passed as a bucket name to the standard S3 SDK, with no endpoint override and no VPC attachment [18].
What to watch
- A published dollar figure for each path's fixed monthly cost at zero requests; the comparison gives resource counts only.
- Whether AWS Blocks leaves preview with the production preset's four deletion-protected tables and AuthBasic still the default.
- Whether Nx Plugin for AWS adds a preset that omits the separate us-east-1 web ACL stack.