What is Keel?

Keel is the AWS CLI you've always wanted: describe your app once in keel.yml, and a single binary provisions, deploys, and operates it on your own AWS account — driven by one config file and a rich terminal UI.

It looks like a platform, but there isn't one. No servers of ours in the middle, no account of ours holding your app, nothing to sign up for. Keel is a single Go binary that speaks fluent AWS on your behalf: your team's IAM identities, your data, and your bill stay entirely under your control. If you deleted Keel tomorrow, everything it built would still be ordinary, inspectable AWS infrastructure.

What Keel provisions

From a single keel.yml, Keel creates and manages:

• Compute — ECS Fargate services (web, worker, scheduled jobs)
• Networking — VPC with public/private subnets, NAT Gateway, security groups
• Load Balancing — Application Load Balancer with HTTPS
• Container Registry — ECR repository with lifecycle policies
• CI/CD — CodeBuild pipeline that builds and pushes your image
• Database — RDS (PostgreSQL, MySQL, Aurora)
• Cache — ElastiCache (Valkey, Redis)
• DNS & SSL — Route 53 + ACM certificates
• Security — WAF with managed rule sets
• Observability — CloudWatch logs and metrics

Every managed resource is tagged with ManagedBy=keel plus the app and environment it belongs to, and each app+environment is recorded in a DynamoDB app registry so any team member can discover it with keel apps.

Infrastructure modes

The top-level mode in keel.yml controls how much (and how expensive) an infrastructure footprint Keel provisions. It sets the defaults for the load balancer, task placement, and NAT gateway — all of which you can still override individually.

Mode	Load balancer	ECS tasks	NAT gateway	Best for
basic	disabled	public subnets (public IPs)	none	Dev, demos, lowest cost
advanced (default)	enabled (ALB + HTTPS)	private subnets	single	Production-style apps
custom	you decide	you decide	you decide	Full manual control

keel init asks which mode to use (default advanced). Explicit settings in keel.yml — load_balancer.enabled, networking.public_tasks, vpc.nat_gateway — always win over the mode default.

How it works

Keel uses a hybrid approach:

• Infrastructure provisioning (keel up, keel infra plan/apply) flows through OpenTofu. Keel generates HCL from your config, writes .tf files, and runs tofu plan / tofu apply with an S3 state backend and DynamoDB locking.
• Runtime operations (keel deploy, keel logs, keel exec, keel scale) go directly through the AWS SDK for speed — no Terraform round-trip needed.

See Architecture for the full picture.

Next steps

• Getting Started — install, set up auth, and ship your first deploy
• Configuration — the anatomy of keel.yml
• Deploying Rails — a worked example with a web process, a worker, and migrations