Infrastructure

Visit willfarrell/terraform-aws-template for the latest improvements and most up to date documentation.

Accounts

Name	Account ID	Colour	Root Email
master		------
production		Red
staging		Orange
testing		Yellow
development		Green
operations		Blue
forensics		Purple

Project Structure

${project}-infrastructure
|-- package.json	# Script shortcuts (lint, install, deploy, test) & versioning?
|-- amis            # Collection of AMIs, built by Packer
|   |-- {name}      # AMI folders, ie bastion, ecs, nat or custom ones
|-- master			# Setup for root level account
|   |-- state		# Sets up state management for terraform
|   |-- account     # Account setup (Groups, Monitoring)
|   |-- operations	# Setup for operation pieces
|-- environments
|   |-- account     # Account setup (Roles, Monitoring)
|   |-- domain		# Domain specific VPC, App, API, ECS, etc. Rename folder to `name`.
|-- modules			# Collection of project specific modules

Getting Started

For up to date documentation and modules see terraform-aws-template.

Installing CLIs

$ brew install terraform

# Optional, for building AMIs
$ brew install packer

• AWS CLI
• AWS SSM Plugin
• AWS ECS CLI

Setup Terraform Workspaces

To create the workspaces, go to the respective subfolder (/environments/*/), and run:

$ terraform init
$ terraform workspace new production
$ terraform workspace new staging
$ terraform workspace new testing
$ terraform workspace new development

Ensure you have the right workspace selected before you apply.

$ terraform workspace select development
$ terraform workspace list

Setup Multi-Accounts

See [docs](./docs/Multi Account Setup.md) for detailed steps.

Build AMIs

To create the AMIs, go to the respective subfolder (/amis/*/), edit the variables.json, and run:

$ packer build -var-file=variables.json ami.json

See docs for configuration and full documentation.

Install node dependencies

$ npm run install:npm

Switch Roles

• OrganizationAccountAccessRole: Admin Access

It is recommended that the account/roles module be forks to customized to specific needs

Manual Steps

• Well-Architected Tool
• Trust Advisor
• Macie

Deployment Steps

1. Build an AMIs that will be needed

packer build -var-file=variables.json ami.json

1. master/state

2. master/account

   • Users (Manual)
   • Macie (Manual)
   • Sub-Accounts / Organization
   • Groups for sub account access
   • Roles for sub accounts (bastion, ECR)
   • AMI permissions
   • CloudTrail
   • GuardDuty
   • Security Hub

3. Switch Roles into each sub-account using OrganizationAccountAccessRole. Create a terraform user to bootstrap assume roles. Be sure to delete the user after you bootstrap

4. Setup terraform workspaces Run the following in each environments folder

terraform workspace new production
terraform workspace new staging
terraform workspace new testing
terraform workspace new development
terraform workspace select ${sub_account_name}

1. environment/account

   • Roles (admin, developer, operator, audit, etc)
   • API Gateway Logs
   • CloudTrail
   • GuardDuty
   • Inspector Agent
   • Macie (Manual)

2. At this point you'll need to update your AWS credentials. Update ~/.aws/credentials:

[${profile}-${sub_account_name}]
source_profile = ${profile}
role_arn = arn:aws:iam::${sub_account_id}:role/admin
session_name = ${profile}-${sub_account_name}

1. environment/domain
   • VPC
   • VPC Endpoints (S3, DynamoDB)
   • Bastion
   • RDS (postgres,mysql)
   • ElasticCache (redis)
   • ElasticSearch
   • DynamoDB
   • ALB + ECS
   • NLB + ECS
   • ECS
   • API Gateway
   • Events, SQS, SNS, Lambda, S3,
   • CloudFront
   • S3
   • CloudWatch Dashboards

Built With

• Terraform
• Packer
• NodeJS

Modules

• state module
• account modules
• logs module
• VPC module
• DB modules
• EC modules
• WAF module
• LB module
• IdP module - TODO
• CDN module

Contributing

See Developer Guide (TODO add link)

Versioning

We use SemVer for versioning. For the versions available, see the tags on this repository.

Authors

• will Farrell

See also the list of contributors who participated in this project.

License

This project is licensed under the MIT License - see the LICENSE file for details

Acknowledgments