Skip to content

Commit afd52d9

Browse files
authored
update docs (#90)
1 parent 9bf1111 commit afd52d9

File tree

1 file changed

+12
-107
lines changed

1 file changed

+12
-107
lines changed

README.md

+12-107
Original file line numberDiff line numberDiff line change
@@ -1,121 +1,26 @@
11
# Overview
2-
Shared templates for building out and maintaining Sage Bionetworks
3-
infrastructure on AWS.
2+
This project contains shared templates for building out and maintaining the
3+
Sage Bionetworks infrastructure on AWS.
44

5-
## Create bootstrap
6-
Bootstrapping the account is a one time manual process:
7-
8-
1. Login to the AWS console with the 'root' account.
9-
2. Goto Services -> Cloudformation
10-
3. Run the bootstrap.yaml template
11-
12-
This will create the account (i.e. travis) required to deploy other
13-
CF templates.
14-
15-
## Deploying templates
16-
17-
The travis account by itself does not have permissions to deploy templates.
18-
You must use the travis user credentials to assume the cfservice role to
19-
get permissions to deploy the templates.
20-
21-
1. Setup ~/.aws/credentials file
22-
```
23-
[default]
24-
region = us-east-1
25-
[bridge.dev.travis]
26-
aws_access_key_id = <Access Key>
27-
aws_secret_access_key = <Secret Access Key>
28-
```
29-
30-
2. Setup ~/.aws/config file
31-
```
32-
[default]
33-
region = us-east-1
34-
[profile bridge.dev.cfservice]
35-
role_arn = <CF Service Role Arn>
36-
source_profile = bridge.dev.travis
37-
```
38-
__NOTE__- source_profile needs to match the profile in ~/.aws/credentials file
39-
40-
4. Assume CF service role to deploy templates
41-
```
42-
aws --profile bridge.dev.cfservice --region us-east-1 cloudformation create-stack ...
43-
```
44-
45-
## Create essential resources
46-
47-
Note: The essentials template will setup log aggregation to
48-
[logcentral](https://github.com/Sage-Bionetworks/logcentral-infra). A
49-
pre-requesite for running this template is setup log aggregation from
50-
the the new account into logcentral.
51-
52-
```
53-
aws --profile bridge.dev.cfservice --region us-east-1 \
54-
cloudformation create-stack --stack-name essentials \
55-
--capabilities CAPABILITY_NAMED_IAM \
56-
--template-url https://s3.amazonaws.com/bootstrap-awss3cloudformationbucket-19qromfd235z9/aws-infra/master/essentials.yaml \
57-
--parameters \
58-
ParameterKey=OperatorEmail,ParameterValue="[email protected]" \
59-
ParameterKey=VpcPeeringRequesterAwsAccountId,ParameterValue="123456789012""
60-
```
61-
62-
The above should setup essential resources for new sage accounts. Once
63-
the resources has been setup you can access and view the account using the
64-
[AWS console](https://AWS-account-ID-or-alias.signin.aws.amazon.com/console).
65-
66-
## Create VPC
67-
68-
```
69-
aws --profile bridge.dev.cfservice --region us-east-1 \
70-
cloudformation create-stack --stack-name vpc-bridge-develop \
71-
--capabilities CAPABILITY_NAMED_IAM \
72-
--template-url https://s3.amazonaws.com/bootstrap-awss3cloudformationbucket-19qromfd235z9/aws-infra/master/vpc.yaml \
73-
--parameters \
74-
ParameterKey=VpcName,ParameterValue="vpc-bridge-develop" \
75-
ParameterKey=VpcSubnetPrefix,ParameterValue="172.150"
76-
```
77-
78-
The above should create a custom VPC with a public and private subnet in
79-
multiple availability zones.
80-
81-
## Configure VPC peering to VPN
82-
83-
`Important` - This template must be run in sequence and can only be run after
84-
the peering connection has been created. To create the peering connnection run the
85-
[VPCPeer.yaml](https://github.com/Sage-Bionetworks/admincentral-infra/blob/master/templates/VPCPeer.yaml)
86-
template.
87-
88-
The sequence:
89-
1. Create VPC by running [vpc.yaml](./vpc.yaml) template
90-
2. Setup VPC peering connection by running VPCPeer.yaml
91-
3. Configure the VPC public and private route table with [vpc.yaml](./vpc.yaml) template
92-
93-
```
94-
aws --profile bridge.dev.cfservice --region us-east-1 \
95-
cloudformation create-stack --stack-name peer-vpn-bridge-develop \
96-
--capabilities CAPABILITY_NAMED_IAM \
97-
--template-url https://s3.amazonaws.com/bootstrap-awss3cloudformationbucket-19qromfd235z9/aws-infra/master/peer-route-config.yaml \
98-
--parameters \
99-
ParameterKey=PeeringConnectionId,ParameterValue="pcx-eb02e083" \
100-
ParameterKey=VpcPublicRouteTable,ParameterValue="rtb-f1a9698d" \
101-
ParameterKey=VpcPrivateRouteTable,ParameterValue="rtb-bbb878c7"
102-
```
103-
104-
The above should configure the public and private routes for the VPC with
105-
the peering connection to the VPN. That allows the VPN to direct traffic
106-
to this VPC.
1075

1086
## Validation
109-
We have setup the CI to syntax validate cloudformation templates with cfn-lint.
7+
We have setup cfn-lint to validate templates on every pull request.
1108

1119
## Tests
11210
We have setup the CI to test cloudformation templates with
11311
[taskcat](https://github.com/aws-quickstart/taskcat). Tests get run in the
11412
AWS Admincentral account.
11513

11614
## Continuous Integration
117-
We have configured the CI to deploy CF template to an S3 bucket on the
118-
AWS Admincentral account.
15+
We have configured the CI to deploy CF template to a public S3 bucket on the
16+
AWS Admincentral account. The purpose is to allow us to share those templates.
17+
18+
## Deployments
19+
Templates can be deployed using the AWSCLI. We use [sceptre](https://github.com/cloudreach/sceptre)
20+
for more functionality. Examples of deployments can be found in our
21+
other Sage-Bionetworks/*-infa repos
22+
(i.e. [sandbox-infra](https://github.com/Sage-Bionetworks/sandbox-infra))
23+
11924

12025
# Contributions
12126

0 commit comments

Comments
 (0)