|
1 | 1 | # Overview
|
2 |
| -Shared templates for building out and maintaining Sage Bionetworks |
3 |
| -infrastructure on AWS. |
| 2 | +This project contains shared templates for building out and maintaining the |
| 3 | +Sage Bionetworks infrastructure on AWS. |
4 | 4 |
|
5 |
| -## Create bootstrap |
6 |
| -Bootstrapping the account is a one time manual process: |
7 |
| - |
8 |
| -1. Login to the AWS console with the 'root' account. |
9 |
| -2. Goto Services -> Cloudformation |
10 |
| -3. Run the bootstrap.yaml template |
11 |
| - |
12 |
| -This will create the account (i.e. travis) required to deploy other |
13 |
| -CF templates. |
14 |
| - |
15 |
| -## Deploying templates |
16 |
| - |
17 |
| -The travis account by itself does not have permissions to deploy templates. |
18 |
| -You must use the travis user credentials to assume the cfservice role to |
19 |
| -get permissions to deploy the templates. |
20 |
| - |
21 |
| -1. Setup ~/.aws/credentials file |
22 |
| -``` |
23 |
| -[default] |
24 |
| -region = us-east-1 |
25 |
| -[bridge.dev.travis] |
26 |
| -aws_access_key_id = <Access Key> |
27 |
| -aws_secret_access_key = <Secret Access Key> |
28 |
| -``` |
29 |
| - |
30 |
| -2. Setup ~/.aws/config file |
31 |
| -``` |
32 |
| -[default] |
33 |
| -region = us-east-1 |
34 |
| -[profile bridge.dev.cfservice] |
35 |
| -role_arn = <CF Service Role Arn> |
36 |
| -source_profile = bridge.dev.travis |
37 |
| -``` |
38 |
| -__NOTE__- source_profile needs to match the profile in ~/.aws/credentials file |
39 |
| - |
40 |
| -4. Assume CF service role to deploy templates |
41 |
| -``` |
42 |
| -aws --profile bridge.dev.cfservice --region us-east-1 cloudformation create-stack ... |
43 |
| -``` |
44 |
| - |
45 |
| -## Create essential resources |
46 |
| - |
47 |
| -Note: The essentials template will setup log aggregation to |
48 |
| -[logcentral](https://github.com/Sage-Bionetworks/logcentral-infra). A |
49 |
| -pre-requesite for running this template is setup log aggregation from |
50 |
| -the the new account into logcentral. |
51 |
| - |
52 |
| -``` |
53 |
| -aws --profile bridge.dev.cfservice --region us-east-1 \ |
54 |
| -cloudformation create-stack --stack-name essentials \ |
55 |
| ---capabilities CAPABILITY_NAMED_IAM \ |
56 |
| ---template-url https://s3.amazonaws.com/bootstrap-awss3cloudformationbucket-19qromfd235z9/aws-infra/master/essentials.yaml \ |
57 |
| ---parameters \ |
58 |
| -ParameterKey=OperatorEmail,ParameterValue="[email protected]" \ |
59 |
| -ParameterKey=VpcPeeringRequesterAwsAccountId,ParameterValue="123456789012"" |
60 |
| -``` |
61 |
| - |
62 |
| -The above should setup essential resources for new sage accounts. Once |
63 |
| -the resources has been setup you can access and view the account using the |
64 |
| -[AWS console](https://AWS-account-ID-or-alias.signin.aws.amazon.com/console). |
65 |
| - |
66 |
| -## Create VPC |
67 |
| - |
68 |
| -``` |
69 |
| -aws --profile bridge.dev.cfservice --region us-east-1 \ |
70 |
| -cloudformation create-stack --stack-name vpc-bridge-develop \ |
71 |
| ---capabilities CAPABILITY_NAMED_IAM \ |
72 |
| ---template-url https://s3.amazonaws.com/bootstrap-awss3cloudformationbucket-19qromfd235z9/aws-infra/master/vpc.yaml \ |
73 |
| ---parameters \ |
74 |
| -ParameterKey=VpcName,ParameterValue="vpc-bridge-develop" \ |
75 |
| -ParameterKey=VpcSubnetPrefix,ParameterValue="172.150" |
76 |
| -``` |
77 |
| - |
78 |
| -The above should create a custom VPC with a public and private subnet in |
79 |
| -multiple availability zones. |
80 |
| - |
81 |
| -## Configure VPC peering to VPN |
82 |
| - |
83 |
| -`Important` - This template must be run in sequence and can only be run after |
84 |
| -the peering connection has been created. To create the peering connnection run the |
85 |
| -[VPCPeer.yaml](https://github.com/Sage-Bionetworks/admincentral-infra/blob/master/templates/VPCPeer.yaml) |
86 |
| -template. |
87 |
| - |
88 |
| -The sequence: |
89 |
| -1. Create VPC by running [vpc.yaml](./vpc.yaml) template |
90 |
| -2. Setup VPC peering connection by running VPCPeer.yaml |
91 |
| -3. Configure the VPC public and private route table with [vpc.yaml](./vpc.yaml) template |
92 |
| - |
93 |
| -``` |
94 |
| -aws --profile bridge.dev.cfservice --region us-east-1 \ |
95 |
| -cloudformation create-stack --stack-name peer-vpn-bridge-develop \ |
96 |
| ---capabilities CAPABILITY_NAMED_IAM \ |
97 |
| ---template-url https://s3.amazonaws.com/bootstrap-awss3cloudformationbucket-19qromfd235z9/aws-infra/master/peer-route-config.yaml \ |
98 |
| ---parameters \ |
99 |
| -ParameterKey=PeeringConnectionId,ParameterValue="pcx-eb02e083" \ |
100 |
| -ParameterKey=VpcPublicRouteTable,ParameterValue="rtb-f1a9698d" \ |
101 |
| -ParameterKey=VpcPrivateRouteTable,ParameterValue="rtb-bbb878c7" |
102 |
| -``` |
103 |
| - |
104 |
| -The above should configure the public and private routes for the VPC with |
105 |
| -the peering connection to the VPN. That allows the VPN to direct traffic |
106 |
| -to this VPC. |
107 | 5 |
|
108 | 6 | ## Validation
|
109 |
| -We have setup the CI to syntax validate cloudformation templates with cfn-lint. |
| 7 | +We have setup cfn-lint to validate templates on every pull request. |
110 | 8 |
|
111 | 9 | ## Tests
|
112 | 10 | We have setup the CI to test cloudformation templates with
|
113 | 11 | [taskcat](https://github.com/aws-quickstart/taskcat). Tests get run in the
|
114 | 12 | AWS Admincentral account.
|
115 | 13 |
|
116 | 14 | ## Continuous Integration
|
117 |
| -We have configured the CI to deploy CF template to an S3 bucket on the |
118 |
| -AWS Admincentral account. |
| 15 | +We have configured the CI to deploy CF template to a public S3 bucket on the |
| 16 | +AWS Admincentral account. The purpose is to allow us to share those templates. |
| 17 | + |
| 18 | +## Deployments |
| 19 | +Templates can be deployed using the AWSCLI. We use [sceptre](https://github.com/cloudreach/sceptre) |
| 20 | +for more functionality. Examples of deployments can be found in our |
| 21 | +other Sage-Bionetworks/*-infa repos |
| 22 | +(i.e. [sandbox-infra](https://github.com/Sage-Bionetworks/sandbox-infra)) |
| 23 | + |
119 | 24 |
|
120 | 25 | # Contributions
|
121 | 26 |
|
|
0 commit comments