Pre-work Checklist: DevOps-Security-Member: [Sevag Bairamian]

Start with CONTRIBUTING.md, especially the AWS account, IAM, CLI, backend state, Terraform, and Terraform Docs sections. Follow the checklist from aws sts get-caller-identity, then inspect aws-user.tf and the terraform directory before running terraform init, plan, and apply. Done means the IAM user configuration is added, Terraform succeeds, the README is regenerated, and the changes are committed and pushed.

Prerequisite

We are looking forward to having you on our team. Please ensure you have prior experience with the HfLA website team before contributing to our repository.

Overview

As a new member on the HfLA devops-security team, fill in the following fields as you complete each onboarding item.

Special Notes

1. Keep this issue open until you've completed all steps, including learning to provide updates for longer tasks.
2. Normally, handle one issue at a time, but this one is an exception as it teaches how to manage multiple tasks.
3. Work on action items sequentially, but proceed if possible. For example, set up your dev environment without waiting for the weekly meeting.

Action Items

• Before starting to work on the below instructions, make sure to join the #ops Slack Channel. And are a member of devops-security repository.

• Self-assign this issue (gear in right side panel).

• Select a role label (gear in label section on the right). They begin with "role:". This should be what you want to do in the DevOps CoP

• Change the issue status to 'in progress' (right side panel).

• Add this issue to the Project Board CoP: DevOps: Project Board - under the Projects section (gear in right side panel).

• Attend the weekly DevOps CoP team meeting. See CoP Meetings on the wiki for the time, which weeks we skip, and how to get onto the calendar invite.

• Complete the steps in Creating a personal AWS account and Login as root user & setup MFA.

• Read and follow the instructions in Setting up IAM and AWS CLI for:

  • Creating an IAM User
  • Creating an IAM Group
  • Attaching IAM user to IAM Group
  • Providing AdministratorAccess policy to IAM group
  • Log in as the newly created user instead of continuing to log in as the root user (it is not recommended to login with root access).
  • Generating user access keys

• Complete the instructions in AWS Documentation and choose your operating system to install AWS CLI.

• Complete the instruction in AWS Documentation to setup the AWS CLI.

• Follow the instructions in Creating a backend state to create the S3 bucket and DynamoDB table.

  • Create the S3 bucket
  • Create the DynamoDB table

• Install Terraform locally by following the instructions of the installation guide mentioned in Installing Terraform

• Install Terraform Docs locally by following the instructions of the installation guide mentioned in Installing Terraform docs

• Complete the instructions in Clone the repository

• Submit a new request to create new AWS user account and then self-assign this issue.

• Create a new branch from main by executing the command

  git checkout -b issue-number-add-new-iam-user
  
  

• Navigate to the aws-user.tf file and add your user information to the end of the file following the below template.

  # Replace USERNAME with your GitHub handle
  module "iam_user_USERNAME" {
    source = "./modules/aws-users"
  
    user_name = "USERNAME" # Replace with GitHub handle
    user_tags = {
      "Project"      = "devops-security"
      "Access Level" = "1"
    }
    user_groups = ["read-only-group"]
  }
  
  

• In your code editor navigate to terraform directory. cd terraform

Note: You must be authenticated to your AWS account via the CLI for the next commands to work. The above instructions for setting up the CLI will guide you through this process. To check to see if you are authenticated, run aws sts get-caller-identity. You should get a response like:

{
    "UserId": "ABCDEFGHIJKLMNOPQRSTU",
    "Account": "012345678910",
    "Arn": "arn:aws:iam::012345678910:user/USERNAME"
}

If you are unable to authenticate from your local machine using the CLI, post in the #ops channel in Slack so that the team can help you get unblocked.

• Execute the command terraform init to initialize terraform in the directory. Address any failures that arise (if any).
• Execute the command terraform plan this will output a plan replicating the same IAM resources as the devops security account. Address any failures that arise (if any).
• Then execute the command terraform apply this will create all of the resources that are currently managed by Devops Security. All of the resources created here incur zero cost except for the Dynamo DB installation, which should remain in the free tier. **
  • If you have cost concerns, Run a Terraform Destroy to take down all of the resources you created (don't worry, you can recreate them just as quickly). If you create resources outside of what's described in this issue, you may incur charges.
• Update the README using Terraform Docs to document changes
  • terraform-docs -c .terraform.docs.yml .
• Once you have tested your changes, stage them in git with
  • git status command.
  • then git add path/to/file (you can copy from above output for the file path).
• Commit the changes by executing git commit -m "brief description of changes".
• Push the changes with git push --set-upstream origin name-of-branch