Skip to content

Latest commit

 

History

History
59 lines (37 loc) · 2.78 KB

set-up-aws-account.md

File metadata and controls

59 lines (37 loc) · 2.78 KB

Set up AWS account

The AWS account setup process will:

  1. Create the Terraform backend resources needed to store Terraform's infrastructure state files. The project uses an S3 backend.
  2. Create the OpenID connect provider in AWS to allow GitHub Actions to access AWS account resources.
  3. Create the IAM role and policy that GitHub Actions will use to manage infrastructure resources.

Prerequisites

Instructions

1. Make sure you're authenticated into the AWS account you want to configure

The account set up sets up whatever account you're authenticated into. To see which account that is, run

aws sts get-caller-identity

To see a more human readable account alias instead of the account, run

aws iam list-account-aliases

2. Create backend resources and tfbackend config file

Run the following command, replacing <ACCOUNT_NAME> with a human readable name for the AWS account that you're authenticated into. The account name will be used to prefix the created tfbackend file so that it's easier to visually identify as opposed to identifying the file using the account id. For example, you have an account per environment, the account name can be the name of the environment (e.g. "prod" or "staging"). Or if you are setting up an account for all lower environments, account name can be "lowers". If your AWS account has an account alias, you can also use that.

make infra-set-up-account ACCOUNT_NAME=<ACCOUNT_NAME>

This command will create the S3 tfstate bucket and the GitHub OIDC provider. It will also create a [account name].[account id].s3.tfbackend file in the infra/accounts directory.

3. Check that GitHub actions can authenticate into the AWS account

This step requires GitHub CLI to be installed and configured to authenticate with your GitHub account. If you don't have it, you can install on Mac via brew install gh

make infra-check-github-actions-auth ACCOUNT_NAME=<ACCOUNT_NAME>

Making changes to the account

If you make changes to the account terraform and want to apply those changes, run

make infra-update-current-account

Destroying infrastructure

To undeploy and destroy infrastructure, see instructions on destroying infrastructure.