Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Feat static bootstrap stack names #712

Merged

Commits on Apr 5, 2024

  1. Feat change to static bootstrap stack names

    **Why?**
    
    Initially, ADF would generate bootstrap stack names that included the name
    of the OU at the end. For example, for an OU named banking, it would generate
    the global `adf-global-base-banking` stack.
    
    This, however, makes it harder to harden ADF. As it would need access rights
    to deploy and manage CloudFormation stacks with a wildcard at the end.
    Instead of listing a limited number of stack names.
    
    Additionally, it makes it harder to write an SCP to limit who can update these
    stacks as well.
    
    **What?**
    
    * Instead of using the OU name, the bootstrap stacks will be named:
      `adf-(global|regional)-base-bootstrap`.
    * Exception being the `adf-(global|regional)-base-deployment` stack,
      as this stack contains the resources that ADF needs to operate.
      As well as the `adf-global-base-adf-build` stack that gets deployed to the
      management account.
      Renaming these stacks would require uninstalling ADF and reinstalling it from
      scratch. Hence these are kept as-is.
    * Tightened the IAM policies that grant access to manage the bootstrap stacks.
    * Added a functionality to delete deprecated stacks automatically and upgrade
      to the new stack name via the `aws-deployment-framework-bootstrap` pipeline.
    * When a deprecated bootstrap stack is deleted, it will first delete the
      global-iam stack if required. As the global-iam stack adds policies to the
      roles that are created in the bootstrap stack. Therefore, the global-iam
      stack should be removed before the bootstrap stack can be deleted in the
      global region.
    * Fix CloudFormation Stack/ChangeSet waiter error capture, to report back the
      account, region, and stack name that ran into a failure when needed.
    sbkok committed Apr 5, 2024
    Configuration menu
    Copy the full SHA
    590ff8b View commit details
    Browse the repository at this point in the history

Commits on Apr 6, 2024

  1. Configuration menu
    Copy the full SHA
    ae86ac5 View commit details
    Browse the repository at this point in the history

Commits on Apr 8, 2024

  1. Fixup

    sbkok committed Apr 8, 2024
    Configuration menu
    Copy the full SHA
    0e5ae1b View commit details
    Browse the repository at this point in the history