Skip to content

AWS ‐ Personal Account

Jump to bottom
Geoffrey Choy edited this page Jan 7, 2025 · 21 revisions

Essentials

  • IAM user: gchoy
  • Account ID: 398018169858

Since AWS IDs may change on TF updates, the use of names is preferred here.

Use - as the delimiter for naming where possible as AWS doesn't like _ a lot of the times. TF variables should use the _ though.

Networking

VPC

  • VPC: main_vpc
  • VPC CIDR (ipv4): 10.0.0.0/16
  • ipv6 is auto assigned
  • An internet gateway is needed with a route table with routes for public traffic to the internet gateway

Subnets

Name CIDR Block
main_subnet_public1 10.0.1.0/24
main_subnet_public2 10.0.2.0/24
Reserved - Future public resources 10.0.3.0/24
main_subnet_private1 10.0.10.0/24
main_subnet_private2 10.0.11.0/24
Reserved - Future database subnet 10.0.20.0/24

The idea to split the IP blocks into large, obvious blocks so that they can be easily distinguished.

Security Groups

Essentially virtual firewalls.

Name Rules
ec2-jump-box-ssh-sg Inbound SSH 22, laptop IP
ec2-jump-box-ssh-sg Outbound All traffic, ipv4: 0.0.0.0/0, ipv6: ::/0
elasticache_redis_in_traffic_sg Inbound TCP Port 6379 from ec2-jump-box-ssh-sg, lambda-dotnet-web-api-sg only
elasticache_redis_in_traffic_sg Outbound All traffic, ipv4: 0.0.0.0/0, ipv6: ::/0

EC2 SSH Box

  1. Allocate an Elastic IP address
  2. Will need to ensure the internet gateway has been created, and then associate the Elastic IP to the EC2 instance.
  3. Will need to update my laptop IP address in HCP TF ENV variable.

Dev steps:

  • SSH: ssh -i "aws-ec2.pem" ec2-user@52.62.129.136
  • Amazon Linux - some gimped down crap
  • Install redis-cli: sudo dnf install redis6.aarch64
  • Connect: redis6-cli -h hostname --tls

Resources

ElastiCache

  • Deployed to the private subnet groups: [ main_subnet_private1, main_subnet_private2 ]
  • Security group: elasticache_redis_traffic_sg
  • The purpose of a subnet group is if you want it to span multiple availability zones potentially.
  • Requires TLS, user authentication via IAM Redis users - web-api-lambda-user

API Gateway

The API Gateway has an authorizer attached to it, which is then linked to an AWS Lambda.

Lambda

  • Lambdas are built and tested in GitHub Actions, however, are not deployed anymore to AWS
  • The build binaries are zipped, and used by terraform to deploy (file hash is checked)

Web API Lambda

Needed to be configured with:

  • VPC
  • Security groups which allows access to Redis - lambda-dotnet-web-api-sg
  • In the private subnets
  • IAM Role: AwsLambdaDotnetWebApiRole
  • Resource based policy (this is attached to the lambda, not through IAM?) to allow the API Gateway to invoke the function
    • TBD - not sure if this can be configured at the rol level

Authentication to other Platform Tools

HCP Terraform Authenticating to AWS

  • Use OIDC provider
  • IAM Role: arn:aws:iam::398018169858:role/HcpTerraformRole
    • This role needs a large set of privileged permissions to deploy lambda, setup networking, elasticache etc.
  • The IAM policies attached would be quite extensive for any AWS services it deploys/manages
  • The IAM trust relationship defines the HCP Terraform OIDC configuration
  • Setup guide for HCP Terraform

GitHub Actions Authenticating to AWS

  • Use OIDC provider
  • IAM Role: arn:aws:iam::398018169858:role/GitHubActionsRole
  • The IAM policies only have Lambda deployments

Clone this wiki locally