hackyourfuture / infrastructure

HackYourFuture Infrastructure

HYF Infrastructure

Infrastructure code for manage cloud resources of HackYourFuture.

For the time being this code is used mainly to create API resources for the website.

Prerequisites

Before you can use run this project you would need make and docker installed.

For install make in a MacOS:

brew install make

Authorizations

In order to access the authorizations for deploy new resources to the infrastructure you need to make sure you own the rights to run the operations. You can get your tokens here: Get your AWS Tokens

Init

Once you get your tokens you can finally get auth by fetching the environment file needed to perform additional operations:

AWS_ACCESS_KEY_ID=<FILL_YOUR_KEY> AWS_SECRET_ACCESS_KEY=<FILL_YOUR_SECRET> AWS_SESSION_TOKEN=<FILL_YOUR_TOKEN> AWS_DEFAULT_REGION=eu-central-1 make .env

A password is gonna been ask to perform additional operations.

Terraform

We use terraform for describe our infrastructure and we deploy against AWS. We highly recommend have study them before play with it ^_^.

For run terraform you can run:

Terraform - Init

Dowload the dependencies.

./bin/terraform init

Terraform - Check changes

Check changes on infra.

`./bin/terraform plan`

Terraform - Apply changes

Deploy the infrastructure.

`./bin/terraform apply`

Important

If you change the files and you run apply make sure you commit all the files include .tfstate* once.

Secrets

If you change the secrets and you want update the secrets: you can run make encrypt.

infrastructure's Issues

Login to aws with a github account

Opportunity - 0: Login to aws with a github account

What we're trying to solve:
Managing aws users is expensive, because creates an additional operational cost.
Reusing the github authentication, to establish permission within aws level would centralise the authentication process and assign the right set of permission for the allowed resources.
By providing one source of true at lower maintenance.

An approach:
The scope is to create an authentication logic that allows user to access to aws.amazon.com/console with a github user that belongs in the HackYourFuture organisation.

The system would map Teams to specific IAM roles and would create a SAML token with the aws provider.

First use case:
Class 14 needs to work at a lambda function that is hosted in our account.
To provide a better access to debug the production environment. The whole team class14 in github needs to be capable of reading the logs of the lambda function.

Steps to be done:

• Create oAuth Application in GitHub
• Create dedicate role for AWS in terraform
• Create hosted auth logic
• Add environment variable to lambda
• Add travis CI
• Deploy