You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/guides/reference-architecture/configuration-guide/index.md
+49-40Lines changed: 49 additions & 40 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -12,9 +12,9 @@ We recommend that you use the Gruntwork CLI tool to automate most of this proces
12
12
13
13
:::
14
14
15
-
:::caution
15
+
:::note
16
16
17
-
Caveat: at this time, the Reference Architecture does not configure or manage the root/management account of an AWS Organization set up. That is, it does not include the [`account-baseline-root` module](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/master/modules/landingzone/account-baseline-root). Gruntwork is planning to add this in a future enhancement to the reference architecture.
17
+
At this time, the Reference Architecture does not configure or manage the root/management account of an AWS Organization set up. That is, it does not include the [`account-baseline-root` module](https://github.com/gruntwork-io/terraform-aws-service-catalog/tree/master/modules/landingzone/account-baseline-root). Gruntwork is planning to add this in a future enhancement to the reference architecture.
18
18
19
19
:::
20
20
@@ -24,15 +24,15 @@ The very first step is to clone this repository to your local machine. You must
@@ -49,16 +49,18 @@ The very first step is to clone this repository to your local machine. You must
49
49
50
50
1. These account IDs will go under `AWSAccounts`in the reference architecture form.
51
51
52
+
:::info
53
+
52
54
For the best results, use [Gruntwork CLI](https://github.com/gruntwork-io/gruntwork) to create the accounts. The Gruntwork CLI automatically grants Gruntwork engineers access to your accounts through an IAM role. However, **if you choose to create the accounts manually and do not use the Gruntwork CLI, you still MUST run the `gruntwork aws grant`command to grant the Gruntwork team access to these accounts**. MFA is enforced for all Gruntwork access. You can use the same tool to revoke access when the deployment is complete. See [CLI documentation](https://github.com/gruntwork-io/gruntwork) for details.
53
55
54
-
:::info
56
+
:::
57
+
58
+
**Important**:
55
59
56
60
- The accounts must be new, empty accounts, with no resources present. That means no EC2 instances, RDS databases, CloudTrail trails, AWS Config recorders, etc.
57
61
- Do not apply any Service Control Policies to the accounts as they may interfere with the Terraform resources in the Reference Architecture.
58
62
- You can name the _dev, stage,_ and _prod_ accounts anything you like, but the others must be named _shared_, _logs_, and _security_.
59
63
60
-
:::
61
-
62
64
## Purchase and register domain names
63
65
64
66
The Reference Architecture uses Route 53 to setup public DNS records forseveral aspects of the infrastructure, such as the network bastion and the [AWS Sample App](https://github.com/gruntwork-io/aws-sample-app/). For this to work, we ask that you set up domains for each application account (_dev_, _stage_, and _prod_) and, if you’re using Jenkins,in the _shared_ account. These domains should be configured as public hosted zones in Route 53. There are two options for domain registration:
@@ -101,27 +103,27 @@ Once everything is configured up correctly, check that you can resolve the domai
101
103
102
104
1. On MacOS or Linux, use `dig` to confirm that the domain can be resolved correctly over the Internet:
Notice that the NS records in the image match the values returned by the commands. The same process applies if you’re using subdomains. Make sure to validate each domain or subdomain in this manner.
127
129
@@ -132,8 +134,12 @@ Notice that the NS records in the image match the values returned by the command
132
134
3. `InfraLiveRepoSSHURL` is where you enter this repo’s SSH URL (e.g. <[email protected]>:gruntwork-io/infrastructure-live.git).
133
135
4. `InfraLiveDefaultBranchName` is where you enter your repo’s default branch name (e.g. main).
134
136
137
+
:::info
138
+
135
139
This current repository will contain all of the infrastructure code you need to extend and operate the environment. For you to have access to all the code, you should copy this code into your newly created _infrastructure-live_ repo once the deployment is done.
136
140
141
+
:::
142
+
137
143
## Set up the machine user
138
144
139
145
Whatever VCS platform you are using, do this:
@@ -182,28 +188,32 @@ The [reference architecture form](https://github.com/gruntwork-clients/infrastru
182
188
183
189
You’ll need all the information you’ve noted in the previous steps. This is where you’ll also be able to customize your infrastructure by choosing a compute option (e.g. ASG, ECS, or EKS), a cache cluster (Redis or Memcached), and a database (e.g. MySQL, PostgreSQL, Aurora, etc). The form contains detailed descriptions of each field.
184
190
191
+
:::caution
192
+
185
193
YAML files are space-sensitive. As you edit the file, be sure to retain the correct whitespace! This should be apparent as you review the file.
186
194
195
+
:::
196
+
187
197
1. Open `reference-architecture-form.yml`in a text editor.
188
-
1. Update the _replace-me_ placeholder text in each field. Use double quotes (`""`) to wrap the values, as shown in the examples.
198
+
2. Update the _replace-me_ placeholder text in each field. Use double quotes (`""`) to wrap the values, as shown in the examples.
189
199
190
200
If you’re unsure about how to answer any of the questions, email <[email protected]> and let us know!
191
201
192
202
## Complete the set up process and open a pull request for Gruntwork
193
203
194
204
1. Review your changes. If you notice any errors, correct them, and rerun:
195
205
196
-
```bash
197
-
git diff
198
-
```
206
+
```bash
207
+
git diff
208
+
```
199
209
200
210
1. Commit the changes and push to the remote repository:
1. [Open a pull request](https://docs.github.com/en/github/collaborating-with-issues-and-pull-requests/creating-a-pull-request). Gruntwork will review the pull request, resolve any open questions or issues, then merge and begin the deployment.
209
219
@@ -231,7 +241,6 @@ Choose a name for the secret (we’ve chosen _GitHubPAT_ here), then click _Next
231
241
232
242
In the ref arch form, `VCSPATSecretsManagerARN` is where you enter this ARN.
0 commit comments