Aller au contenu

AWS - Account management#

This page explains how an AWS account must be declared for cloud/client zone usage.

Two use cases are possible: dynamic provisioning and external reference. Whereas dynamic provisioning is for AWS accounts managed inside the Caascad organization (case of infra zones and staging cloud/client zones), external reference is mainly for AWS accounts managed by customers (case of production client zones).

Dynamic provisioning#

Declare a new AWS account in caascad-zones#

In the aws_accounts.cue file of the caascad-zones repository, add an entry: 

your_zone_name: #AWSAccount & {
  name: "caascad-your_zone_name"
  ou:   "Caascad_dev_zones"
}

Notes:

  • The ou attribute has only two values. Caascad_dev_zones for accounts dedicated to staging zones or Caascad_prod_zones for prod zones
  • Only indicate name and ou attributes. Besides, name must starts with caascad string. If your account definition does not follow those rules, it is assumed the account is already existing (external reference)

Run configurations to create and initialize the account#

Create a MR. Once reviewed, approved and merged, run the following trackbone configurations to get the AWS account created and configured:

trackbone apply -z ZONE_NAME -c aws_ses_rules
trackbone apply -z ZONE_NAME -c aws_account_create
trackbone apply -z ZONE_NAME -c aws_account_bootstrap
trackbone apply -z ZONE_NAME -c aws_caascad_roles
trackbone apply -z ZONE_NAME -c vault_aws_sts_roles

To acces the account using the Webconsole and federated login, run: 

trackbone apply -z ZONE_NAME -c keycloak-vault-client

External reference#

The customer manages its own AWS organization.

First, it must create an AWS account. Then it has to run the aws-caascad-roles public configuration to create an IAM role which will be used by the Caascad provisioning.

Declare the AWS account in caascad-zones#

In the aws_accounts.cue file of the caascad-zones repository, add an entry: 

customer_A: #AWSAccount & {
  id: "XXXXXXXXXXXX"
}

Run configurations to initialize the account#

Create a MR. Once reviewed, approved and merged, run the following trackbone configurations to use the AWS account:

trackbone apply -z ZONE_NAME -c vault_aws_sts_roles