Set up the AWS (sponsored) account as a Terraform project

[dduportal]

This task is about preparing the operations on the AWS account for which we have $60k ready

• Ensure a secured bootstrap of the project (root account)
• Ensure each team member have (secured) access to the AWS UI
• Ensure we have a working Terraform project (code, build, deployment)

[dduportal]

Ensure a secured bootstrap of the project (root account)

• (private) AWS root account access is available through shared encrypted elements in https://github.com/jenkins-infra/charts-secrets/tree/main/config/aws-jenkins-infra (as a fallback if the infra team members loose all their access).
  • Private repo
  • List of encrypted (GPG) members
• (private) bootstrap with the Terraform "States" sub-project: https://github.com/jenkins-infra/terraform-states/tree/main/aws-sponsored
  • https://github.com/jenkins-infra/terraform-states/blob/main/aws-sponsored/users.tf defines the human users which are admins, developers (like terraform users) and MFA-enforced (see associated policies)
  • Each user has an initial password encrypted with only their personal GPG key when created.
  • Initial connection enforces password change + setting up MFA
  • User cannot manipulate resources: they need to assume an admin or developer role which requires MFA even on command line

[dduportal]

Ensure we have a working Terraform project (code, build, deployment)

• Repo (public) created: https://github.com/jenkins-infra/terraform-aws-sponsorship
  • Initial commit: jenkins-infra/terraform-aws-sponsorship@50c1d4e to fill it
• Terraform backends set up in AzureRM in (private) https://github.com/jenkins-infra/terraform-states/blob/7442baaeffd17aaa3cdf86b5b2e623b53f6ab5a7/aws-sponsored/main.tf#L2-L11
• feat(infra.ci/jobs): add a multibranch pipeline for AWS-SPONSORSHIP kubernetes-management#5768 introduced the job on infra.ci
  • Secrets pushed in (private) https://github.com/jenkins-infra/charts-secrets/commit/82cb8d21c458995e6646cade088d8e18fc0a61c0

Notes:

• We have some updatecli job / manifest to add along the way but the projects is now working
• We might need to update the permissions of the terraform users. @smerle33 did it once with the s3:list - https://github.com/jenkins-infra/terraform-states/commit/4d517a50fefedbfbfaf7849f85526e5ab1d427a6

[dduportal]

Ensure each team member have (secured) access to the AWS UI

• Both @smerle33 and I have access.
• User jfranco created in https://github.com/jenkins-infra/terraform-states/commit/3fa0a7c525854c63268e053484d443bfd96aeb8b

[jayfranco999]

I have access to aws-sponsored, we can proceed with the next steps.