20hertz / boomtap-infra

Infra-as-code for the eponymous website

Boomtap Infra

Prerequisites

You need:

• Node.js
• AWS CLI
• AWS CDK Toolkit
• Proper AWS credentials

Get a new environment up and running

There are a few steps to get there:

1. Create an AWS account that is member of the organization

   Easiest way is using CLI's create-account command

   % aws organizations create-account --email <value> --account-name <ENVIRONMENT_NAME>
   

   Recommended: save the account id in a variable as you'll need it in the steps below.

2. Define a profile that can assume the OrganizationAccountAccessRole

   # ~/.aws/config
   
   [profile <NAME_OF_PROFILE>]
   role_arn = arn:aws:iam::<ACCOUNT_ID>:role/OrganizationAccountAccessRole
   source_profile = default (or any profile whose credentials have the OrganizationAccountAccessRole)
   region = <REGION>
   

3. Create a policy that allows CDK to deploy resources on this account

   pnpm policy:create <backstage|prod>

4. Bootstrap the CDK for the new account

   cdk bootstrap /
      -c env=<ENVIRONMENT_NAME> /
      --cloudformation-execution-policies "arn:aws:iam::$ACCOUNT_ID:policy/CDKExecutionAccess" /
      [--profile <PROFILE_NAME>]
   

Updating the CDK execution policy

You might need to expand the permission that CDK currently has to deploy resources. To do so, update the CDKExecutionAccess policy with the new Actions you need and with respect to the least privilege principle.

1. Update cdkExecutionPolicy.json
2. Run pnpm policy:update <backstage | prod>
3. You probably don't need to run the bootstrap script again. But try it if deployment doesn't work.

There is a limit to 5 Policy versions, so we need to delete old versions to make updates. But it’s not difficult. We simply list existing versions:

aws iam list-policy-versions \
      --policy-arn arn:aws:iam::$ACCOUNT_ID:policy/CDKExecutionAccess

And then delete the selected old version:

aws iam delete-policy-version \
      --policy-arn arn:aws:iam::$ACCOUNT_ID:policy/CDKExecutionAccess \
      --version-id <VERSION>

Other useful commands

• pnpm build --> compile typescript to js
• pnpm watch --> watch for changes and compile
• pnpm test --> perform the jest unit tests
• cdk diff --> compare deployed stack with current state
• cdk synth --> emits the synthesized CloudFormation template

Misc

The cdk.json file tells the CDK Toolkit how to execute your app.