Asterion infrastructure deployment

This repository captures the end to end workflow for deploying asterion digital aws organization and iam via pulumi.

The asterion organization on aws will contain a number of aws organizational units as well as aws accounts and iam resources. When the organization has been deployed into aws, it should look similar to this:

Setup environment

To get started lets initialise our project, making sure we are in the right directory, have the python virtual environment activated, and have installed our python dependencies with pip.

# Start from the infra directory and initialise
cd org-asterion && pulumi stack init dev

# Create virtual environment
python3 -m venv venv

# Activate virtual environment
source venv/bin/activate

# Install pip requirements
pip install -r requirements.txt

Create stack and retrieve kubeconfig

Once we have our local pulumi configuration set we can bring up the organizational stack.

Currently this stack includes construction of the asterion organization in aws, with iam users and login profiles, as well as aws accounts to manage resources in different development environments, and roles that administrative iam users can assume to access these accounts.

pulumi up --yes

Asterion organization has now been deployed in aws! 🚀

Access aws accounts and switch roles

To be able to switch roles and access asterion aws accounts, you’ll need to configure your aws profile by doing the following steps:

1. Log in to the aws management console with one of the users listed in the appropriate pulumi configuration file and using the specific user password that will be output from the org-asterion pulumi stack.
2. Create an access key in the management console, and note both the access key id and secret access key id.
3. Use aws configure and the access key information in the cli to set the access keys, region name, and default output type to a default profile in your .aws/config and .aws/credentials files.
4. Append the following to your aws config file to create a new cli profile and assume the administrator role in the asterion dev aws account:

[profile asteriondev]
region=ap-southeast-2
output=json
role_arn = arn:aws:iam::822258672282:role/administrator
source_profile = default

Now, you can swap between your default and asteriondev profiles by setting the AWS_PROFILE environment variable, e.g export AWS_PROFILE=asteriondev.

Check whether you’ve signed into your original iam user or have assumed the administrator role with the cli command aws sts get-caller-identity.

Teardown stack

Need to make it all go away 😅? No problem, run the following to completely teardown this stack.

pulumi destroy --yes