feat: setup AWS infrastructure directory and checklist

2026-04-05 09:32:32 +00:00
commit 79887ffb59
7 changed files with 946 additions and 0 deletions
@@ -0,0 +1,197 @@
+# Syslog Solution LLC AWS Organization - Terraform
+
+Infrastructure as Code (IaC) configuration for setting up AWS Organization structure for Syslog Solution LLC business.
+
+## Overview
+
+This Terraform configuration creates a complete AWS Organization structure with:
+- AWS Organization with all features enabled
+- Organizational Units (OUs) for Management, Security, Workloads, and Sandbox
+- Member accounts for Development and Staging environments
+- IAM users and groups with appropriate policies
+- Billing alerts and monitoring
+- Tagging and security best practices
+
+## Prerequisites
+
+1. **AWS Account**: Create a new AWS account with business email (`jerome@sysloggh.com`)
+2. **AWS CLI**: Install and configure AWS CLI
+3. **Terraform**: Install Terraform 1.0 or later
+4. **IAM User**: Create an IAM user with AdministratorAccess in the new account
+
+## Setup Instructions
+
+### Step 1: Configure AWS CLI
+
+```bash
+# Configure AWS CLI with new business account
+aws configure --profile syslog-business
+
+# Enter credentials from IAM user
+AWS Access Key ID: [YOUR_ACCESS_KEY]
+AWS Secret Access Key: [YOUR_SECRET_KEY]
+Default region name: us-east-1
+Default output format: json
+```
+
+### Step 2: Initialize Terraform
+
+```bash
+# Clone or copy this directory
+cd terraform-syslog-aws-org
+
+# Initialize Terraform
+terraform init
+
+# Copy example variables file
+cp terraform.tfvars.example terraform.tfvars
+
+# Edit terraform.tfvars with your values
+nano terraform.tfvars
+```
+
+### Step 3: Review Plan
+
+```bash
+# Review what will be created
+terraform plan
+```
+
+### Step 4: Apply Configuration
+
+```bash
+# Apply the configuration (this will create resources)
+terraform apply
+
+# Type 'yes' when prompted to confirm
+```
+
+## What Gets Created
+
+### 1. AWS Organization
+- Organization with ALL features enabled
+- Service access for CloudTrail, Config, SSO, RAM, Service Catalog
+- SERVICE_CONTROL_POLICY enabled
+
+### 2. Organizational Units (OUs)
+- **Management**: Admin and IAM management (Tier 0)
+- **Security**: Security tools and monitoring (Tier 0)
+- **Workloads**: Application workloads (Tier 1)
+- **Sandbox**: Experimentation and testing (Tier 2)
+
+### 3. Member Accounts
+- **Development**: `jerome+dev@sysloggh.com`
+- **Staging**: `jerome+staging@sysloggh.com`
+
+### 4. IAM Resources
+- Users: `syslog-admin`, `syslog-developer`, `syslog-cicd`
+- Groups: `SyslogAdmins`, `SyslogDevelopers`
+- Policies with least privilege access
+
+### 5. Monitoring & Billing
+- SNS topic for billing alerts
+- CloudWatch alarm for monthly spend threshold
+- Email subscription for alerts
+
+## Post-Deployment Steps
+
+### 1. Check Email
+- AWS will send account creation emails to dev and staging email addresses
+- Accept the invitations in each account
+
+### 2. Configure AWS Profiles
+```bash
+# Configure profiles for each account
+aws configure --profile syslog-dev
+aws configure --profile syslog-staging
+```
+
+### 3. Set up AWS IAM Identity Center (SSO)
+1. Go to AWS Console → IAM Identity Center
+2. Enable SSO
+3. Configure identity source
+4. Create permission sets for different roles
+5. Assign users to accounts
+
+### 4. Begin Development
+```bash
+# Switch to development account
+export AWS_PROFILE=syslog-dev
+
+# Test access
+aws sts get-caller-identity
+```
+
+## Variables Configuration
+
+Key variables in `terraform.tfvars`:
+
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `aws_profile` | AWS CLI profile name | `syslog-business` |
+| `dev_account_email` | Development account email | `jerome+dev@sysloggh.com` |
+| `staging_account_email` | Staging account email | `jerome+staging@sysloggh.com` |
+| `billing_alert_email` | Email for billing alerts | `jerome@sysloggh.com` |
+| `monthly_spend_threshold` | Billing alert threshold (USD) | `100` |
+
+## Security Notes
+
+1. **Least Privilege**: IAM policies follow least privilege principle
+2. **MFA Recommended**: Enable MFA for all IAM users
+3. **Root Account**: Secure root account with MFA and strong password
+4. **Access Keys**: Rotate access keys regularly
+5. **Audit Trail**: CloudTrail enabled for all accounts
+
+## Cost Estimation
+
+- **AWS Organizations**: Free
+- **IAM Users/Groups**: Free
+- **SNS Topics**: ~$0.50/month per topic
+- **CloudWatch Alarms**: ~$0.10/month per alarm
+- **Member Accounts**: No additional cost for account creation
+
+Total estimated monthly cost: **$0.60 - $1.00**
+
+## Troubleshooting
+
+### Common Issues
+
+1. **Permission Denied**: Ensure IAM user has `Organizations:CreateOrganization` permission
+2. **Email Already Used**: Change email addresses in `terraform.tfvars`
+3. **Rate Limiting**: AWS limits organization creation to 1 per day
+
+### Debug Commands
+
+```bash
+# Check AWS profile configuration
+aws sts get-caller-identity --profile syslog-business
+
+# Check Terraform state
+terraform state list
+
+# Show outputs
+terraform output
+
+# Destroy resources (if needed)
+terraform destroy
+```
+
+## Next Steps
+
+After organization setup:
+
+1. **Set up Amplify** in development account for website
+2. **Configure CI/CD** pipeline with GitHub Actions
+3. **Deploy initial website** to `dev.sysloggh.com`
+4. **Integrate AI agents** from `aws-multi-agent-rag` repository
+5. **Complete Ghana business profile** optimization
+
+## Contact
+
+For issues or questions:
+- Email: jerome@sysloggh.com
+- Telegram: @mejerome19
+
+## License
+
+This Terraform configuration is proprietary to Syslog Solution LLC.