# Syslog Solution LLC AWS Organization - Terraform

Infrastructure as Code (IaC) configuration for setting up AWS Organization structure for Syslog Solution LLC business.

## Overview

This Terraform configuration creates a complete AWS Organization structure with:
- AWS Organization with all features enabled
- Organizational Units (OUs) for Management, Security, Workloads, and Sandbox
- Member accounts for Development and Staging environments
- IAM users and groups with appropriate policies
- Billing alerts and monitoring
- Tagging and security best practices

## Prerequisites

1. **AWS Account**: Create a new AWS account with business email (`jerome@sysloggh.com`)
2. **AWS CLI**: Install and configure AWS CLI
3. **Terraform**: Install Terraform 1.0 or later
4. **IAM User**: Create an IAM user with AdministratorAccess in the new account

## Setup Instructions

### Step 1: Configure AWS CLI

```bash
# Configure AWS CLI with new business account
aws configure --profile syslog-business

# Enter credentials from IAM user
AWS Access Key ID: [YOUR_ACCESS_KEY]
AWS Secret Access Key: [YOUR_SECRET_KEY]
Default region name: us-east-1
Default output format: json
```

### Step 2: Initialize Terraform

```bash
# Clone or copy this directory
cd terraform-syslog-aws-org

# Initialize Terraform
terraform init

# Copy example variables file
cp terraform.tfvars.example terraform.tfvars

# Edit terraform.tfvars with your values
nano terraform.tfvars
```

### Step 3: Review Plan

```bash
# Review what will be created
terraform plan
```

### Step 4: Apply Configuration

```bash
# Apply the configuration (this will create resources)
terraform apply

# Type 'yes' when prompted to confirm
```

## What Gets Created

### 1. AWS Organization
- Organization with ALL features enabled
- Service access for CloudTrail, Config, SSO, RAM, Service Catalog
- SERVICE_CONTROL_POLICY enabled

### 2. Organizational Units (OUs)
- **Management**: Admin and IAM management (Tier 0)
- **Security**: Security tools and monitoring (Tier 0)
- **Workloads**: Application workloads (Tier 1)
- **Sandbox**: Experimentation and testing (Tier 2)

### 3. Member Accounts
- **Development**: `jerome+dev@sysloggh.com`
- **Staging**: `jerome+staging@sysloggh.com`

### 4. IAM Resources
- Users: `syslog-admin`, `syslog-developer`, `syslog-cicd`
- Groups: `SyslogAdmins`, `SyslogDevelopers`
- Policies with least privilege access

### 5. Monitoring & Billing
- SNS topic for billing alerts
- CloudWatch alarm for monthly spend threshold
- Email subscription for alerts

## Post-Deployment Steps

### 1. Check Email
- AWS will send account creation emails to dev and staging email addresses
- Accept the invitations in each account

### 2. Configure AWS Profiles
```bash
# Configure profiles for each account
aws configure --profile syslog-dev
aws configure --profile syslog-staging
```

### 3. Set up AWS IAM Identity Center (SSO)
1. Go to AWS Console → IAM Identity Center
2. Enable SSO
3. Configure identity source
4. Create permission sets for different roles
5. Assign users to accounts

### 4. Begin Development
```bash
# Switch to development account
export AWS_PROFILE=syslog-dev

# Test access
aws sts get-caller-identity
```

## Variables Configuration

Key variables in `terraform.tfvars`:

| Variable | Description | Default |
|----------|-------------|---------|
| `aws_profile` | AWS CLI profile name | `syslog-business` |
| `dev_account_email` | Development account email | `jerome+dev@sysloggh.com` |
| `staging_account_email` | Staging account email | `jerome+staging@sysloggh.com` |
| `billing_alert_email` | Email for billing alerts | `jerome@sysloggh.com` |
| `monthly_spend_threshold` | Billing alert threshold (USD) | `100` |

## Security Notes

1. **Least Privilege**: IAM policies follow least privilege principle
2. **MFA Recommended**: Enable MFA for all IAM users
3. **Root Account**: Secure root account with MFA and strong password
4. **Access Keys**: Rotate access keys regularly
5. **Audit Trail**: CloudTrail enabled for all accounts

## Cost Estimation

- **AWS Organizations**: Free
- **IAM Users/Groups**: Free
- **SNS Topics**: ~$0.50/month per topic
- **CloudWatch Alarms**: ~$0.10/month per alarm
- **Member Accounts**: No additional cost for account creation

Total estimated monthly cost: **$0.60 - $1.00**

## Troubleshooting

### Common Issues

1. **Permission Denied**: Ensure IAM user has `Organizations:CreateOrganization` permission
2. **Email Already Used**: Change email addresses in `terraform.tfvars`
3. **Rate Limiting**: AWS limits organization creation to 1 per day

### Debug Commands

```bash
# Check AWS profile configuration
aws sts get-caller-identity --profile syslog-business

# Check Terraform state
terraform state list

# Show outputs
terraform output

# Destroy resources (if needed)
terraform destroy
```

## Next Steps

After organization setup:

1. **Set up Amplify** in development account for website
2. **Configure CI/CD** pipeline with GitHub Actions
3. **Deploy initial website** to `dev.sysloggh.com`
4. **Integrate AI agents** from `aws-multi-agent-rag` repository
5. **Complete Ghana business profile** optimization

## Contact

For issues or questions:
- Email: jerome@sysloggh.com
- Telegram: @mejerome19

## License

This Terraform configuration is proprietary to Syslog Solution LLC.