client-projects/infrastructure/aws-org/README.md

Syslog Solution LLC AWS Organization - Terraform

Infrastructure as Code (IaC) configuration for setting up AWS Organization structure for Syslog Solution LLC business.

Overview

This Terraform configuration creates a complete AWS Organization structure with:

• AWS Organization with all features enabled
• Organizational Units (OUs) for Management, Security, Workloads, and Sandbox
• Member accounts for Development and Staging environments
• IAM users and groups with appropriate policies
• Billing alerts and monitoring
• Tagging and security best practices

Prerequisites

1. AWS Account: Create a new AWS account with business email (jerome@sysloggh.com)
2. AWS CLI: Install and configure AWS CLI
3. Terraform: Install Terraform 1.0 or later
4. IAM User: Create an IAM user with AdministratorAccess in the new account

Setup Instructions

Step 1: Configure AWS CLI

# Configure AWS CLI with new business account
aws configure --profile syslog-business

# Enter credentials from IAM user
AWS Access Key ID: [YOUR_ACCESS_KEY]
AWS Secret Access Key: [YOUR_SECRET_KEY]
Default region name: us-east-1
Default output format: json

Step 2: Initialize Terraform

# Clone or copy this directory
cd terraform-syslog-aws-org

# Initialize Terraform
terraform init

# Copy example variables file
cp terraform.tfvars.example terraform.tfvars

# Edit terraform.tfvars with your values
nano terraform.tfvars

Step 3: Review Plan

# Review what will be created
terraform plan

Step 4: Apply Configuration

# Apply the configuration (this will create resources)
terraform apply

# Type 'yes' when prompted to confirm

What Gets Created

1. AWS Organization

• Organization with ALL features enabled
• Service access for CloudTrail, Config, SSO, RAM, Service Catalog
• SERVICE_CONTROL_POLICY enabled

2. Organizational Units (OUs)

• Management: Admin and IAM management (Tier 0)
• Security: Security tools and monitoring (Tier 0)
• Workloads: Application workloads (Tier 1)
• Sandbox: Experimentation and testing (Tier 2)

3. Member Accounts

• Development: jerome+dev@sysloggh.com
• Staging: jerome+staging@sysloggh.com

4. IAM Resources

• Users: syslog-admin, syslog-developer, syslog-cicd
• Groups: SyslogAdmins, SyslogDevelopers
• Policies with least privilege access

5. Monitoring & Billing

• SNS topic for billing alerts
• CloudWatch alarm for monthly spend threshold
• Email subscription for alerts

Post-Deployment Steps

1. Check Email

• AWS will send account creation emails to dev and staging email addresses
• Accept the invitations in each account

2. Configure AWS Profiles

# Configure profiles for each account
aws configure --profile syslog-dev
aws configure --profile syslog-staging

3. Set up AWS IAM Identity Center (SSO)

1. Go to AWS Console → IAM Identity Center
2. Enable SSO
3. Configure identity source
4. Create permission sets for different roles
5. Assign users to accounts

4. Begin Development

# Switch to development account
export AWS_PROFILE=syslog-dev

# Test access
aws sts get-caller-identity

Variables Configuration

Key variables in terraform.tfvars:

Variable	Description	Default
aws_profile	AWS CLI profile name	syslog-business
dev_account_email	Development account email	jerome+dev@sysloggh.com
staging_account_email	Staging account email	jerome+staging@sysloggh.com
billing_alert_email	Email for billing alerts	jerome@sysloggh.com
monthly_spend_threshold	Billing alert threshold (USD)	100

Security Notes

1. Least Privilege: IAM policies follow least privilege principle
2. MFA Recommended: Enable MFA for all IAM users
3. Root Account: Secure root account with MFA and strong password
4. Access Keys: Rotate access keys regularly
5. Audit Trail: CloudTrail enabled for all accounts

Cost Estimation

• AWS Organizations: Free
• IAM Users/Groups: Free
• SNS Topics: ~$0.50/month per topic
• CloudWatch Alarms: ~$0.10/month per alarm
• Member Accounts: No additional cost for account creation

Total estimated monthly cost: $0.60 - $1.00

Troubleshooting

Common Issues

1. Permission Denied: Ensure IAM user has Organizations:CreateOrganization permission
2. Email Already Used: Change email addresses in terraform.tfvars
3. Rate Limiting: AWS limits organization creation to 1 per day

Debug Commands

# Check AWS profile configuration
aws sts get-caller-identity --profile syslog-business

# Check Terraform state
terraform state list

# Show outputs
terraform output

# Destroy resources (if needed)
terraform destroy

Next Steps

After organization setup:

1. Set up Amplify in development account for website
2. Configure CI/CD pipeline with GitHub Actions
3. Deploy initial website to dev.sysloggh.com
4. Integrate AI agents from aws-multi-agent-rag repository
5. Complete Ghana business profile optimization

Contact

For issues or questions:

• Email: jerome@sysloggh.com
• Telegram: @mejerome19

License

This Terraform configuration is proprietary to Syslog Solution LLC.