197 lines
5.2 KiB
Markdown
197 lines
5.2 KiB
Markdown
# Syslog Solution LLC AWS Organization - Terraform
|
|
|
|
Infrastructure as Code (IaC) configuration for setting up AWS Organization structure for Syslog Solution LLC business.
|
|
|
|
## Overview
|
|
|
|
This Terraform configuration creates a complete AWS Organization structure with:
|
|
- AWS Organization with all features enabled
|
|
- Organizational Units (OUs) for Management, Security, Workloads, and Sandbox
|
|
- Member accounts for Development and Staging environments
|
|
- IAM users and groups with appropriate policies
|
|
- Billing alerts and monitoring
|
|
- Tagging and security best practices
|
|
|
|
## Prerequisites
|
|
|
|
1. **AWS Account**: Create a new AWS account with business email (`jerome@sysloggh.com`)
|
|
2. **AWS CLI**: Install and configure AWS CLI
|
|
3. **Terraform**: Install Terraform 1.0 or later
|
|
4. **IAM User**: Create an IAM user with AdministratorAccess in the new account
|
|
|
|
## Setup Instructions
|
|
|
|
### Step 1: Configure AWS CLI
|
|
|
|
```bash
|
|
# Configure AWS CLI with new business account
|
|
aws configure --profile syslog-business
|
|
|
|
# Enter credentials from IAM user
|
|
AWS Access Key ID: [YOUR_ACCESS_KEY]
|
|
AWS Secret Access Key: [YOUR_SECRET_KEY]
|
|
Default region name: us-east-1
|
|
Default output format: json
|
|
```
|
|
|
|
### Step 2: Initialize Terraform
|
|
|
|
```bash
|
|
# Clone or copy this directory
|
|
cd terraform-syslog-aws-org
|
|
|
|
# Initialize Terraform
|
|
terraform init
|
|
|
|
# Copy example variables file
|
|
cp terraform.tfvars.example terraform.tfvars
|
|
|
|
# Edit terraform.tfvars with your values
|
|
nano terraform.tfvars
|
|
```
|
|
|
|
### Step 3: Review Plan
|
|
|
|
```bash
|
|
# Review what will be created
|
|
terraform plan
|
|
```
|
|
|
|
### Step 4: Apply Configuration
|
|
|
|
```bash
|
|
# Apply the configuration (this will create resources)
|
|
terraform apply
|
|
|
|
# Type 'yes' when prompted to confirm
|
|
```
|
|
|
|
## What Gets Created
|
|
|
|
### 1. AWS Organization
|
|
- Organization with ALL features enabled
|
|
- Service access for CloudTrail, Config, SSO, RAM, Service Catalog
|
|
- SERVICE_CONTROL_POLICY enabled
|
|
|
|
### 2. Organizational Units (OUs)
|
|
- **Management**: Admin and IAM management (Tier 0)
|
|
- **Security**: Security tools and monitoring (Tier 0)
|
|
- **Workloads**: Application workloads (Tier 1)
|
|
- **Sandbox**: Experimentation and testing (Tier 2)
|
|
|
|
### 3. Member Accounts
|
|
- **Development**: `jerome+dev@sysloggh.com`
|
|
- **Staging**: `jerome+staging@sysloggh.com`
|
|
|
|
### 4. IAM Resources
|
|
- Users: `syslog-admin`, `syslog-developer`, `syslog-cicd`
|
|
- Groups: `SyslogAdmins`, `SyslogDevelopers`
|
|
- Policies with least privilege access
|
|
|
|
### 5. Monitoring & Billing
|
|
- SNS topic for billing alerts
|
|
- CloudWatch alarm for monthly spend threshold
|
|
- Email subscription for alerts
|
|
|
|
## Post-Deployment Steps
|
|
|
|
### 1. Check Email
|
|
- AWS will send account creation emails to dev and staging email addresses
|
|
- Accept the invitations in each account
|
|
|
|
### 2. Configure AWS Profiles
|
|
```bash
|
|
# Configure profiles for each account
|
|
aws configure --profile syslog-dev
|
|
aws configure --profile syslog-staging
|
|
```
|
|
|
|
### 3. Set up AWS IAM Identity Center (SSO)
|
|
1. Go to AWS Console → IAM Identity Center
|
|
2. Enable SSO
|
|
3. Configure identity source
|
|
4. Create permission sets for different roles
|
|
5. Assign users to accounts
|
|
|
|
### 4. Begin Development
|
|
```bash
|
|
# Switch to development account
|
|
export AWS_PROFILE=syslog-dev
|
|
|
|
# Test access
|
|
aws sts get-caller-identity
|
|
```
|
|
|
|
## Variables Configuration
|
|
|
|
Key variables in `terraform.tfvars`:
|
|
|
|
| Variable | Description | Default |
|
|
|----------|-------------|---------|
|
|
| `aws_profile` | AWS CLI profile name | `syslog-business` |
|
|
| `dev_account_email` | Development account email | `jerome+dev@sysloggh.com` |
|
|
| `staging_account_email` | Staging account email | `jerome+staging@sysloggh.com` |
|
|
| `billing_alert_email` | Email for billing alerts | `jerome@sysloggh.com` |
|
|
| `monthly_spend_threshold` | Billing alert threshold (USD) | `100` |
|
|
|
|
## Security Notes
|
|
|
|
1. **Least Privilege**: IAM policies follow least privilege principle
|
|
2. **MFA Recommended**: Enable MFA for all IAM users
|
|
3. **Root Account**: Secure root account with MFA and strong password
|
|
4. **Access Keys**: Rotate access keys regularly
|
|
5. **Audit Trail**: CloudTrail enabled for all accounts
|
|
|
|
## Cost Estimation
|
|
|
|
- **AWS Organizations**: Free
|
|
- **IAM Users/Groups**: Free
|
|
- **SNS Topics**: ~$0.50/month per topic
|
|
- **CloudWatch Alarms**: ~$0.10/month per alarm
|
|
- **Member Accounts**: No additional cost for account creation
|
|
|
|
Total estimated monthly cost: **$0.60 - $1.00**
|
|
|
|
## Troubleshooting
|
|
|
|
### Common Issues
|
|
|
|
1. **Permission Denied**: Ensure IAM user has `Organizations:CreateOrganization` permission
|
|
2. **Email Already Used**: Change email addresses in `terraform.tfvars`
|
|
3. **Rate Limiting**: AWS limits organization creation to 1 per day
|
|
|
|
### Debug Commands
|
|
|
|
```bash
|
|
# Check AWS profile configuration
|
|
aws sts get-caller-identity --profile syslog-business
|
|
|
|
# Check Terraform state
|
|
terraform state list
|
|
|
|
# Show outputs
|
|
terraform output
|
|
|
|
# Destroy resources (if needed)
|
|
terraform destroy
|
|
```
|
|
|
|
## Next Steps
|
|
|
|
After organization setup:
|
|
|
|
1. **Set up Amplify** in development account for website
|
|
2. **Configure CI/CD** pipeline with GitHub Actions
|
|
3. **Deploy initial website** to `dev.sysloggh.com`
|
|
4. **Integrate AI agents** from `aws-multi-agent-rag` repository
|
|
5. **Complete Ghana business profile** optimization
|
|
|
|
## Contact
|
|
|
|
For issues or questions:
|
|
- Email: jerome@sysloggh.com
|
|
- Telegram: @mejerome19
|
|
|
|
## License
|
|
|
|
This Terraform configuration is proprietary to Syslog Solution LLC. |