Skip to content

Commit e2d948b

Browse files
author
Peter Benjamin
committed
Rename doc files
1 parent c90b9cf commit e2d948b

7 files changed

Lines changed: 97 additions & 0 deletions

File tree

docs/01-RESTACKER_INTRO.md

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
# INTRODUCTION
2+
3+
The Control-Plane pattern/architecture is designed to mitigate and limit risk/exposure if an account were to be compromised.
4+
In DevSecOps, we call this **Blast Radius**.
5+
6+
## CONTROL PLANE
7+
In a typical Control-Plane architecture, an account is designated as the Control Plane.
8+
It does not have any instances (e.g. EC2, RDS ...etc).
9+
The main purpose of this account is to maintain users and roles.
10+
11+
## TARGET PLANE
12+
The target plane, or account, will host the instances, databases, and any other AWS services needed.
13+
The roles in this account trusts roles from the Control Plane/Account
14+
15+
## WORKFLOW
16+
In a Control-Plane architecture, the workflow for performing operations on the Target Account will look like this:
17+
- Authenticate against the Control Account to obtain an AWS STS token.
18+
- Pass that STS token to the next Target Account to assume a specific role (e.g. Read-Only, Deploy-Admin, Incident-Response ...etc).

docs/02-RESTACKER_YML.md

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
# RESTACKER.YML
2+
This is the configuration file for Restacker CLI.
3+
See the sample [here](../source/restacker-sample.yml).
4+
5+
## STRUCTURE
6+
In order for Restacker to work as expected, the following key:value pairs are required:
7+
- `:default:`: specifies the default location/plane for all Restacker operations. This is intended to save you from having to specify the required `-l <location>` everytime.
8+
- `:label:`: the name of the default location.
9+
- `:ctrl: &ctrl_default`: default configuration for the Control Account
10+
- `:label:`: name of the account
11+
- `:role-name:`
12+
- `:role-prefix:`
13+
- `:bucket:`: S3 Bucket configuration to read/consume files from.
14+
- `:name:`: Bucket name
15+
- `:prefix:`: **optional** bucket prefix/path
16+
- `:ami_key:`: **optional** name of object on S3 that contains list of approved AMIs
17+
- `:Account_Name:`: name of target account
18+
- `:region:`: default region to deploy instances in (e.g. `us-west-2`)
19+
- `:ctrl:`: control account for this account
20+
- `<<: *ctrl_default`: if the control account is the default account specified in `&ctrl_default`, then just insert default configurations here
21+
- `:target:`: the target account configuration
22+
- `:label:`: name of target account
23+
- `:account_number:`: target account number
24+
- `:role_name:`: target role name
25+
- `:role_prefix:`: target role prefix
26+
27+
## Example Restacker Configuration:
28+
```
29+
:default:
30+
:label: myapp1
31+
32+
:ctrl: &ctrl_default
33+
:label: ctrlAcct
34+
:account_number: '123456789012'
35+
:role_name: ctrl-ctrl-DeployAdmin
36+
:role_prefix: "/dso/ctrl/ctrl/"
37+
:bucket:
38+
:name: kaos-installers
39+
:prefix: cloudformation
40+
:ami_key: latest_amis
41+
42+
:ctrlAcct:
43+
:region: us-west-2
44+
:ctrl:
45+
<<: *ctrl_default
46+
:target:
47+
<<: *ctrl_default
48+
49+
:myapp1:
50+
:region: us-west-2
51+
:ctrl:
52+
<<: *ctrl_default
53+
:role_name: ctrl-myapp1-DeployAdmin
54+
:target:
55+
:label: myapp1
56+
:account_number: '098765432123'
57+
:role_name: myapp1-dso-DeployAdmin
58+
:role_prefix: "/dso/human/"
59+
60+
:myapp2:
61+
:region: us-west-2
62+
:ctrl:
63+
<<: *ctrl_default
64+
:role_name: ctrl-myapp2-DeployAdmin
65+
:target:
66+
:label: myapp2
67+
:account_number: '123098456765'
68+
:role_name: myapp2-dso-DeployAdmin
69+
:role_prefix: "/dso/human/"
70+
71+
```

docs/03-PARAMETERS_YML.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
# PARAMETERS.YML
2+
Configurations to be passed to the CloudFormation template.
3+
4+
<!-- Explain each Parameter here -->
5+
6+
**NOTE:** Any Environment variable that you'd like to persist past boot, place them here, **not** in `userdata.sh`

docs/04-USERDATA_SH.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
# USERDATA.SH
2+
Configuration needed only during instance-creation stage

docs/CHANGELOG.md

Whitespace-only changes.

docs/PARAMETERS.md

Whitespace-only changes.

docs/RESTACKER-YML.md

Whitespace-only changes.

0 commit comments

Comments
 (0)