becollective-infrastructure

becollective-infrastructure

Setup your development environment

Only criteria to get started is to install CloudFormation Linter. See details here

Install via Pip

pip install cfn-lint

Install via Homebrew

brew install cfn-lint

Moving BeCollective to the Cloud! Properly!

• Deploy VPC stack

• Setup MongoDB Atlas Peering:

  • Establish VPC Peering from MongoDB Atlas
  • Get PCX (Peering ID) from VPC Peering
  • Add Peering PCX ID to main routing table

• Deploy deployer stack

• Deploy custom-message-hook and pre-signup-hook lambda functions in services

• Grant ECS Repository cross account access to the new account See Reference Here.

  You should update the existing ecr-cross-account-access role in the main workingbee account.

  • In workingbee, go to IAM -> Roles, find role arn:aws:iam::223304667504:role/ecr-cross-account-access
  • Edit trust relationship
  • Attach a this code snippet at the end of the configuration JSON, in Statement array. This is required for infrastructure stack to be allowed to access ECS repositories while provisioning its ECS cluster.

  {
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::[new-aws-account-id]:root"
    },
    "Action": "sts:AssumeRole",
    "Condition": {}
  }
  

• Add permissions for each ECR Repository.

  • Go to Amazon ECR
  • Go to Repositories
  • One by one, select each Repository
    • Select Permissions
    • Select Edit Policy JSON
    • Add new account as an AWS Principal

• Setup and verify email address in SES.

  • grant access policy to Cognito in Identity Policies

    {
     "Version": "2008-10-17",
     "Statement": [
     {
         "Sid": "stmnt1559626874704",
         "Effect": "Allow",
         "Principal": {
             "Service": "cognito-idp.amazonaws.com"
         },
         "Action": [
             "ses:SendEmail",
             "ses:SendRawEmail"
         ],
         "Resource": "arn:aws:ses:eu-west-1:[new-aws-account-id]:identity/[e-mail]"
     }
     ]
    }
    

• Deploy Infrastructure stack

• A Cognito user will have been created (with the arn:aws:iam::aws:policy/AmazonCognitoPowerUser Policy). Manually create security keys and apply as updates to the appropriate config.ENVIRONMENT.json file in becollective-node.

• Deploy the rest of the services in the following order

  • send-email
  • timesheets
  • notifications
  • cron-approve-timesheet
  • cron-create-timesheet
  • cron-expire
  • cron-opportunity-updates
  • cron-send-default-volunteer-briefs
  • cron-send-volunteer-briefs
  • cron-sitemap
  • documents
  • report
  • accounts
  • cron-batch-emails
  • cron-working-with-children-check
  • smartlists
  • events
  • opportunities
  • groups
  • users
  • etc

• Update @becollective/config package. (services could be redeployed with the latest @becollective/config package)

• Deploy MongoDB Stitch services. (Mainly notification based on data insert at the moment)

• Deploy ECS aka the containerised node services.

• Add new Public Load Balancer to AWS Route53 as a CNAME for lb-<env>.becollective.com

• Add new Private Load Balancer to AWS Route53 as a CNAME for private-lb-<env>.becollective.com

• Add Public Load Balancer as default to config package.

• Deploy admin page.

• Deploy Landing page.

• Deploy Gateway page.

• Deploy Management Portal.

• Clone over S3 buckets (if existing)

• Create ImgIX domain

• Update Fastly with new region VCL

• (Optional) Add Reserved Nodes for Redis