3 ms·

Might I ask how you bootstrap your CloudFormation setup? Do you set up all IAM accounts via CloudFormation on the root account, or do you use something else for

Might I ask how you bootstrap your CloudFormation setup? Do you set up all IAM accounts via CloudFormation on the root account, or do you use something else for that? What do you run your CloudFormation templates on, dev machines or something on AWS? I'm currently tasked with getting a SaaS application onto Amazon and picking it up as I go along, mostly just from the docs. It's been very hard to find high-level overviews of ways to use AWS's ops tools like CloudFormation, most articles I've found are about one specific API and not about architecturing AWS apps.

BoorishBears 9y ago
Serverless gets its own user that has the permissions needed to apply our CF templates, then the templates define the IAM roles. But I guess depending on the structure of your team and deploy that can be an issue, since having the serverless credentials = being able to create and assign IAMs. For example, if those credentials are in your CI, now giving someone access to your CI also gives them access to an AWS user who's practically a "superuser" (although tbh, I'm not sure how much of a problem that is since access to CI is already a pretty big deal). We run serverless (which in turn applies the CF templates) on Jenkins instead of locally (which also helps automate passing the correct stage and parameters). I guess the equivalent without serverless would be just be using aws-cli, since serverless doesn't do anything special to the CF templates There was a great webinar on production deployments with SAM (which you could replace with CF) via CodePipeline, but I can't seem to find the slides for it anywhere. If we "did it again" we'd probably use CodePipline/CodeBuild(We just used Jenkins because we didn't really have a chance to look at other options)
- cryptarch 9y ago
  Thanks for the advice, I think I'm going the CodePipeline/CodeBuild route :)

BoorishBears 9y ago

Serverless gets its own user that has the permissions needed to apply our CF templates, then the templates define the IAM roles. But I guess depending on the structure of your team and deploy that can be an issue, since having the serverless credentials = being able to create and assign IAMs. For example, if those credentials are in your CI, now giving someone access to your CI also gives them access to an AWS user who's practically a "superuser" (although tbh, I'm not sure how much of a problem that is since access to CI is already a pretty big deal). We run serverless (which in turn applies the CF templates) on Jenkins instead of locally (which also helps automate passing the correct stage and parameters). I guess the equivalent without serverless would be just be using aws-cli, since serverless doesn't do anything special to the CF templates There was a great webinar on production deployments with SAM (which you could replace with CF) via CodePipeline, but I can't seem to find the slides for it anywhere. If we "did it again" we'd probably use CodePipline/CodeBuild(We just used Jenkins because we didn't really have a chance to look at other options)

cryptarch 9y ago
Thanks for the advice, I think I'm going the CodePipeline/CodeBuild route :)