Boomtap Infra

Prerequisites

You need:

Node.js
AWS CLI
AWS CDK Toolkit
Proper AWS credentials

Get a new environment up and running

There are a few steps to get there:

Create an AWS account that is member of the organization

Easiest way is using CLI's create-account command
```
% aws organizations create-account --email <value> --account-name <ENVIRONMENT_NAME>
```
Recommended: save the account id in a variable as you'll need it in the steps below.

Define a profile that can assume the OrganizationAccountAccessRole

# ~/.aws/config

[profile <NAME_OF_PROFILE>]
role_arn = arn:aws:iam::<ACCOUNT_ID>:role/OrganizationAccountAccessRole
source_profile = default (or any profile whose credentials have the OrganizationAccountAccessRole)
region = <REGION>

Create a policy that allows CDK to deploy resources on this account

pnpm policy:create <backstage|prod>

Bootstrap the CDK for the new account

cdk bootstrap /
   -c env=<ENVIRONMENT_NAME> /
   --cloudformation-execution-policies "arn:aws:iam::$ACCOUNT_ID:policy/CDKExecutionAccess" /
   [--profile <PROFILE_NAME>]

Updating the CDK execution policy

You might need to expand the permission that CDK currently has to deploy resources. To do so, update the CDKExecutionAccess policy with the new Actions you need and with respect to the least privilege principle.

Update cdkExecutionPolicy.json
Run pnpm policy:update <backstage | prod>
You probably don't need to run the bootstrap script again. But try it if deployment doesn't work.

There is a limit to 5 Policy versions, so we need to delete old versions to make updates. But it’s not difficult. We simply list existing versions:

aws iam list-policy-versions \
      --policy-arn arn:aws:iam::$ACCOUNT_ID:policy/CDKExecutionAccess

And then delete the selected old version:

aws iam delete-policy-version \
      --policy-arn arn:aws:iam::$ACCOUNT_ID:policy/CDKExecutionAccess \
      --version-id <VERSION>

Other useful commands

pnpm build --> compile typescript to js
pnpm watch --> watch for changes and compile
pnpm test --> perform the jest unit tests
cdk diff --> compare deployed stack with current state
cdk synth --> emits the synthesized CloudFormation template

Misc