Pre-work Checklist: DevOps-Security-Member: Mike Waggoner

[sudhara]

Prerequisite

We are looking forward to having you on our team. Please ensure you have prior experience with the HfLA website team before contributing to our repository.

Overview

As a new member on the HfLA devops-security team, fill in the following fields as you complete each onboarding item.

Special Notes

1. Keep this issue open until you've completed all steps, including learning to provide updates for longer tasks.
2. Normally, handle one issue at a time, but this one is an exception as it teaches how to manage multiple tasks.
3. Work on action items sequentially, but proceed if possible. For example, set up your dev environment without waiting for the weekly meeting.

Action Items

• Before starting to work on the below instructions, make sure to join the #ops Slack Channel. And are a member of devops-security repository.

• Self-assign this issue (gear in right side panel).

• Add this issue to the Project Board CoP: DevOps: Project Board - under the Projects section (gear in right side panel).

• Attend weekly team meeting, Wednesdays 6-8pm PST.

  • Note: There are no meetings on the 1st Wednesday of every month.

• Complete the steps in Creating a personal AWS account and Login as root user & setup MFA.

• Read and follow the instructions in Setting up IAM and AWS CLI for:

  • Creating an IAM User
  • Creating an IAM Group
  • Attaching IAM user to IAM Group
  • Providing AdministratorAccess policy to IAM group
  • Log in as the newly created user instead of continuing to log in as the root user (it is not recommended to login with root access).
  • Generating user access keys

• Complete the instructions in AWS Documentation and choose your operating system to install AWS CLI.

• Complete the instruction in AWS Documentation to setup the AWS CLI.

• Follow the instructions in Creating a backend state to create the S3 bucket and DynamoDB table.

  • Create the S3 bucket
  • Create the DynamoDB table

• Install Terraform locally by following the instructions of the installation guide mentioned in Installing Terraform

• Install Terraform Docs locally by following the instructions of the installation guide mentioned in Installing Terraform docs

• Complete the instructions in Clone the repository

• Submit a new request to create new AWS user account and then self-assign this issue.

• Create a new branch from main by executing the command

  git checkout -b issue-number-add-new-iam-user
  

• Navigate to the aws-user.tf file and add your user information to the end of the file following the below template.

  # Replace USERNAME with your GitHub handle
  module "iam_user_USERNAME" {
  source = "./modules/aws-users"
  
  user_name = "USERNAME" # Replace with GitHub handle
  user_tags = {
    "Project"      = "devops-security"
    "Access Level" = "1"
  }
  user_groups = ["read-only-group"]
  }
  

• In your code editor navigate to terraform directory. cd terraform

Note: You must be authenticated to your AWS account via the CLI for the next commands to work. The above instructions for setting up the CLI will guide you through this process. To check to see if you are authenticated, run aws sts get-caller-identity. You should get a response like:

{
    "UserId": "ABCDEFGHIJKLMNOPQRSTU",
    "Account": "012345678910",
    "Arn": "arn:aws:iam::012345678910:user/USERNAME"
}

If you are unable to authenticate from your local machine using the CLI, post in the #ops channel in Slack so that the team can help you get unblocked.

• Execute the command terraform init to initialize terraform in the directory. Address any failures that arise (if any).
• Execute the command terraform plan this will output a plan replicating the same IAM resources as the devops security account. Address any failures that arise (if any).
• Then execute the command terraform apply this will create all of the resources that are currently managed by Devops Security. All of the resources created here incur zero cost except for the Dynamo DB installation, which should remain in the free tier. **
  • If you have cost concerns, Run a Terraform Destroy to take down all of the resources you created (don't worry, you can recreate them just as quickly). If you create resources outside of what's described in this issue, you may incur charges.
• Update the README using Terraform Docs to document changes
  • terraform-docs -c .terraform.docs.yml .
• Once you have tested your changes, stage them in git with
  • git status command.
  • then git add path/to/file (you can copy from above output for the file path).
• Commit the changes by executing git commit -m "brief description of changes".
• Push the changes with git push --set-upstream origin name-of-branch

[ExperimentsInHonesty]

prework checklists need to be made by the person, not the lead. I am closing this issue as unplanned.

[here]

• Touched issue and completed additional aws account setup.
• New user issue request at Create new AWS user account - here #89
• New branch at https://github.com/hackforla/devops-security/tree/89-add-new-iam-user-here

---

Notable changes for peer review:

• User alexe role changed from ops-leads to read-only-group to avoid terraform apply 404 error on group ops-leads
• Username for new user @here changed to "herehfla" to avoid local error on terraform apply 409 user already exists for "here" and "herebox" as existing IAM users created prior to terraform apply.
• Self-assigned CONTRIBUTING.md ToC out of date #90 to help update CONTRIBUTING.md based on pre-work onboarding

[ale210]

@here changing your username is fine but please try to figure out a workaround for updating my role - I do need the ops-leads role :)

[ExperimentsInHonesty]

@here It looks like @ale210 asked for a change to your PR #92 (review) on 2025-01-22. Will you be making the change or should close the PR?

[ExperimentsInHonesty]

p.s. if you are staying, please add a role label that matches your skill you are working on here, or let us know if no roles match, what you would like to have.

[ExperimentsInHonesty]

Please do this

• Select a role label (gear in label section on the right). They begin with "role:". This should be what you want to do in the DevOps CoP

[ale210]

closing this issue as abandoned

[here]

• Reopening with updated iam user request in Add new iam user for self @here #92
• Role set to DevOps engineer

Thank you!