becollective-infrastructure

Setup your development environment

Only criteria to get started is to install CloudFormation Linter. See details here

Install via Pip

pip install cfn-lint

Install via Homebrew

brew install cfn-lint

Moving BeCollective to the Cloud! Properly!

1. Deploy VPC stack

2. Setup MongoDB Atlas Peering:

   1. Establish VPC Peering from MongoDB Atlas
   2. Get PCX (Peering ID) from VPC Peering
   3. Add Peering PCX ID to main routing table

3. Deploy deployer stack

4. Deploy custom-message-hook and pre-signup-hook lambda functions in services

5. Grant ECS Repository cross account access to the new account See Reference Here.

   You should update the existing ecr-cross-account-access role in the main workingbee account.

   1. In workingbee, go to IAM -> Roles, find role arn:aws:iam::223304667504:role/ecr-cross-account-access
   2. Edit trust relationship
   3. Attach a this code snippet at the end of the configuration JSON, in Statement array. This is required for infrastructure stack to be allowed to access ECS repositories while provisioning its ECS cluster.

   {
     "Effect": "Allow",
     "Principal": {
       "AWS": "arn:aws:iam::[new-aws-account-id]:root"
     },
     "Action": "sts:AssumeRole",
     "Condition": {}
   }

6. Add permissions for each ECR Repository.

   1. Go to Amazon ECR
   2. Go to Repositories
   3. One by one, select each Repository
      1. Select Permissions
      2. Select Edit Policy JSON
      3. Add new account as an AWS Principal

7. Setup and verify email address in SES.

   1. grant access policy to Cognito in Identity Policies

      {
       "Version": "2008-10-17",
       "Statement": [
       {
           "Sid": "stmnt1559626874704",
           "Effect": "Allow",
           "Principal": {
               "Service": "cognito-idp.amazonaws.com"
           },
           "Action": [
               "ses:SendEmail",
               "ses:SendRawEmail"
           ],
           "Resource": "arn:aws:ses:eu-west-1:[new-aws-account-id]:identity/[email protected]"
       }
       ]
      }

8. Deploy Infrastructure stack

9. A Cognito user will have been created (with the arn:aws:iam::aws:policy/AmazonCognitoPowerUser Policy). Manually create security keys and apply as updates to the appropriate config.ENVIRONMENT.json file in becollective-node.

10. Deploy the rest of the services in the following order

    1. send-email
    2. timesheets
    3. notifications
    4. cron-approve-timesheet
    5. cron-create-timesheet
    6. cron-expire
    7. cron-opportunity-updates
    8. cron-send-default-volunteer-briefs
    9. cron-send-volunteer-briefs
    10. cron-sitemap
    11. documents
    12. report
    13. accounts
    14. cron-batch-emails
    15. cron-working-with-children-check
    16. smartlists
    17. events
    18. opportunities
    19. groups
    20. users
    21. etc

11. Update @becollective/config package. (services could be redeployed with the latest @becollective/config package)

12. Deploy MongoDB Stitch services. (Mainly notification based on data insert at the moment)

13. Deploy ECS aka the containerised node services.

14. Add new Public Load Balancer to AWS Route53 as a CNAME for lb-<env>.becollective.com

15. Add new Private Load Balancer to AWS Route53 as a CNAME for private-lb-<env>.becollective.com

16. Add Public Load Balancer as default to config package.

17. Deploy admin page.

18. Deploy Landing page.

19. Deploy Gateway page.

20. Deploy Management Portal.

21. Clone over S3 buckets (if existing)

22. Create ImgIX domain

23. Update Fastly with new region VCL

24. (Optional) Add Reserved Nodes for Redis