#refarch - February 2023

@Erik Osterman (Cloud Posse) has joined the channel

set the channel description: Cloud Posse Reference Architecture

@Christopher Pieper has joined the channel

@Ben Smith (Cloud Posse) has joined the channel

@Dan Miller (Cloud Posse) has joined the channel

<!subteam^S0316FFT4M9|@cloudposse-team>

@Andriy Knysh (Cloud Posse) has joined the channel

@Jeremy G (Cloud Posse) has joined the channel

@johncblandii has joined the channel

@Maxim Mironenko (Cloud Posse) has joined the channel

@Andy Miguel has joined the channel

@Yonatan Koren has joined the channel

@RB has joined the channel

@Dan Meyers has joined the channel

@Hugo Samayoa has joined the channel

@Steven Hopkins has joined the channel

@Max Lobur has joined the channel

@Leo Przybylski has joined the channel

@Lucky has joined the channel

@Ralf Pieper has joined the channel

@Omry Hay has joined the channel

@johntellsall has joined the channel

hey folks, i'm working through setting up the refarch and I have aws-teams, aws-team-roles, and aws-sso deployed. I'm unable to use my SSO creds to run Terraform, though.

All of my configs are basically straight from the module READMEs except the permission_sets in tfstate-backend and teams/team-roles. Any insight here would be great

√ . [xy-core-gbl-identity] (HOST) infrastructure ⨠ aws sts get-caller-identity
{
    "UserId": "AROXYZDFHBTIJLNHGWBBH:John.Bland@somewhere.com",
    "Account": "0123456789",
    "Arn": "arn:aws:sts::0123456789:assumed-role/AWSReservedSSO_IdentityAdminRoleAccess_xzypdq/John.Bland@somewhere.com"
}

√ . [xy-core-gbl-identity] (HOST) infrastructure ⨠ aws sts get-caller-identity --profile xy-core-gbl-identity-admin
{
    "UserId": "AROXYZDFHBTIKLO6H2Y6S:botocore-session-1677008620",
    "Account": "0123456789",
    "Arn": "arn:aws:sts::0123456789:assumed-role/xy-core-gbl-identity-admin/botocore-session-1677008620"
}

√ . [xy-core-gbl-identity] (HOST) infrastructure ⨠ aws sts get-caller-identity --profile xy-core-gbl-audit-admin

An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::0123456789:assumed-role/AWSReservedSSO_IdentityAdminRoleAccess_xzypdq/John.Bland@somewhere.com is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::9876543210:role/xy-core-gbl-audit-admin

√ . [xy-core-gbl-identity] (HOST) infrastructure ⨠ aws sts get-caller-identity --profile xy-core-gbl-root-terraform

An error occurred (AccessDenied) when calling the AssumeRole operation: User: arn:aws:sts::0123456789:assumed-role/AWSReservedSSO_IdentityAdminRoleAccess_xzypdq/John.Bland@somewhere.com is not authorized to perform: sts:AssumeRole on resource: arn:aws:iam::456789321:role/xy-core-gbl-root-terraform

oh and i'm SSO auth'd from Leapp, renamed role to the xy-core-gbl-identity which can assume role to xy-core-gbl-admin just fine

@Sean Nguyen @Christopher Pieper @Alex Siegman @Michael Pursifull @Amrutha Sunkara

@Sean Nguyen has joined the channel

@Alex Siegman has joined the channel

@Michael Pursifull has joined the channel

@Amrutha Sunkara has joined the channel

We have a single administrative stack, but lately have found it takes a very long time to plan given that the # of our stacks has recently exploded (we’re at 1200+ Spacelift stacks currently).

Has anyone considered splitting their administrative stack into multiple admin stacks? Perhaps along tenant lines

the only policy attached to an admin stack is TRIGGER Administrative Policy. shouldn't it get the git push-specific policies too?

worker pools user-data.sh is failing to run after this log and before the next. Any ideas why this would fail to run?

  echo "Turning on swap" | tee -a /var/log/spacelift/info.log
  dd if=/dev/zero of=/swapfile bs=128M count=32 2>/var/log/spacelift/error.log
  chmod 600 /swapfile 2>/var/log/spacelift/error.log
  mkswap /swapfile 2>/var/log/spacelift/error.log
  swapon /swapfile 2>/var/log/spacelift/error.log
  swapon -s | tee -a /var/log/spacelift/info.log