set up the frontend production infrastructure

vilnacrm commented 1 year ago

As a frontend/user, I need to be able to merge pull requests to the main branch and see my features and fixes on the production vilnacrm.com.

[x] configure Terraform for frontend (Cloudfront, AWS S3)
[x] implement CD for terraform pipeline (execute terraspace up when PR've merged to the main branch)
[x] add automatically roles, and permissions using Terraform
[x] configure GitHub Actions to deploy production (replace this implementation with the AWS CodeBuild approach to be more secure)
[x] create health checks for deploying production
[x] configure logs, monitoring, and alerting for frontend through AWS CloudWatch
[x] configure alerting channels in Slack (sentry, cloud watch, uptime robot)
[x] set up blue/green releases for the frontend production deployments
[x] add diagrams

[ ] new features deployed to the production after merging pull requests to the main branch
[x] health checks works
[x] all teams can see logs and monitoring information
[x] alerts works and writes to the slack
[x] production deploying according to the rules of the blue/green release
[x] rollback is working for production
[x] all infrastructure CI checks passed

YapieRT commented 8 months ago

[x] Rework Validation
[x] Rework hurl
[x] Move Versions in Buildspecs to one file
[x] Duplicate external S3 module into repository
[x] (Checkov) Remove S3 lifecycle configuration and suppress error CKV2_AWS_61
[x] (Checkov) Ignore KMS S3 CKV_AWS_145
[x] (Checkov) Integrate S3 CKV_AWS_144
[x] (Checkov) Integrate S3 CKV_AWS_18
[x] (Checkov) Integrate S3 CKV2_AWS_32
[x] (Checkov) Integrate S3 CKV2_AWS_62 and implement into ChatBot security channel and only when it`s not new version (Object removed and ObjectAcl) using Lambda.
[x] (Checkov) Integrate Cloudfront CKV2_AWS_47
[x] (Checkov) Integrate Cloudfront CKV_AWS_310
[x] (Checkov) Integrate Cloudfront CKV_AWS_86
[x] (Checkov) Integrate Cloudfront CKV_AWS_68
[x] (Terrascan) Ignore Ensure that geo restriction is enabled for your Amazon CloudFront CDN distribution to whitelist or blacklist a country in order to allow or restrict users in specific locations from accessing web application content.
[x] Send event about Cloudfront Failover
[x] Add step of pulling and building frontend

YapieRT commented 7 months ago

[x] Least privelege for all created roles and permissions using Access Advisor. ~ 3 days
[x] Remove tokens from secrets manager and create for it separate user for deployment. ~ 5 days
- Auto-rotation enabled.
- Delete terraform user.
- Use iamlive for scanning.
- Use AWS session or AWS STS.
[x] First - deployment users and for different stack - different users(codepipeline and website) in these stacks. ~ 8 days
[x] Create auto system for iamlive.** Needs IAM user that can change role`s policies and only this. ~ 4 days

Deadline: 22 April

VilnaCRM-Org / website-infrastructure