As a cloud.gov operator, I want to be able to deploy the AWS service broker to staging.

[spgreenberg]

In order to test the AWS service broker for redis and elastic search as a replacement for Kubernetes, we need the broker deployed to staging.

Acceptance Criteria

• the AWS service broker at https://github.com/awslabs/aws-servicebroker is deployed to the staging environment via a concourse pipeline
• the redis and elastic search offerings are made available in the marketplace via a test org.
• the names of the redis and elastic search offerings do not clash with existing offerings in the marketplace.

Implementation sketch

Pipeline:

• [ ] ingests the broker release as a resource: https://github.com/awslabs/aws-servicebroker/releases
• [ ] deploys the broker as an application to cloud.gov (including necessary services)
• [ ] registers the service broker with the cloud controller
• [ ] makes the redis and elastic search offerings available in a test organization

Repository: https://github.com/18F/cg-deploy-aws-servicebroker

[karareinsel]

@spgreenberg is this ready to start work this sprint?

[ChrisMcGowan]

Update:

• The repo included complied cf binary works for some services but does not work for provided elasticsearch template.
• With the help of @mxplusb we cut a new binary that fixed a S3URL bug in the broker go code.
• Using the custom binary we still get S3 access issues for the broker user itself.
• Using the cf manifest provided creds into the aws cli we can access the bucket in question as the broker user.
• Other services like elasticache and dynamodb don't error out and proceed to creating the stack in Cloudformation. The elasticsearch template does not even get that far into CF.

Next steps:

• The main example uses a assumed role that holds very high level permissions inside iam and other amazon services in the vpc. Create the role and assign it as a target role to the broker and test to see if the code base used for creating elasticsearch via CF templates relies on assumed role vs native permissions
• If assumed role works, try to reduce down the level of permissions in the role only to those needed for the services provided if the policy declaration fits into policy size constants of AWS IAM

[karareinsel]

@ChrisMcGowan @spgreenberg - Is there a status update that can be shared so that @RonWilliams can coordinate a new testing time with Coalfire?

[karareinsel]

@ChrisMcGowan @soutenniza should this be closed out in favor of new cards that reflect the latest information since AWS is no longer being pursued as the broker option?

[ChrisMcGowan]

For now this ticket can be closed as work has suspended in favor of other options. There is a github repo and S3 bucket which contains the existing work which can be leveraged for this broker in later use for native AWS services