New Platform Operator Onboarding Checklist

Special Notes

Do not create this issue until the System Owner has formally authorized and requested it.
Please only use first names.

In order to get Mark productively contributing to the cloud.gov team, Andrew should help Mark complete a prescribed set of tasks that will bring them up to speed and get them setup with cloud.gov.

Instructions

Try to go through the checklists in order.
If Andrew can’t complete any of the items on their checklist personally, they are responsible for ensuring that someone with the correct access completes that item.

Onboarding Checklist

Required items for all team members

These items help us fulfill security and compliance requirements (including for FedRAMP). If you get stuck, or if these requirements are confusing, ask for help from your buddy or in a cloud.gov channel.

[x] Take judicious notes on what about this onboarding process or cloud.gov is confusing or frustrating. If you notice a problem (especially with things like documentation), you are more than welcome to fix it! At the very least, please share this information with your onboarding buddy (or someone) at some point so we can make the team/platform better. (You can also file issues and pull requests on the template Onboarding checklist.
[x] Be sure to introduce yourself and follow up with your onboarding buddy (they should have reached out to you at this point; if they haven't, please let the team know) and make sure this issue is assigned to them in our Github Project Planning Board. We use this board to organize, prioritize, and track our work.

Pre-requisites

[x] Complete GSA OLU GSA Mandatory Cyber Security and Privacy Training, including accepting the GSA IT Rules of Behavior, which is required before we can give you access to any cloud.gov systems. If you joined GSA more than two months ago, you've already completed this task and can just check the box.

Fulfill security and compliance requirements (including for FedRAMP) - Completed by onboarding buddy

[x] Make sure they're in the list of people working on the project.
[x] Add their name, whether they're Cloud Ops (Platform), and the date they joined the team to the training tracker. Copy the formulas for the due dates from an existing row (grab the "corner" of the cells and pull down).
[x] As they complete training, fill out their completion dates in the training tracker.
[x] Add them to the @cloud-gov-team in Slack’s Team Directory.
[x] Review the recurring cloud.gov meetings that are relevant for them in the team calendar (they will get access to this when added to the cloud.gov Team Google Group).
[x] Add them to the cloud-gov organization in GitHub, and the cloud-gov-team team.

Learn our policies and procedures

For the three trainings list at the top, your onboarding buddy will create a separate ticket to track the trainings once scheduling has been finished. This will help consolidate trainings for multiple new members to the team and prevent them from blocking progress on this onboarding ticket. Once the trainings are scheduled, they can be marked as complete here.

[x] Coordinate with your onboarding buddy to go through Contingency Planning training within 60 days (and annually after that). This will cover the following document, which you should also review before or after training:
- [x] Read the Contingency Plan.
[x] Coordinate with your onboarding buddy to go through Incident Response Training within 60 days of joining the team (and annually after that). This will cover the following document, which you should also review before or after training:
- [x] Read the Incident Response Guide.
[x] Coordinate with your onboarding buddy to go through nonpublic information training within 60 days of joining the team (and annually after that). This will cover the following documents, which you should also review before or after training:
- [x] Review the cloud.gov open source policy guidance about protecting sensitive information.
- [x] Read our sharing secret keys policy.
- [x] Review the TTS requirements for password management.
[x] Read the Continuous Monitoring Strategy, particularly the cloud.gov team responsibilities.
[x] Read the Configuration Management Plan.
[x] Read the cloud.gov Security Policies and Procedures. These documents explain the high-level policies and procedures we must comply with while running cloud.gov, sorted into security control "families" They explain that we follow GSA IT security policy, and they provide a summary of the procedures in our System Security Plan.
[x] Review the System Security Plan (the latest version lives on Google Drive; look for "cloud.gov System Security Plan (SSP)" as a .docx file). Of particular note for onboarding: Section 9 (System Description) and Section 10 (System Environment)

Getting to know cloud.gov

These items will help you come up to speed on cloud.gov and what it is, how it works, why it exists, etc. While you should take the time to go through them, please do not try and tackle it all in one shot! It can become overwhelming very quickly, so your onboarding buddy will walk through this list with you at a high level with you to help manage the work.

[x] Read the team onboarding document for more context about cloud.gov.
[x] Bookmark the pertinent links listed here.
[x] Read through the Overview section of our site for a broader understanding of cloud.gov, especially how we present it to potential customers and users.
[x] Sign up for a cloud.gov sandbox using your GSA email address and start experimenting to get familiar with the basics of the PaaS from a user's perspective.
- This is also required in order to make you a platform admin once you've completed the Cybersecurity and Privacy training.
[x] Read the Delivery Process document to learn about how we work.
[x] Read our service disruption guide to learn how we handle customer-facing service disruptions.
[x] Add the cloud.gov Google Drive folder to your Google Drive -- that's where we put cloud.gov docs. If you create or move a doc there, it'll get the right access permissions for team members to be able to view and edit it.
[x] Subscribe to the cloud.gov team calendar (click the + in the bottom right) so you know when assorted team meetings are happening in the various squads. Tip: When you plan Out of Office time, make a calendar event for that on the cloud.gov calendar so that your teammates know you'll be away

Slack channels

Your onboarding buddy will add you to these Slack channels:

[x] #cloud-gov - bots post announcements here
[ ] #cg-billing - private business development channel (if applicable)
[x] #cg-business - business development (if applicable)
[x] #cg-compliance - compliance-related information and discussion
[x] #cg-offtopic - off-topic team sharing
[x] #cg-platform - platform operations
[x] #cg-platform-news - bots post platform alerts
[x] #cg-general - program-level information and discusion
[x] #cg-support - support requests and assistance within TTS
[x] #cg-incidents - private channel for incident response
[x] #cg-supportstream - notification channel from our support system, ZenDesk
[x] #cg-priv-all - private channel for in-team discussion
[x] #cg-priv-gov (Federal employees only) - may contain discussion of contracting-related or other private, federal-employee-only comms

Once you're added to these channels, you probably want to mute these channels until you're on support rotation:

[x] #cg-supportstream - notification channel from our support system, ZenDesk
[x] #cg-support - support requests and assistance within TTS
[x] #cg-platform-news - platform alerts

Platform-Ops-specific items

You should already have admin rights on your machine as a part of its original setup. If for whatever reason you don't, Please let your onboarding buddy know and they will help you request local admin rights on your GFE Mac using this justification.

Cloud Operations account management

Note: These are all contingent on completing the GSA Mandatory Cyber Security and Privacy Training first. AWS user names should be identical across accounts so that permissions can be correctly managed by Terraform.

[x] Create AWS Accounts via the AWS web console (not Terraform) and provide one-time credentials - these will be setup as read-only at the start, and once the 3 mandatory cloud.gov trainings are complete they will be switched to full admin accounts and added to the audit input file:
- [x] AWS Commercial accounts
- [x] AWS GovCloud accounts
[x] Add them to Nessus Manager via the GUI
[x] Make them an admin of the platform.
[x] Add them to the platform-ops team in GitHub.
[x] Add them as an admin on the cg-django-uaa docs
[x] Add them to the cloud.gov team Google Group so they can participate in team-wide internal communication.
[x] Add them to our dockerhub org and ensure we're not over our license count
[ ] Business Unit Only - Add them to the cloud.gov inquiries Google Group so they can keep apprised of prospective new clients.

Your onboarding buddy will create a separate ticket tied to this one to track the AWS accounts being granted full admin access.

Additional compliance setup/review

[x] Install caulking git leak prevention by following the README
[x] Verify caulking by running make audit and pasting a screenshot as a comment on this GitHub issue
[x] Set GPG signing set up for GitHub (instructions here)

Install a development environment for cloud.gov

[x] Install Homebrew (brew)
[x] Install CloudFoundry for mac per their docs:
- brew tap cloudfoundry/tap
- brew install cf-cli@7
- brew install openssl
[x] Verify CloudFoundry Installation via the CLI (once an existing cloud.gov teammate has made your cloud.gov admin account)
- cf login -a api.fr.cloud.gov --sso
- cf orgs
- As a cloud.gov team member, you should have a very giant list of organizations
- If you have none or one (e.g. sandbox) org, please reach out to your onboarding buddy
[x] Install the Bosh CLI using their instructions for MacOS
- brew install cloudfoundry/tap/bosh-cli
- [x] Verify the installation by running bosh -v in the command line
[x] Install Terraform and other tools per cg-provision
- brew install terraform
- brew install awscli
- brew install jq
- [x] Verify Terraform installed and is in your path: run terraform and helper text should display
- [x] Verify AWS CLI installed and is in your path: run aws and helper text should display
[x] Install and configure aws-vault by following our directions
[x] Install the Concourse fly CLI
- Download the fly binary zip for MacOS from https://concourse-ci.org/
- Extract the binary and move it to /usr/local/bin/fly so it's in your path
- cd ~/Downloads
- mv fly /usr/local/bin/fly
- [x] Verify by running fly -h in your command line
- This may fail due to app security policy on your mac rejecting apps from unidentified developers.
- You can try the procedure here to change the app's security settings.
[x] Install cloud.gov dev tools by cloning the cg-scripts repo: run git clone https://github.com/cloud-gov/cg-scripts.git in your command line

Figure out your first tasks

Please work with your onboarding buddy to determine a platform component to work on first. Once you've identified the component you're going to focus on, your onboarding buddy will introduce you to someone who can onboard you to that project in specific. For the next few sprints, work on features, bugs, and improvements on this component. Reach out to your onboarding buddy or anyone else on the team if you need any help. Here are some easily-separated pieces to consider:

S3 broker (Golang, Open Service Broker API)
Aws broker (Golang, Open Service Broker API)
Domain brokers and friends (New stuff is all python + Open Service Broker API):
- External-domain broker
- legacy domain broker
- cdn broker
Logging stack (BOSH, ELK)
Prometheus (BOSH)
Stratos (golang + js)
uaa-extras (python + OIDC)
shibboleth (Java, OIDC)

Compliance items

These are items that are only necessary for someone stepping into a compliance role, but you can still subscribe to the alerts and mailing lists if you're interested:

[ ] Subscribe to US-CERT alerts: https://us-cert.cisa.gov/mailing-lists-and-feeds
[ ] Subscribe to FedRAMP mailing lists: https://public.govdelivery.com/accounts/USGSA/subscriber/topics?qsp=USGSA_2224
[ ] Read Compliance Lead documents at root of the Google Drive Security and Compliance folder

cloud-gov / product

Checklist for Onboarding Mark B. #1714