Open kj4ezj opened 1 year ago
I recommend reviewing the following relevant resources:
I propose we use the same organization strategy regardless of cloud provider, for consistency. AWS and GCP "best practices" contradict in the sense that AWS recommends against using an organization structure that is similar to your reporting structure, whereas GCP recommends for doing this. Neither explain why they make that recommendation, and I didn't find useful discussions about this online. I align more with GCP in this regard. Note that the structure can be changed.
I recommend we adopt the following structure.
Here, AWS nomenclature is in black while GCP nomenclature is in blue. The solid lines are resources that I recommend creating immediately, whereas the dotted lines are resources we may want in the future. These are primarily included to help visualize how the hierarchy would be used as we grow.
We would have the following layers.
Meta
organizational unit is an AWS-specific implementation detail which holds:
Admin
organizational unit is just an example that might contain resources relevant to the administration of the entire organization, such as buckets for grant informationRead
access at this levelWrite
access to lower environments, and Read
access to higher environments at this levelWhat is not captured in the diagram above is that we should be making use of IAM groups (called Google groups on GCP) to make it easy to grant permissions to specific teams. This makes it easier to revoke permissions from a specific individual who leaves our organization because instead of editing all of the nodes in the hierarchy, an administrator would only have to edit the IAM group.
Thanks for doing this Zach. Per my comments of Antelope and ENV being parallel orgs, it would be good to update the picture. Also OK to add in a perf_harness account/org parallel to DevRel and Engineering. This is very helpful.
https://github.com/eosnetworkfoundation/product please submit PR in this repo for md file documentation
While working on Developer Relations issue 80, I found there is not currently an organized layout of organizational units (OUs) and accounts in Amazon Web Services (AWS). These terms correspond to folders and projects in Google Cloud Platform (GCP), respectively, and we likely don't have a strategy for organizing resources there either. I brought up this concern and was asked by @ericpassmore to come up with such a strategy. This ticket tracks that subset of work.