mostlygeek
commented
11 years ago Note: All of these are alpha ideas. To be done/tested/iterated to find something good.
- Multi-Region
- One node per region, m1.small
- Security groups to only allow HTTPS access directly to the nodes.
- or... no direct access to nodes. Use an ELB as an SSL terminator. (simplifies node config)
- Nodes operate independently (shared nothing)
- Nodes talk back to main LDAP directory via encrypted link
Things to figure out
Encrypted WAN Link
- what is the encrypted WAN link? VPN? LDAPS, LDAP + TLS?
- what does secops require. IE: IP lockdown? This is more difficult w/ AWS type infrastructure as IP addresses can change. Whitelisting an AWS block seems pointless. TBD
Deployment
- Deployment, we want quick/fast/repeatable. Perhaps:
- Start w/ an AMI that is copied to each region
- boot them through the AWS console
- then do it through the CLI EC2 tools
- then turn it into a shell script so it is 1 step to add a new node
lloyd
Current Proposal:
3 regions, 2 m1.small instances each. All communicating with LDAP over WAN.
See the attached bug for some deeper thought. let's pile on here.