17/05/2024
LF Dev, direct to client please read
Please DM or send me an email [email protected]
Base Requirements
For each Useability Epic to be complete, all AWS components must be completely described in Cloudformation or Terraform code that completely recreates the environment. Such code must provision instances only in accounts with minimal access required to run them.
All static secrets must be stored in AWS-native keystores and pulled via API on instance start.
Access between objects and instances must be defined and restricted via IAM policies.
Epic: Operational VDI environment
This epic is complete when TGVA staff can and are restricted to use the Simple Salt VDI to perform all Simple Salt work via the VDI platform.
WEBAPP ACCESS Milestone
A chrome browser prepopulated with bookmarks to Simple Salt web applications and the Bitwarden plugin. All user access is via OIDC federation via a Simple Salt IdP.
Workstation access Milestone
A VPN tunnel from the VDI that enables an RDP session pointed at the creative workstation.
Passwordless Access Milestone
Replace all access with kiosk-mode chrome sessions for each web platform needed by TGVA staff. Each webapp will automate login with a stored credential before presenting the user with access.
Epic: Internal Stack
Core APPS Milestone
Build and integrate the following systems and services:
Containers:
Superset (data visualization)
Codered (backend)
Appsmith (frontend)
Be able to quickly and consistently create storage and messaging instances for apps built on this stack:
S3 (blob)
DocumentDB (structured data)
SQS (message queue)
Environment sanitation
Restrict production AWS environment to only allow infrastructure changes via cloudformation or terraform. Set IAM policies to disallow unused services or datacenters. Set billing alerts.
Internal Access Milestone
Present all three webapps to the internet, with access only available via federated authentication from the Simple Salt O365 IdP.
Define IAM policies between all instances to restrict data flows.
Restrict outbound traffic from containers to a list of authorized data endpoints (eg O365, hubspot APIs).
App code control MILESTONE
Move container config to git for resiliency. Be able to commit current configuration for each container to git.
Maintain custom container definitions in git for each container defining additional required libraries, assets, and code.
Jobs to restart and update containers weekly and on negative health checks.
Epic: Customer Apps
Base stack Builds
Replicate the key features of the Internal Stack Epic as a parallel codebase for customer-facing products, building out at least three persistent internal environments and be able to easily deploy new ones into customer AWS environments.
CI/CD for container code
Build an automated code cascade allowing changes to apps in the dev environment to be committed to git, promoted to a test environment, and then a repo available for customer environments to automatically pull from.
customer onboarding
Build a reliable customer onboarding process to deploy the customer product stack in their environment and integrate automated access to their IdP.