Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Doc | Post-deployment section: change method to get temp password #140

Merged
merged 6 commits into from
Oct 5, 2022
Merged

Doc | Post-deployment section: change method to get temp password #140

Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
3597cd9
doc(first-steps/post-deployment): add new step to avoid errors with mfa
rodriguez-matias Sep 22, 2022
a85b809
doc(first-steps/post-deployment): update the information to make it m…
rodriguez-matias Sep 24, 2022
5dc270a
doc(first-steps/post-deployment):update the method to get temp passwd.
rodriguez-matias Sep 24, 2022
4fd1229
doc(first-steps/post-deployment): update information in credentials step
rodriguez-matias Sep 29, 2022
5b9beb1
Merge branch 'doc-flz-post-deployment-profiles-mfa' of github.com:bin…
rodriguez-matias Sep 29, 2022
f119f8b
doc(first-steps/post-deployment): update -json flag command
rodriguez-matias Sep 29, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 41 additions & 9 deletions docs/first-steps/post-deployment.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ When Natasha's user was created, an initial random password was also created alo

As Natasha, you need to access that password so that you can create your programmatic keys to interact with the environment through Leverage.

First, for the `management` account, change the value `sensitive` to `true` in the output block `user_natasha_romanoff_login_profile_encrypted_password` of `management/global/base-identities/outputs.tf`:
First, for the `management` account, check that the value `sensitive` is set to `true` in the output block `user_natasha_romanoff_login_profile_encrypted_password` of `management/global/base-identities/outputs.tf`:

``` terraform
output "user_natasha_romanoff_login_profile_encrypted_password" {
Expand All @@ -20,16 +20,23 @@ output "user_natasha_romanoff_login_profile_encrypted_password" {
}
```

Then, in the `global/base-identities` directory, run:
Then, in the `global/base-identities` directory, run the output command with the `-json` flag:

``` bash
leverage terraform apply
leverage terraform output
leverage terraform output -json
```
```
...
user_natasha_romanoff_login_profile_encrypted_password = "SipVOzVtNTI0Ml...EZmJFxxQSteYQ=="
user_natasha_romanoff_name = "natasha.romanoff"
"user_natasha_romanoff_name": {
"sensitive": false,
"type": "string",
"value": "natasha.romanoff"
},
"user_natasha_romanoff_login_profile_encrypted_password": {
"sensitive": true,
"type": "string",
"value": "wcDMAyRZJTaxw5v1AQwAy6c...............2mBIbNFxF1Tp/ilvyk8eEHvAA="
}
Comment on lines +26 to +39
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rodriguez-matias Matu, I'm wondering why you've changed this command with the json output instead of the original one

CC: @angelofenoglio @juanmatias

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@exequielrafaela with the original method, in order to get the temp credentials , we need to do:

  • change the sensitive argument from true to false .
  • Save the changes and then run the apply + output commands
  • Then change it back again to sensitive = True
  • And apply again the changes

with the output -json command we can obtain the value of the temp passwd without make any change in the code

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@rodriguez-matias I see, I think that is by design, so this seems to be some kind of workaround to skip that. But you have a good point that even if the sensitive property it's set to "True" we can skip that "secure" config.

Let's discuss this along @angelofenoglio and @diego-ojeda-binbash in order to have their feedback.

...
```

Expand All @@ -46,7 +53,7 @@ As Natasha also has an IAM user for the `security` account besides the one in `m
To be able to use the generated programmatic keys, you need to configure them in your local environment. To do that, run:

``` bash
leverage credentials configure --fetch-mfa-device --type MANAGEMENT # or `SECURITY` depending on the credentials to configured
leverage credentials configure --type MANAGEMENT # or `SECURITY` depending on the credentials to be configured
```
<pre><code><span class="fsg-timestamp">[12:28:12.111]</span> INFO Loading configuration file.
<span class="fsg-timestamp">[12:28:12.132]</span> INFO Loading project environment configuration file.
Expand All @@ -57,8 +64,6 @@ leverage credentials configure --fetch-mfa-device --type MANAGEMENT # or `SECURI
<span class="fsg-prompt">></span> <b>Secret: <span class="fsg-userinput">****************************************</span></b>
<span class="fsg-timestamp">[12:28:30.739]</span> INFO <b>Management credentials configured in:</b> <span class="fsg-path">/home/user/.aws/me/credentials</span>
<span class="fsg-timestamp">[12:28:34.991]</span> INFO Configuring assumable roles.
<span class="fsg-timestamp">[12:28:34.993]</span> INFO Fetching organization accounts.
<span class="fsg-timestamp">[12:28:37.060]</span> INFO Fetching MFA device serial.
<span class="fsg-timestamp">[12:28:39.299]</span> INFO Backing up account profiles file.
<span class="fsg-timestamp">[12:28:39.941]</span> INFO Configuring profile <b>me-management-oaar</b>
<span class="fsg-timestamp">[12:28:45.205]</span> INFO Configuring profile <b>me-security-oaar</b>
Expand Down Expand Up @@ -138,6 +143,33 @@ Similarly to the management user's MFA enabling step, you are switching from usi

As a last step you need to make sure that `MFA_ENABLED` is set to `true` in the `build.env` file.

## Re-Configure profiles MFA

For everything to work as expected, you need to set the aws configuration profiles to the corresponding mfa-device configuration.

Then run `leverage credentials configure` again with the `--fetch-mfa-device` flag and select the `skip credentials configuration` option.

As an alternative, the flag [--skip-access-keys-setup](https://leverage.binbash.com.ar/user-guide/leverage-cli/reference/credentials/#options) could be used to avoid the interactive step.

``` bash
leverage credentials configure --fetch-mfa-device --type MANAGEMENT
leverage credentials configure --fetch-mfa-device --type SECURITY
```
<pre><code>
<span class="fsg-timestamp">[10:10:11.033]</span> INFO Loading configuration file.
<span class="fsg-timestamp">[10:10:11.092]</span> INFO Loading project environment configuration file.
<span class="fsg-timestamp">[10:10:11.093]</span> INFO Loading Terraform common configuration.
<span class="fsg-prompt">></span> <b> Credentials already configured for ld-management: <span class="fsg-userinput">Skip credentials configuration. Continue on with assumable roles setup.</span></b>
<span class="fsg-timestamp">[10:10:30.345]</span> INFO Attempting to fetch organization accounts.
<span class="fsg-timestamp">[10:10:33.928]</span> INFO Configuring assumable roles.
<span class="fsg-timestamp">[10:10:33.932]</span> INFO <b>Fetching MFA device serial.</b>
<span class="fsg-timestamp">[10:10:37.473]</span> INFO Backing up account profiles file.
<span class="fsg-timestamp">[10:10:38.913]</span> INFO Configuring profile <b>me-management-oaar</b>
<span class="fsg-timestamp">[10:10:53.088]</span> INFO Configuring profile <b>me-security-oaar</b>
<span class="fsg-timestamp">[10:11:08.229]</span> INFO Configuring profile <b>me-shared-oaar</b>
<span class="fsg-timestamp">[10:11:23.185]</span> INFO <b>Account profiles configured in:</b> <span class="fsg-path">/home/user/.aws/me/config</span>
</code></pre>

## Next steps

Now you not only have a fully functional landing zone configuration deployed, but also the users to interact with it are correctly configured in both the AWS and local environment.
Expand Down