This repository contains infrastructure-as-code and automation for managing AWS resources across multiple accounts (Backups, DevOps, Corp, Management, and foundations-dev for development). It includes CloudFormation, Terraform, Kubernetes manifests, automation scripts, and GitHub Actions workflows for CI/CD, account management, and auditing.
As of 20250904 the new platform backup-<env> accounts are also managed from this repo.
As of 20251223 the new 'sdlc-' accounts are also managed from this repo.
- EKS Cluster Deployments: Automated deployment and management of EKS clusters and related resources for private GitHub Action runners.
- StackSet Deployments: CloudFormation StackSets for shared infrastructure across accounts.
- Account Initialization: Bootstraps new AWS accounts with required IAM roles and OIDC providers.
- Role and Access Management: Ensures InfoSec and DevOps roles are consistently deployed and have the correct permissions.
- Addons and Caching: Updates and manages EKS addons and caching infrastructure for runners.
- Terraform Setup: Deploys initial Terraform resources for new environments.
- Auditing and Reporting: Scripts and workflows for auditing AWS account access, especially for InfoSec.
Workflows are defined in .github/workflows/ and automate:
- Deploying DNS aggregator, EKS clusters, StackSets, and other infrastructure on changes to relevant files or branches.
- Manual and automated workflows for initializing accounts and updating EKS addons.
- Auditing InfoSec group access and generating remediation commands.
- Review the
.github/workflows/directory for automation entry points. - Use scripts in
guild-management/account-access/for auditing and managing AWS account access. - See subdirectory READMEs for more details on specific infrastructure components.