DevOps Roadmap

Area 1 - Documentation

• how to set up new projects in incubator
• example github actions

Area 2 - Formalize IAM user access

• data (secrets, S3 objects, etc) should only be able to be read by project users
• same for write, different group
• devops is different, read/write/admin for all projects
• access level and project tags don't make sense, use IAM groups instead

Area 3 - Make sure that all resources are in terraform, and can only be managed via terraform

• have special tags for things that cannot be managed by terraform (s3 backend, dynamodb etc)
• do some kind of documented way of figuring out what's not in terraform (tag editor, etc)

Area 4 - Better IAM user automation

• need a better way to deal with new user passwords and stale AWS accounts
  • upon creation of a new IAM user, set password and send email to someone with their password and login instructions
  • if someone creates an account then doesn't log in for 30 days, account is flagged for removal

Area 5 - Monitoring / Slackbot

• send messages to a slack channel for events:
  • if service has gone down
  • if cpu or memory usage is out of control