create ci-staging aws account

[MarcoIeni]

We want to test running github actions into aws, so I created a new aws account.

Name

Do you like the name of the account or is it too minimal?

I also considered ci-runners-{staging, prod}

Plan

12:21:59.778 STDOUT terraform: Terraform will perform the following actions:
12:21:59.778 STDOUT terraform:   # aws_organizations_account.ci_staging will be created
12:21:59.778 STDOUT terraform:   + resource "aws_organizations_account" "ci_staging" {
12:21:59.778 STDOUT terraform:       + arn               = (known after apply)
12:21:59.778 STDOUT terraform:       + close_on_deletion = false
12:21:59.778 STDOUT terraform:       + create_govcloud   = false
12:21:59.778 STDOUT terraform:       + email             = "[email protected]"
12:21:59.778 STDOUT terraform:       + govcloud_id       = (known after apply)
12:21:59.778 STDOUT terraform:       + id                = (known after apply)
12:21:59.778 STDOUT terraform:       + joined_method     = (known after apply)
12:21:59.778 STDOUT terraform:       + joined_timestamp  = (known after apply)
12:21:59.778 STDOUT terraform:       + name              = "ci-staging"
12:21:59.778 STDOUT terraform:       + parent_id         = (known after apply)
12:21:59.778 STDOUT terraform:       + status            = (known after apply)
12:21:59.778 STDOUT terraform:       + tags_all          = (known after apply)
12:21:59.778 STDOUT terraform:     }
12:21:59.778 STDOUT terraform: Plan: 1 to add, 0 to change, 0 to destroy.

[jdno]

The name is fine for me. Maybe we want to move the CI caches there eventually as well...

[MarcoIeni]

applied

[Mark-Simulacrum]

I might add rustc or something to the account names; if we do this it seems likely we'll want to limit to partition by account any different repos.

[MarcoIeni]

are you proposing to have one account per repo? Sounds a bit too much 🤔

Probably I misunderstood. We can discuss in zulip, too 👍

[Mark-Simulacrum]

At the very least I would isolate our user-facing builds (i.e., rustc dist) in its own account. Long-term even if we don't pursue CodeBuild I'd expect us to move the S3 buckets and what not related to rustc dist into said account, and accounts provide a default isolation boundary that takes intentional effort to break (unlike e.g. just being careful with permissions).