Skip to content

prerequisites.md

Latest commit

 

History

History
296 lines (191 loc) · 5.57 KB

prerequisites.md

File metadata and controls

296 lines (191 loc) · 5.57 KB
Raw

Prerequisites

  • AWS account
  • IAM user with administrative permissions
  • AWS CLI v2 installed and configured
  • Terraform installed
  • kubectl installed
  • A custom domain purchased from any domain provider
    • Example: Hostinger, Namecheap, GoDaddy, etc.

Configure GitHub OIDC Authentication with AWS

  • Using GitHub OIDC removes the need for long-lived AWS access keys in GitHub Secrets by enabling short-lived, securely scoped role assumption from GitHub Actions workflows.

  1. IAM Identity Provider:

    • Provider URL: https://token.actions.githubusercontent.com

    • Audience: sts.amazonaws.com

      identity-provider

  2. Deployment Role:

    • Click on created Identity provider

    • Assign & Create a role named GitHubActionsRole.

    • Enter the following details:

      • Identity provider: Select the created one.
      • Audience: Select the created one.
      • GitHub organization: Your GitHub username or organization name where this repository is located.
      • GitHub repository: Enter the repository name of this project (e.g., github-actions-kubernetes-masterclass).
      • GitHub branch: The branch to use for this project (e.g., main).
      • Click on Next.

      role

    • Assign AmazonEC2ContainerRegistryPowerUser permissions.

      iam permission

    • Click on Next, enter the name of the role, and click on Create role.

      iam role

Configure GitHub Secrets & Environment Variable

Add the following secrets/variable in the GitHub repository settings:

Secrets Description
AWS_ROLE_ARN The ARN of the GitHubActionsRole
AWS_REGION The AWS region where resources are deployed
AWS_ACCOUNT_ID Your 12-digit AWS account number
Variable Description
DEPLOY_ENABLED true

RepoSecrets

RepoVar

Create Public Hosted Zone in Route 53

Log in to the AWS Management Console.

Go to:

Route 53 → Hosted zones

Click:

Create hosted zone

Enter:

Domain name: cloud2devops.online
Type: Public Hosted Zone

Click:

Create hosted zone

PublicHostedZone

CreatedPublicHostedZone

Copy Route 53 NameServers

Copy all 4 NS records.

Example:

ns-1682.awsdns-18.co.uk
ns-1102.awsdns-09.org
ns-507.awsdns-63.com
ns-628.awsdns-14.net

Update NameServers in Hostinger

Go to:

Hostinger → Domains → cloud2devops.online → Nameservers

Replace the existing nameservers with the Route 53 nameservers.

Save the changes.

Nameservers

Wait for DNS propagation.

Verify:

nslookup -type=NS cloud2devops.online 8.8.8.8

DNSResolve

  • Google Public DNS (8.8.8.8) is used to validate DNS resolution independently of the local resolver (router/ISP DNS), ensuring authoritative DNS propagation from Route 53 is correct.

Create ACM Wildcard Certificate

Important: The ACM certificate must be created in the same AWS region where the Application Load Balancer (ALB) is deployed.

Go to:

AWS Certificate Manager (ACM)

Select the region:

ap-south-1

Click:

Request certificate

Choose:

Request a public certificate

PublicCert

Add the domains:

cloud2devops.online
*.cloud2devops.online

Choose the validation method:

DNS validation

Click:

Request

DomainNames

Validate ACM Certificate

Open the certificate.

Click:

Create records in Route 53

CreateCname

Click:

Create records

CreateRecords

Wait until status becomes:

Issued

Issued

Create ECR Repositories

  • Create the ECR repositories using the AWS CLI:
# For backend
aws ecr create-repository --repository-name skillpulse-backend --region ap-south-1

# For frontend
aws ecr create-repository --repository-name skillpulse-frontend --region ap-south-1

ECRRepo

Create an S3 Bucket with Versioning Enabled

Note: S3 bucket names are globally unique across AWS. Use a unique bucket name if skillpulse-tfstate is unavailable.

  1. Create the S3 bucket:
aws s3api create-bucket \
    --bucket skillpulse-tfstate \
    --region ap-south-1 \
    --create-bucket-configuration LocationConstraint=ap-south-1
  1. Enable versioning:
aws s3api put-bucket-versioning \
    --bucket skillpulse-tfstate \
    --versioning-configuration Status=Enabled
  1. Verify the versioning configuration:
aws s3api get-bucket-versioning --bucket skillpulse-tfstate

S3BucketCreated

Create the Secret in AWS Secrets Manager

Run the following command:

aws secretsmanager create-secret \
  --name skillpulse-db \
  --region ap-south-1 \
  --secret-string '{
    "MYSQL_ROOT_PASSWORD":"CHANGE_ME",
    "MYSQL_USER":"skillpulse",
    "MYSQL_PASSWORD":"CHANGE_ME",
    "MYSQL_DATABASE":"skillpulse"
  }'

Secrets

Next Stage

Follow Infra.md to provision the AWS VPC and Amazon EKS infrastructure using Terraform.