AWS Account Setup: My 10-Step Checklist After 14 Years

# Uses Terraform 1.9.7, but feel free to use whichever version you need
cd /tmp/ && \
wget https://releases.hashicorp.com/terraform/1.9.7/terraform_1.9.7_linux_amd64.zip && \
unzip terraform_1.9.7_linux_amd64.zip && \
sudo mv terraform /usr/bin && \
rm LICENSE.txt terraform_1.9.7_linux_amd64.zip && \
cd -

git config --global user.name "Your Name"
git config --global user.email "Your email"

ssh-keygen -t ed25519
cat ~/.ssh/id_ed25519.pub

aws ssm put-parameter \
    --name "/cicd/github_token" \
    --value "your GitHub PAT" \
    --type "SecureString" \
    --overwrite

# Replace the values below so the URL looks something like githube.com/myusername/my-repo without the <>.
git clone git@github.com/<github org|username>/<repo name>

mkdir terraform

module "bootstrap" {
    source = "github.com/build-on-aws/terraform-samples//modules/bootstrap-aws-account"

    state_file_aws_region  = "us-west-2"
    state_file_bucket_name = "name-for-the-state-file-bucket"
}

terraform init
terraform apply

terraform init -migrate-state

git add .
git commit -m "Create Terraform backend resources"
git push

# Change values as needed:
module "bootstrap_cicd_aws_codebuild" {
    source = "github.com/build-on-aws/terraform-samples//modules/bootstrap-cicd-aws-codebuild"

    github_organization       = "your org | github username"
    github_repository         = "your repo name"
    aws_region                = "us-east-2"
    state_file_iam_policy_arn = module.bootstrap.state_file_iam_policy_arn

    codebuild_terraform_version = "1.9.7"
}

# Pulls the new modules
terraform init 
terraform apply

git add .
git commit -m "Adding the CI/CD pipeline"
git push

git checkout -b add-identity-center

#--------------------#
# Retrieve account id 
#--------------------#
data "aws_caller_identity" "current" {}

locals {
    # Group definitions
    sso_groups = {
        Admin = {
            group_name        = "Admin"
            group_description = "Admin IAM Identity Center Group"
        },
        Developers = {
            group_name        = "Developers"
            group_description = "Dev IAM Identity Center Group"
        }
    }

    # User definitions
    sso_users = {
        marymajor = {
            group_membership = [local.sso_groups.Admin.group_name]
            user_name        = "marymajor"
            given_name       = "Mary"
            family_name      = "Major"
            email            = "marymajor@example.com"
        },
        johndoe = {
            group_membership = [local.sso_groups.Developers.group_name]
            user_name        = "johndoe"
            given_name       = "John"
            family_name      = "Doe"
            email            = "johndoe@example.com"
        }
    }

    # Permission sets definitions
    permission_sets = {
        AdministratorAccess = {
            description          = "Provides AWS full access permissions."
            session_duration     = "PT4H"
            aws_managed_policies = ["arn:aws:iam::aws:policy/AdministratorAccess"]
            tags                 = { ManagedBy = "Terraform" }
        },
        ViewOnlyAccess = {
            description          = "Provides AWS view only permissions."
            session_duration     = "PT3H"
            aws_managed_policies = ["arn:aws:iam::aws:policy/job-function/ViewOnlyAccess"]
            tags                 = { ManagedBy = "Terraform" }
        }
    }

    # Account assignments
    account_assignments = {
        Admin = {
            principal_name  = local.sso_groups.Admin.group_name
            principal_type  = "GROUP"
            principal_idp   = "INTERNAL"
            permission_sets = ["AdministratorAccess"]
            account_ids     = [data.aws_caller_identity.current.account_id]
        },
        Developers = {
            principal_name  = local.sso_groups.Developers.group_name
            principal_type  = "GROUP"
            principal_idp   = "INTERNAL"
            permission_sets = ["ViewOnlyAccess"]
            account_ids     = [data.aws_caller_identity.current.account_id]
        }
    }
}

module "aws-iam-identity-center" {
    source = "aws-ia/iam-identity-center/aws"

    # Use local variables for groups, users, permission sets, and account assignments
    sso_groups          = local.sso_groups
    sso_users           = local.sso_users
    permission_sets     = local.permission_sets
    account_assignments = local.account_assignments
}

git add .
git commit -m "Adding Identity Center"
git push --set-upstream origin add-identity-center

git clone git@github.com/<org|github uername>/<repo name>

terraform init

git checkout -b add-cloudtrail-budget-alert

module "bootstrap_cloudtrail" {
    source = "github.com/build-on-aws/terraform-samples//modules/bootstrap-cloudtrail"

    aws_region             = "us-west-2"
    cloudtrail_bucket_name = "name for your S3 bucket to store the trails"
    cloudtrail_name        = "friendly name for the trail"
}

module "budget_billing_alert" {
    source = "github.com/build-on-aws/terraform-samples//modules/aws-billing-budget-notification"

    budget_email_address = "your-email-address@example.com"

    # budget_alert_amount               = 10
    # budget_alert_currency             = "USD"
    # budget_alert_threshold_percentage = 75
}

terraform init
terraform plan

git add .
git commit -m "Adding CloudTrail and a Budget + Billing Alert"
git push --set-upstream origin add-cloudtrail-budget-alert