# DBaaS Infra

Infrastructure for DBaaS. DBaaS is our managed cloud offering.

## Organization

- `deploy/bastion`: the code of our bastion machines
- `deploy/eks`: the code of installing EKS clusters
- `deploy/gke`: the code of installing GKE clusters
- `deploy/logging`: the code of installing the logging stack
- `deploy/monitoring`: the code of installing the monitoring stack
- `deploy/iam`: the code of creating IAM resources

## Before You Start

It is mandatory to install and configure [git-secrets](https://github.com/awslabs/git-secrets), before you start checking out and working on this repository. It helps prevent committing passwords and any other sensitive information to git repositories.

### Install git-secrets
Refer to [here](https://github.com/awslabs/git-secrets/blob/master/README.rst#installing-git-secrets) to install git-secrets.

### Configure git-secrets

- Add the common AWS prohibited patterns to all repositories:
```
git secrets --register-aws --global
```
- Add a configuration template to add hooks to all repositories:
```
git secrets --install ~/.git-templates/git-secrets
git config --global init.templateDir ~/.git-templates/git-secrets
```
- Check your <code>~/.gitconfig</code>, and you should have seen <code>secrets</code> and <code>init</code> sections were added like below:
```
...
[secrets]
	providers = git secrets --aws-provider
	patterns = (A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}
	patterns = (\"|')?(AWS|aws|Aws)?_?(SECRET|secret|Secret)?_?(ACCESS|access|Access)?_?(KEY|key|Key)(\"|')?\\s*(:|=>|=)\\s*(\"|')?[A-Za-z0-9/\\+=]{40}(\"|')?
	patterns = (\"|')?(AWS|aws|Aws)?_?(ACCOUNT|account|Account)_?(ID|id|Id)?(\"|')?\\s*(:|=>|=)\\s*(\"|')?[0-9]{4}\\-?[0-9]{4}\\-?[0-9]{4}(\"|')?
	allowed = AKIAIOSFODNN7EXAMPLE
	allowed = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
[init]
	templateDir = /<home>/.git-templates/git-secrets
	templateDir = /<home>/.git-templates/git-secrets
```
- Add a new prohibited pattern, for example, we need to prevent committing GCP service account keys, which contain 'PRIVATE KEY' in the key content:
```
git secrets --add 'PRIVATE KEY'
```
Or we can insert a new line into the <code>~/.gitconfig</code> file:
```
patterns = PRIVATE KEY
```
Note: The patterns are regex expressions essentially, you can add more patterns as matched with your sensitive information.

- You can also mark the pattern as allowed to filter the false positives:
```
git secrets --add -a 'allowed pattern'
```

## Get Started

Checkout the [DBaaS operation handbook](./docs/README.md) to get started.