# Bootstrap

CICD pipeline relies on the identity (say, `cicdSA`) provided by GCP compute instance metadata to access both GCP and AWS Cloud APIs. It is
interesting to note that the permissions of the `cicdSA` principal itself are also managed by CICD. Apparently, this principal cannot grant
permissions to itself without the "grant" permission at the first place. So, manual bootstrapping is required when deploying cicd stack to a
new environment.

## GCP Bootstrap

The idea is that, this stack should be executed with a high-privileged principal during bootstrap to grant the required permissions (`iam.*`)
to `cicdSA`. Then the pipeline can manage itself's permissions via the `iam.*` permission afterwards. 

After bootstrapping, the high-privileged principal can be deleted.

**NOTE 1**: since `cicdSA` has to access multiple GCP projects, the high-privileged principal must have the `iam.*` permissions in all these projects, otherwise the bootstrap will fail

**NOTE 2**: for the same reason, DO NOT remove `iam.*` permissions of `cicdSA` in this module

## AWS Bootstrap

`cicdSA` leverages [identity federation](https://aws.amazon.com/cn/identity/federation/) to access AWS with a GCP principal. To grant permission to a GCP SA on AWS, apply this module with empty `aws-accounts` first, get the `serviceAccountUID` output, and create the 
following `Role` and `RolePolicy` for each AWS account CICD has to access to:

Role:
```
{
    "Version": "2012-10-17",
    "Statement": [{
      "Action": "sts:AssumeRoleWithWebIdentity",
      "Principal": {
        "Federated": "accounts.google.com"
      },
      "Effect": "Allow",
      "Condition": {
        "StringEquals": {
          "accounts.google.com:aud": "${serviceAccountUID}"
        }
      }
    }]
}
```

RolePolicy:
```
{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Action": ["iam:*"],
        "Resource": ["*"]
      },
    ]
}
```

Set `aws-accounts` to the desired accounts and set `aws-role-name` to the role name that you just created. Done.

**Note 1**: the role in different aws accounts must have the same name.

**Note 2**: the role **MUST BE** retained after bootstrap, the manually created role policy can be deleted after bootstrapping since `cicdSA` has started to manage itself's role policy.