DOCSEARCHbyAlgolia
Submit Docs

BareMetal Tutorials

website·Indexed 30 days ago

https://baremetal.help

Tutorials and guides for setting up computers without pre-installed software, with a focus on AWS infrastructure. Includes documentation on AWS account setup, AWS Organization, AWS Single Sign-On (SSO) integration with Azure AD, Content Delivery Networks (CDN), and enterprise landing zone configuration.

Tokens
6.4K
Snippets
17
Records
52
Agent score
50%

What's inside BareMetal

  1. Overview of BareMetal Tutorials and AWS CDK approach

    BareMetal Tutorials provide guides for building enterprise-grade cloud infrastructure on Amazon Web Services (AWS). The tutorials utilize Infrastructure-as-Code (IaC) via the AWS Cloud Development Kit (CDK) written in TypeScript. Each tutorial includes at least one CDK 'stack' that encapsulates a collection of related resources, allowing users to deploy infrastructure consistently without manual configuration of every detail.

  2. Deploy applications using AWS EC2

    Amazon EC2 (Elastic Compute Cloud) provides virtual machines in the cloud. It is a general-purpose service that allows developers to run any workload, including custom applications and self-managed databases, providing maximum control over the operating system and environment.

  3. Understand the architecture for Azure AD and AWS SSO integration

    When integrating Azure AD with AWS Single Sign-On (SSO), Azure AD serves as the primary Identity Provider. Users and groups are administered exclusively within the Azure AD console. Because AWS SSO is configured with a single external Identity Provider, the ability to manage users and groups directly from the AWS Console is disabled.

  4. Build a documentation site with Docusaurus and Markdown

    The BareMetal documentation site is built using Docusaurus, which utilizes Markdown for content. The site uses default Docusaurus styles. Visual Studio Code is recommended as an editor for its Markdown support.

  5. Use BareMetal infrastructure-as-code stacks

    BareMetal provides infrastructure-as-code stacks designed for enterprise-grade AWS accounts. These stacks use a common configuration to ensure consistency and compatibility across your environment. This approach allows you to:

    • Pick and choose specific components to deploy.
    • Update all stacks simultaneously by changing common configuration values and redeploying.
    • Follow a modular path where dependencies between different tutorials are explicitly marked.

  6. CDN Architecture and Assumptions

    The BareMetal CDN is implemented as a read-through cache where an S3 bucket serves as the origin and global edge locations serve the content to users to reduce latency.

    Key Assumptions:

    • Custom Domain: A registered domain is required for the stack to function as intended. Without one, you cannot automate SSL validation or have a persistent URL.
    • Registrar: Using AWS Route53 as the registrar allows the CDK stack to automatically add necessary DNS records.
    • Content: You must have assets (images, CSS, etc.) to upload to the origin S3 bucket.

  7. Prerequisites for AWS SSO and Azure AD Integration

    To integrate AWS SSO with Azure AD, the following requirements must be met:

    1. An active Azure account.
    2. An Azure AD tenant with sufficient permissions to configure it.
    3. An Azure P2 trial license.

  8. Configure automatic provisioning between AD and AWS SSO

    Automatic provisioning uses the SCIM protocol to synchronize identities. This requires a Tenant URL and a Secret Token generated from the AWS SSO console.

    Configuration Steps:

    1. In the AWS Single Sign-on Enterprise Application, go to Provisioning and click Get started.
    2. Select Automatic as the provisioning mode.
    3. In the AWS SSO Console, click Enable next to Automatic Provisioning to generate the credentials.
    4. Copy the SCIM endpoint from AWS and paste it into the Tenant URL field in the AD Provisioning console.
    5. Copy the Access token from AWS and paste it into the Secret Token field in the AD Provisioning console.
    6. Click Test Connection to verify the link, then click Save.
    7. Click Start provisioning to begin the synchronization process.

  9. Manage AWS costs and billing budgets

    To prevent unexpected charges (sticker shock) and monitor usage, use the 'Billing and Cost Management' console. Recommended actions include: 1. Using the AWS Pricing Calculator to estimate costs based on usage patterns. 2. Creating budgets and alarms via AWS Budgets to receive notifications when spending exceeds defined thresholds. 3. Setting up CloudWatch billing alarms to monitor estimated charges.

  10. Secure the AWS root user account

    The root user is the primary account owner and should not be used for daily tasks or command-line tools. To secure the root account: 1. Log in using the email and password used during registration. 2. Navigate to 'Security credentials' in the top-right menu. 3. Click 'Assign MFA device' and follow the prompts to enable Multi-Factor Authentication (MFA). 4. Verify the setup by signing out and logging back in to ensure the MFA prompt appears.

  11. Secure the `baremetal` IAM user with MFA

    After creating the baremetal user, secure the account by enabling Multi-Factor Authentication (MFA):

    1. Log in to the AWS Console as the baremetal user using the provided credentials.
    2. Change the temporary password upon first login.
    3. Navigate to the IAM service console.
    4. In the "Add MFA for yourself" section, click Add MFA.
    5. Best Practice: Add multiple MFA methods (up to five) to prevent lockout. Biometrics are preferred over hardware or software tokens for a balance of security and convenience.

  12. Manually create groups and assign users in Azure AD

    After creating users, you can manually create AD Groups to organize them for permission assignment in AWS SSO. In the Azure AD console, navigate to the groups section, click Create, and manually add the desired users to the group members list.