Creating a BigBang member account is only half the job. Once the account exists, something has to deploy applications into it without handing out account-wide admin rights. This Terraform module owns the IAM side of every BigBang-generated account: it is meant to be the single place where all identity and access for those accounts is defined. Today it provisions one thing well, the deployer role used to ship containerized apps to ECS, and it is built to grow into the home for any future IAM needs of BigBang accounts.
Repositories
002 – Shared network account
The Shared Network account is owned by the Cloud Team and exists to do one thing well: provide shared connectivity that the rest of the ARGLabs organization can consume. Instead of every account building and maintaining its own network, this account builds the baseline once and shares it through AWS Resource Access Manager (RAM).
001 – Main account first pipeline
The Main Account is the root of the ARGLabs AWS Organization, but it is intentionally minimal. It does not run any workloads. Its only job is to host the pieces that have to live at the very top of the tree: the organization structure, the identity provider for everyone who logs into AWS, and the company’s main domain.
000 – Main account pre-requisites
We aim to do everything as code in ARGLabs, but at the very first moment we cannot even run pipelines. There is no IAM role for Bitbucket to assume, no S3 bucket to store Terraform state, and no policies to authorize anything. This project breaks that chicken-and-egg cycle by provisioning the foundational pieces every other ARGLabs project depends on.
ARGLabs 