In the last section, you learned about connecting to your servers using SSH and VPN. In this section,
you'll learn about connecting to your AWS accounts:
Each of your environments (e.g., stage, prod) is in a separate AWS account. This gives you more fine grained control
over who can access what and improves isolation and security, as a mistake or breach in one account is unlikely to
affect the others. The accounts are:
dev: 087285199408
master: 087285199408
prod: 087285199408
security: 087285199408
shared-services: 087285199408
stage: 087285199408
Note that all IAM users are deployed in a single account called "Security." The idea is that you log into the Security
account and, if you need to do something in one of the other accounts, you "switch" to it by assuming an IAM Role in
that account (if you've been granted the necessary permissions).
If you are logged in as an IAM user in account A and you want to switch to account B, you need the following:
Account B must have an IAM role that explicitly allows your IAM user in account A (or all IAM users in account A)
to assume that IAM role. We have already set this up in all accounts using the cross-account-iam-roles
module.
Your IAM user in account A must have the proper IAM permissions to assume roles in account B. We have created IAM
groups with these permissions using the iam-groups
module. Typically, these IAM groups
using the naming convention _account.xxx, where xxx is the name of an account you can switch to (e.g.
_account.stage, _account.prod). There is also an _account.all group that allows you to switch to all other
accounts. Make sure your IAM user is in the appropriate group.
Once you take care of the two prerequisites above, you will need two pieces of information to switch to another
account:
The ID of the account you wish to switch to. You should get this from whoever administers your AWS accounts.
such as allow-read-only-access-from-other-accounts or allow-full-access-from-other-accounts.
With these two pieces of data, you should be able to switch accounts in the AWS console or with AWS CLI tools as
explained in the following two sections.
Terragrunt has the ability to assume an IAM role before running
Terraform. That means you can authenticate to any account by:
Authenticate to your Security account (the one where the IAM users are defined) using the normal process, such
as setting the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables for that account.
Call Terragrunt with the --terragrunt-iam-role argument or set the TERRAGRUNT_IAM_ROLE environment variable.
For example, to assume the allow-full-access-from-other-accounts role in account 1111111111111:
export TERRAGRUNT_IAM_ROLE=arn:aws:iam::1111111111111:role/allow-full-access-from-other-accounts.
Now you can use all your normal Terragrunt commands: e.g., terragrunt plan.
If you want to assume an IAM role in another account for some other AWS CLI tool, the easiest way to do it is with
the aws-auth script, which can
reduce the authentication process to a one-liner. This tool is also useful for authenticating in the CLI when MFA
is enabled.
Authenticating
Some best practices around authenticating to your AWS account:
Always enable multi-factor authentication (MFA) for your AWS account. That is, in addition to a password, you must
provide a second factor to prove your identity. The best option for AWS is to install Google
Authenticator on your phone and use it to generate a one-time
token as your second factor.
Use a password manager
Never store secrets in plain text. Store your secrets using a secure password manager, such as
pass, OS X Keychain, or
KeePass. You can also use cloud-based password managers, such as
1Password or LastPass, but be aware that since they have
everyone's passwords, they are inherently much more tempting targets for attackers. That said, any reasonable password
manager is better than none at all!
Don't use the root user
AWS uses the Identity and Access Management (IAM) service to manage users and their
permissions. When you first sign up for an AWS account, you are logged in as the root user. This user has permissions
to do everything in the account, so if you compromise these credentials, you’re in deep trouble.
Therefore, right after signing up, you should:
Enable MFA on your root account. Note: we strongly recommend making a copy of the MFA secret key. This way, if you
lose your MFA device (e.g. your iPhone), you don’t lose access to your AWS account. To make the backup, when
activating MFA, AWS will show you a QR code. Click the "show secret key for manual configuration" link and save that
key to a secure password manager.
Make sure you use a very long and secure password. Never share that password with anyone. If you need to store it
(as opposed to memorizing it), only store it in a secure password manager.
Use the root account to create a separate IAM user for yourself and your team members with more limited IAM
permissions. You should manage permissions using IAM groups. See the iam-groups
module for details.
Use IAM roles when you need to give limited permissions to tools (for eg, CI servers or EC2 instances).
Require all IAM users in your account to use MFA.
Never use the root IAM account again.
Kubernetes RBAC Roles and Helm Authentication
Up to this point we focused on accounts and authentication in AWS. However, with EKS, Kubernetes adds another layer of
accounts and authentication that are tied to, but not exactly the same as, AWS IAM.
In this section, you'll learn about Kubernetes RBAC roles and Helm authentication:
Role Based Access Control (RBAC) is a method to regulate
access to resources based on the role that individual users assume in an organization. Kubernetes allows you to define
roles in the system that individual users inherit, and explicitly grant permissions to resources within the system to
those roles. The Control Plane will then honor those permissions when accessing the resources on Kubernetes through
clients such as kubectl. When combined with namespaces, you can implement sophisticated control schemes that limit the
access of resources across the roles in your organization.
The RBAC system is managed using ClusterRole and ClusterRoleBinding resources (or Role and RoleBinding resources
if restricting to a single namespace). The ClusterRole (or Role) object defines a role in the Kubernetes system that
has explicit permissions on what it can and cannot do. These roles are then bound to users and groups using the
ClusterRoleBinding (or RoleBinding) resource. An important thing to note here is that you do not explicitly create
users and groups using RBAC, and instead rely on the authentication system to implicitly create these entities.
EKS manages authentication to Kubernetes based on AWS IAM roles and users. This is done by embedding AWS IAM credentials
(the access key and secret key) into the authentication token used to authenticate to the Kubernetes API. The API server
then forwards this to AWS to validate it, and then reconciles the role / user into an RBAC user and group that is then
used to reconcile authorization rules for the API.
By default all IAM roles and users (except for the role / user that deployed the cluster) has no RBAC user or groups
associated with it. This automatically translates the role / user into an anonymous user on the cluster, who by default
has no permissions. In order to allow access to the cluster, you need to explicitly bind the IAM role / user to an RBAC
entity, and then bind Roles or ClusterRoles that explicitly grants permissions to perform actions on the cluster.
This mapping is handled by the eks-k8s-role-mapping
module, used under the hood
in the eks-cluster infrastructure module.
You can read more about the relationship between IAM roles and RBAC roles in EKS in the official
documentation.
Namespaces and RBAC
Namespaces are Kubernetes resources
that creates virtual partition boundaries in your cluster. The resources in each Namespace are isolated from other
Namespaces, and can only interact with them through Service endpoints, unless explicit permissions are granted. This
allows you to divide the cluster between multiple users in a way that prevents them from seeing each others' resources,
allowing you to share clusters while protecting sensitive information.
RBAC is critical in achieving isolation of Namespaces. The RBAC permissions can be restricted by Namespace. This
allows you to bind permissions to entities such that they can only perform certain actions on resources within a
particular Namespace.
Every EKS cluster comes with two default Namespaces:
kube-system: This Namespace holds admin and cluster level resources. Only cluster administrators ("superusers")
should have access to this Namespace.
default: This is the default Namespace that is used for API calls that don't specify a particular Namespace.
This should primarily be used for development and experimentation purposes.
Additionally, in the Reference Architecture, we create another Namespace: applications. This Namespace is used to
house the deployed sample applications and its associated resources.
Most Kubernetes tools will let you set the Namespace as CLI args. For example, kubectl supports a -n parameter for
specifying which Namespace you intend to run the command against. kubectl additionally supports overriding the
default Namespace for your commands by binding a Namespace to your authentication context.
Accessing the cluster
As mentioned in Relation to IAM Roles, EKS proxies Kubernetes authentication through AWS IAM
credentials. This means that you need to be authenticated to AWS first in order to authenticate to Kubernetes. Refer to
the previous section on AWS authentication for information on how to authenticate to AWS.
There are three main ways to interact with Kubernetes in the Reference Architecture:
When deploying Kubernetes resources using Terragrunt / Terraform, all the authentication is handled inside of Terraform
using a combination of EKS data sources and provider logic. What this means is that you don't have to worry about
explicitly authenticating to Kubernetes when going through Terraform, as long as you are authenticating to an IAM role
that has a valid mapping to an RBAC entity in the cluster.
The one exception to this is the modules that depend on helm, which requires additional configuration. See the
section on helm for more info.
Kubectl
Most manual operations in Kubernetes are handled through the kubectl command line
utility. kubectl requires an explicit authentication
configuration to access the cluster.
You can use kubergrunt to configure your local kubectl client to authenticate against a deployed EKS cluster. After
authenticating to AWS, run:
This will add a new entry to your kubectl config file (defaults to $HOME/.kube/config) with the logic for
authenticating to EKS, registering it under the context name $EKS_CLUSTER_ARN. You can modify the name of the context
using the --kubectl-context-name CLI arg.
You can verify the setup by running:
kubectl cluster-info
This will report information about the Kubernetes endpoints for the cluster only if you are authorized to access to the
cluster. Note that you will need to be authenticated to AWS for kubectl to successfully authenticate to the cluster.
If you have multiple clusters, you can switch the kubectl context using the use command. For example, to switch the
current context to the dev EKS cluster from the prod cluster and back:
kubectl use arn:aws:eks:us-east-1:$DEV_ACCOUNT_ID:cluster/eks-dev
kubectl cluster-info # Should target the dev EKS cluster
kubectl use arn:aws:eks:us-east-1:$PROD_ACCOUNT_ID:cluster/eks-prod
kubectl cluster-info # Should target the prod EKS cluster
Helm
Helm relies on TLS based authentication and authorization to access Tiller (the Helm Server). This is separate from the
RBAC based authorization native to Kubernetes. Intuitively, RBAC is used to manage whether or not someone can lookup the
Pod endpoint address, while the TLS authentication and authorization scheme manages whether or not you can establish a
connection to the Tiller server. All deployments of Tiller in the Reference Architecture uses kubergrunt to manage the
TLS certificates.
We highly recommend reading Gruntwork's guide to
helm to understand the security model surrounding
Helm and Tiller.
kubergrunt manages the TLS certificates using Kubernetes Secrets, guarded by RBAC roles. A cluster administrator can
grant access to any RBAC entity to any Tiller deployment using the kubergrunt helm grant command. For example, to
grant access to a Tiller server deployed in the namespace applications-tiller to the RBAC user
allow-full-access-from-other-accounts:
kubergrunt helm grant \
--tls-common-name allow-full-access-from-other-accounts \
--tls-org Acme Multi Account \
--tiller-namespace applications \
--rbac-user allow-full-access-from-other-accounts
Note on RBAC users: The RBAC user username (--rbac-user) corresponds to the IAM Role or User name of the
authenticating AWS credentials.
This generates new TLS certificate key pairs that grant access to the Tiller deployed in the applications-tiller
Namespace. In addition, this creates and binds RBAC roles that allow users of the RBAC group developers to be able to
read the necessary Secrets to download the generated TLS certificate key pairs.
Now anyone who maps to the developers RBAC group can use the kubergrunt helm configure command to setup their
helm client to access the deployed Tiller:
Download the client TLS certificate key pair generated with the grant command.
Install the TLS certificate key pair in the helm home directory (defaults to $HOME/.helm).
Install an environment file that sets up environment variables to target the specific helm server (defaults to
$HELM_HOME/env). This environment file needs to be loaded before issuing any commands, at it sets the necessary
environment variables to signal to the helm client which helm server to use. The environment variables it sets are:
HELM_HOME: The helm client home directory where the TLS certs are located.
TILLER_NAMESPACE: The namespace where the helm server is installed.
HELM_TLS_VERIFY: This will be set to true to enable TLS verification.
HELM_TLS_ENABLE: This will be set to true to enable TLS authentication.
Once this is setup, Terraform modules that need to access helm will be able to use the downloaded credentials to
authenticate to Tiller. Additionally, once you source the environment file, you will be able to use the helm client to
directly work with Tiller.
If you have the helm client installed, you can verify your configuration setup using the helm version command:
helm version
If your helm client is configured correctly, the version command will output information about the deployed Tiller
instance that it connected to.
Next steps
Now that you know how to authenticate, you may want to take a look through this list of Gruntwork
Tools.
Questions? Ask away.
We're here to talk about our services, answer any questions, give advice, or just to chat.
{"treedata":{"name":"root","toggled":true,"children":[{"name":".gitignore","path":".gitignore","sha":"1c27fc6013cba46cd301a7c8bf951694670153a3"},{"name":"CODEOWNERS","path":"CODEOWNERS","sha":"6bddb3ff6e1b3dfaba7cf180e56bca12c245be56"},{"name":"README.md","path":"README.md","sha":"45d75f99aefaa9a2d008b223da04bc26453ef651"},{"name":"_docs","children":[{"name":"01-architecture-overview.md","path":"_docs/01-architecture-overview.md","sha":"115a05d08f3a431a19e5aa2596c079619ae66dab"},{"name":"02-whats-deployed.md","path":"_docs/02-whats-deployed.md","sha":"9dc8a401caf24896ce00a8087bfe32c7af99d2d2"},{"name":"03-security-compliance-compatibility.md","path":"_docs/03-security-compliance-compatibility.md","sha":"9342617f42adb28e440cc2161f3fee56205c150e"},{"name":"04-how-code-is-organized.md","path":"_docs/04-how-code-is-organized.md","sha":"3b340de506525633e1f7333a1e9ac9a5565a88e3"},{"name":"05-dev-environment.md","path":"_docs/05-dev-environment.md","sha":"c8b494aed802b623f7891047b6cba633d8ab5fa7"},{"name":"06-ci-cd.md","path":"_docs/06-ci-cd.md","sha":"b6c2a7d7cde7471fb08bff5dcf68c40156db68d5"},{"name":"07-monitoring-alerting-logging.md","path":"_docs/07-monitoring-alerting-logging.md","sha":"619c810c6e60418b3a46fa3d903bc76dc6d48e41"},{"name":"08-ssh-vpn.md","path":"_docs/08-ssh-vpn.md","sha":"9fe83afbd3d6116a4f3faff8923a81cd37ff91c7"},{"name":"09-accounts-and-auth.md","path":"_docs/09-accounts-and-auth.md","sha":"6b0472241644ffc79556e60d582ff1edb80f0554","toggled":true},{"name":"10-gruntwork-tools.md","path":"_docs/10-gruntwork-tools.md","sha":"d08b1fe7cfbb9ad91155bfff9e3a05525c39c127"},{"name":"11-deploying-a-docker-service.md","path":"_docs/11-deploying-a-docker-service.md","sha":"c735be4ee94e76cc55b48a21039dfec44e6a5d51"},{"name":"12-migration.md","path":"_docs/12-migration.md","sha":"464cadf6e05d5ffd44e569c0d866b5c2cf5f42e9"},{"name":"13-deploying-the-reference-architecture-from-scratch.md","path":"_docs/13-deploying-the-reference-architecture-from-scratch.md","sha":"fa362071f460f7df7331645d6e5052e8cd20c30b"},{"name":"14-undeploying-the-reference-architecture.md","path":"_docs/14-undeploying-the-reference-architecture.md","sha":"c6dcaae7266ead56d539b1816a5cfe2988412fe1"},{"name":"15-adding-new-environments-regions-and-accounts.md","path":"_docs/15-adding-new-environments-regions-and-accounts.md","sha":"c01188a1539e93ed2773a1b799b3b0f8e7b2045e"},{"name":"README.md","path":"_docs/README.md","sha":"ddb9fe83eb2fcad91e82771ad276dd0bdba40cb2"},{"name":"_images","children":[{"name":"cw-logs-1.png","path":"_docs/_images/cw-logs-1.png","sha":"84c86f014751844fbd777b5139ed61f749b5ed32"},{"name":"cw-logs-2.png","path":"_docs/_images/cw-logs-2.png","sha":"9a0a80b20490fdc1b9014040cc0bbc87c9cf6f68"},{"name":"cw-logs-3.png","path":"_docs/_images/cw-logs-3.png","sha":"bda49dc4e947658e0ceb9ba592b4e314d9db61e9"},{"name":"cw-logs-4.png","path":"_docs/_images/cw-logs-4.png","sha":"54bcc44c4b0701620b7f20c4e6fc0a9fd8f38049"},{"name":"ecs-console-1.png","path":"_docs/_images/ecs-console-1.png","sha":"afe452278d5f107e6ec225a235c587de7cb53510"},{"name":"ecs-console-2.png","path":"_docs/_images/ecs-console-2.png","sha":"40609b98015d781b9e1de801c131fadc323337ae"},{"name":"ecs-console-3.png","path":"_docs/_images/ecs-console-3.png","sha":"87ad40d291b7e9e6f6caa0389b846392bdb93ee0"},{"name":"ref-arch-full.png","path":"_docs/_images/ref-arch-full.png","sha":"8c17eef52be06757553a1f3ee4e387e6dc820016"},{"name":"ref-arch-icon.png","path":"_docs/_images/ref-arch-icon.png","sha":"05876962e6877df911674237ca1b793d9f4f04b3"},{"name":"terraform-code-provenance.png","path":"_docs/_images/terraform-code-provenance.png","sha":"e2a9d6bfbd8b963b057d4341dd0ec93e3823d834"}]}],"toggled":true},{"name":"dev","children":[{"name":"_global","children":[{"name":"README.md","path":"dev/_global/README.md","sha":"d1b8a96c00211751f079fa13cac1b3417d29bf09"},{"name":"cloudtrail","children":[{"name":"README.md","path":"dev/_global/cloudtrail/README.md","sha":"65aac5742b3dc183d11a7d83a31ae69afe5df2e5"},{"name":"terragrunt.hcl","path":"dev/_global/cloudtrail/terragrunt.hcl","sha":"fb19b4438de2ba919d17f3e4a6ccb3c9f2517f26"}]},{"name":"iam-cross-account","children":[{"name":"README.md","path":"dev/_global/iam-cross-account/README.md","sha":"6bf06985be74cf68085a78728c41cf88fc354141"},{"name":"terragrunt.hcl","path":"dev/_global/iam-cross-account/terragrunt.hcl","sha":"96f6b058d3db5871b45cd9e9c05d2387f7fa8340"}]},{"name":"iam-user-password-policy","children":[{"name":"README.md","path":"dev/_global/iam-user-password-policy/README.md","sha":"d3240490ed6005924706f6dd8a1718747ebcd8d9"},{"name":"terragrunt.hcl","path":"dev/_global/iam-user-password-policy/terragrunt.hcl","sha":"47b669ba52099812a6d52ed4fcdad48c5e32e91e"}]},{"name":"region.yaml","path":"dev/_global/region.yaml","sha":"18b7823ed017b97431d58da7bcb9a4e31299272a"},{"name":"route53-public","children":[{"name":"README.md","path":"dev/_global/route53-public/README.md","sha":"69a24d1bb0eff2a66ca9be44c0dfc864f7086960"},{"name":"terragrunt.hcl","path":"dev/_global/route53-public/terragrunt.hcl","sha":"68ed9958a62546160f9007660857c5baa95ce12b"}]}]},{"name":"empty.yaml","path":"dev/empty.yaml","sha":"5aa66daa40faeaef37eccb7b4b0fcc792233cd7b"},{"name":"terragrunt.hcl","path":"dev/terragrunt.hcl","sha":"a63152bc683cf06815f93c001fc4e96d498db325"},{"name":"us-east-1","children":[{"name":"_global","children":[{"name":"README.md","path":"dev/us-east-1/_global/README.md","sha":"37b828b038945a50e2e571ef1e755c4f9170e7cf"},{"name":"kms-master-key","children":[{"name":"README.md","path":"dev/us-east-1/_global/kms-master-key/README.md","sha":"9f97f59f9d03bc3cef6ecb0e97af8ffdfd7c0334"},{"name":"terragrunt.hcl","path":"dev/us-east-1/_global/kms-master-key/terragrunt.hcl","sha":"d5c556e7eb743da62e0191243a2d4ee9ec2cf828"}]},{"name":"sns-topics","children":[{"name":"README.md","path":"dev/us-east-1/_global/sns-topics/README.md","sha":"7926797c3094f0e708bd761d297589bd94be873e"},{"name":"terragrunt.hcl","path":"dev/us-east-1/_global/sns-topics/terragrunt.hcl","sha":"225cf4b3fe49af57c85a1e25b7942c72cf9e6853"}]}]},{"name":"dev","children":[{"name":"README.md","path":"dev/us-east-1/dev/README.md","sha":"30eef7620895f3ad23174f5f2c8772ab7f8880a8"},{"name":"cloudwatch-dashboard","children":[{"name":"README.md","path":"dev/us-east-1/dev/cloudwatch-dashboard/README.md","sha":"01e60cd5e9f63892e09b1d7edfa7bea8fd7d0a3d"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/cloudwatch-dashboard/terragrunt.hcl","sha":"f3533abbe42145ab1b29f235701892621c9d63d3"}]},{"name":"data-stores","children":[{"name":"elk-single-cluster","children":[{"name":"README.md","path":"dev/us-east-1/dev/data-stores/elk-single-cluster/README.md","sha":"a90283b9240f67c38dd1bd77755a8162fa6f3999"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/data-stores/elk-single-cluster/terragrunt.hcl","sha":"97fc6b6c810137e559da50b3684a5f6383c77c72"}]},{"name":"kafka","children":[{"name":"README.md","path":"dev/us-east-1/dev/data-stores/kafka/README.md","sha":"72582bdb047da4f8820f45716977d5b962c17028"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/data-stores/kafka/terragrunt.hcl","sha":"1c40ceaf50ae178033dda665553598a3f7548cd1"}]},{"name":"mysql","children":[{"name":"README.md","path":"dev/us-east-1/dev/data-stores/mysql/README.md","sha":"625773572c620dcddf722d0d0d206576f57f4af7"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/data-stores/mysql/terragrunt.hcl","sha":"40313bc9ada285fe59d77067728f6cf208b04668"}]},{"name":"redis","children":[{"name":"README.md","path":"dev/us-east-1/dev/data-stores/redis/README.md","sha":"5d82990da39b55e6ac7b3bbb442d4209e62dba1f"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/data-stores/redis/terragrunt.hcl","sha":"bfa22ef95f443e06ccf0624c414d6f9f6bde5b88"}]},{"name":"zookeeper","children":[{"name":"README.md","path":"dev/us-east-1/dev/data-stores/zookeeper/README.md","sha":"87b4dda769ae63cffa851b6ccf2086b617bf989d"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/data-stores/zookeeper/terragrunt.hcl","sha":"76af3451b7a52fd7d59cd8744ff3836da3c1826d"}]}]},{"name":"env.yaml","path":"dev/us-east-1/dev/env.yaml","sha":"c38dd83256fc4206be3afc24972cd7f3b6712b19"},{"name":"lambda","children":[{"name":"long-running-scheduled","children":[{"name":"README.md","path":"dev/us-east-1/dev/lambda/long-running-scheduled/README.md","sha":"274c405a65d60c6a253ca2cf24863e1025402874"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/lambda/long-running-scheduled/terragrunt.hcl","sha":"72518b7089bd107c05c281372f3cccd6d7a6a628"}]},{"name":"s3-image-processing","children":[{"name":"README.md","path":"dev/us-east-1/dev/lambda/s3-image-processing/README.md","sha":"d7e48256e90edb0896769e4bd537c22e34c42f22"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/lambda/s3-image-processing/terragrunt.hcl","sha":"9be5024cab87f495dd8ac275b9807d086b971da5"}]}]},{"name":"networking","children":[{"name":"alb-internal","children":[{"name":"README.md","path":"dev/us-east-1/dev/networking/alb-internal/README.md","sha":"6d7b1a62e65dab5e908d2fd2ba291a98bc639a1d"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/networking/alb-internal/terragrunt.hcl","sha":"3226f2f8cc966d88abe6ffe7b1d912735a638b80"}]},{"name":"alb-public","children":[{"name":"README.md","path":"dev/us-east-1/dev/networking/alb-public/README.md","sha":"6d7b1a62e65dab5e908d2fd2ba291a98bc639a1d"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/networking/alb-public/terragrunt.hcl","sha":"039a02514db5e62d5ec21d3131579c821dcb6283"}]},{"name":"route53-private","children":[{"name":"README.md","path":"dev/us-east-1/dev/networking/route53-private/README.md","sha":"c93f222ed15cae75ec411a4b005ad4da32548c42"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/networking/route53-private/terragrunt.hcl","sha":"f7e7c4b437c11b0340c682314deb9b08aca3a854"}]}]},{"name":"services","children":[{"name":"ecs-cluster","children":[{"name":"README.md","path":"dev/us-east-1/dev/services/ecs-cluster/README.md","sha":"775dc4b2d530ce3ef27d0e9ad22e282a52bcffd3"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/services/ecs-cluster/terragrunt.hcl","sha":"64c60f67c5ce0a965a2e636015dcb9ff4e22344a"}]},{"name":"eks-cluster","children":[{"name":"README.md","path":"dev/us-east-1/dev/services/eks-cluster/README.md","sha":"8666da2d140182a504efdfedb45554623de0f642"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/services/eks-cluster/terragrunt.hcl","sha":"791a66ce8376fbec9a019d0cab0ac0ead3aac1ac"}]},{"name":"eks-core-services","children":[{"name":"README.md","path":"dev/us-east-1/dev/services/eks-core-services/README.md","sha":"4c2ea353f337fa34827a56b6a2230f6c8c690deb"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/services/eks-core-services/terragrunt.hcl","sha":"b9a002b3992e384e57015587693b3e7fe8eddc48"}]},{"name":"k8s-applications-namespace","children":[{"name":"README.md","path":"dev/us-east-1/dev/services/k8s-applications-namespace/README.md","sha":"4475bc76ebcba0b26acff53ccaf827375d74bf7c"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/services/k8s-applications-namespace/terragrunt.hcl","sha":"dd0fbec59f588fe88fc6c7f59382c0ab6d20ff9c"}]},{"name":"k8s-sample-app-backend-multi-account-acme","children":[{"name":"README.md","path":"dev/us-east-1/dev/services/k8s-sample-app-backend-multi-account-acme/README.md","sha":"62e7efec668cc4effc669c4070dcb968fa0bdc1d"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/services/k8s-sample-app-backend-multi-account-acme/terragrunt.hcl","sha":"953bef0317447c080e801343e586b0d1b3cbfbfa"}]},{"name":"k8s-sample-app-frontend-multi-account-acme","children":[{"name":"README.md","path":"dev/us-east-1/dev/services/k8s-sample-app-frontend-multi-account-acme/README.md","sha":"63c1026d7c1e936b30a82f90fae754cde0cc6897"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/services/k8s-sample-app-frontend-multi-account-acme/terragrunt.hcl","sha":"40060b5d96f21608eb30d259cef65289f6169a6f"}]},{"name":"sample-app-backend-multi-account-acme-asg","children":[{"name":"README.md","path":"dev/us-east-1/dev/services/sample-app-backend-multi-account-acme-asg/README.md","sha":"211044e0160f812cc6a5c984ea2dc71d769eece7"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/services/sample-app-backend-multi-account-acme-asg/terragrunt.hcl","sha":"cf84fcfa70c6d966803b70e29f549f3bd057f206"}]},{"name":"sample-app-backend-multi-account-acme","children":[{"name":"README.md","path":"dev/us-east-1/dev/services/sample-app-backend-multi-account-acme/README.md","sha":"caa8ba67485807d6d463fd7573aa8b9808f7e20b"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/services/sample-app-backend-multi-account-acme/terragrunt.hcl","sha":"c88b0d61edddbf9337c414cfae2d970735be2b6f"}]},{"name":"sample-app-beanstalk","children":[{"name":"README.md","path":"dev/us-east-1/dev/services/sample-app-beanstalk/README.md","sha":"2cd92b79c23a86d7759b8074de2158ab762ab01d"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/services/sample-app-beanstalk/terragrunt.hcl","sha":"77ac87dca4c64fbf5108231a6faf807fca3d1fee"}]},{"name":"sample-app-frontend-multi-account-acme-asg","children":[{"name":"README.md","path":"dev/us-east-1/dev/services/sample-app-frontend-multi-account-acme-asg/README.md","sha":"fcd0809e1c9a0a824ed30aca8746a383838b5745"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/services/sample-app-frontend-multi-account-acme-asg/terragrunt.hcl","sha":"17d10295d106fbde6b0de3bf6c5d3badc97c0ecd"}]},{"name":"sample-app-frontend-multi-account-acme","children":[{"name":"README.md","path":"dev/us-east-1/dev/services/sample-app-frontend-multi-account-acme/README.md","sha":"70cacba00f9ed9f2b11ef2615fd9d27ef24558e6"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/services/sample-app-frontend-multi-account-acme/terragrunt.hcl","sha":"c423cc7a2fe3630db7c75a72ef212ba186ab3739"}]},{"name":"static-website","children":[{"name":"README.md","path":"dev/us-east-1/dev/services/static-website/README.md","sha":"c39ed7c607eb4d1313ea3892768bad09e7f39fd9"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/services/static-website/terragrunt.hcl","sha":"3329db273624fe437ef031ee4e42583aa13c2312"}]}]},{"name":"vpc","children":[{"name":"README.md","path":"dev/us-east-1/dev/vpc/README.md","sha":"9f2704ce60e42e8f3a603a376abb15135183d887"},{"name":"terragrunt.hcl","path":"dev/us-east-1/dev/vpc/terragrunt.hcl","sha":"aea95690d1f2f5d37e6781f718f4b132c7f509b1"}]}]},{"name":"mgmt","children":[{"name":"README.md","path":"dev/us-east-1/mgmt/README.md","sha":"8a131a11632b97fec18a5e344d5c721fce24b652"},{"name":"env.yaml","path":"dev/us-east-1/mgmt/env.yaml","sha":"b514ab3187ebfb5bf467c632f27a21f5a9611bfc"},{"name":"openvpn-server","children":[{"name":"README.md","path":"dev/us-east-1/mgmt/openvpn-server/README.md","sha":"aa6f4262ab6e2e98c4cc2bb76e0f53953dbefc86"},{"name":"terragrunt.hcl","path":"dev/us-east-1/mgmt/openvpn-server/terragrunt.hcl","sha":"c9373ed801250a4a3f727b77bb7ef026738226ac"}]},{"name":"vpc","children":[{"name":"README.md","path":"dev/us-east-1/mgmt/vpc/README.md","sha":"758f74748caa3cabf6230c214784445e0c1f7c97"},{"name":"terragrunt.hcl","path":"dev/us-east-1/mgmt/vpc/terragrunt.hcl","sha":"20f97f225446751b79f2283837d0d9d225ea3833"}]}]},{"name":"region.yaml","path":"dev/us-east-1/region.yaml","sha":"d56afa3d82e6cea0d792e84748de56dafb0bad70"}]}]},{"name":"master","children":[{"name":"_global","children":[{"name":"README.md","path":"master/_global/README.md","sha":"d1b8a96c00211751f079fa13cac1b3417d29bf09"},{"name":"cloudtrail","children":[{"name":"README.md","path":"master/_global/cloudtrail/README.md","sha":"65aac5742b3dc183d11a7d83a31ae69afe5df2e5"},{"name":"terragrunt.hcl","path":"master/_global/cloudtrail/terragrunt.hcl","sha":"fb19b4438de2ba919d17f3e4a6ccb3c9f2517f26"}]},{"name":"iam-cross-account","children":[{"name":"README.md","path":"master/_global/iam-cross-account/README.md","sha":"6bf06985be74cf68085a78728c41cf88fc354141"},{"name":"terragrunt.hcl","path":"master/_global/iam-cross-account/terragrunt.hcl","sha":"0f540eaa0fa2fddb3c7afdead9cd4d4b71e77b11"}]},{"name":"iam-user-password-policy","children":[{"name":"README.md","path":"master/_global/iam-user-password-policy/README.md","sha":"d3240490ed6005924706f6dd8a1718747ebcd8d9"},{"name":"terragrunt.hcl","path":"master/_global/iam-user-password-policy/terragrunt.hcl","sha":"47b669ba52099812a6d52ed4fcdad48c5e32e91e"}]},{"name":"region.yaml","path":"master/_global/region.yaml","sha":"18b7823ed017b97431d58da7bcb9a4e31299272a"}]},{"name":"empty.yaml","path":"master/empty.yaml","sha":"5aa66daa40faeaef37eccb7b4b0fcc792233cd7b"},{"name":"terragrunt.hcl","path":"master/terragrunt.hcl","sha":"5d9ca2068ff75ac0532e01f3ec52b4051e419053"},{"name":"us-east-1","children":[{"name":"_global","children":[{"name":"README.md","path":"master/us-east-1/_global/README.md","sha":"37b828b038945a50e2e571ef1e755c4f9170e7cf"}]},{"name":"region.yaml","path":"master/us-east-1/region.yaml","sha":"d56afa3d82e6cea0d792e84748de56dafb0bad70"}]}]},{"name":"prod","children":[{"name":"_global","children":[{"name":"README.md","path":"prod/_global/README.md","sha":"d1b8a96c00211751f079fa13cac1b3417d29bf09"},{"name":"cloudtrail","children":[{"name":"README.md","path":"prod/_global/cloudtrail/README.md","sha":"65aac5742b3dc183d11a7d83a31ae69afe5df2e5"},{"name":"terragrunt.hcl","path":"prod/_global/cloudtrail/terragrunt.hcl","sha":"fb19b4438de2ba919d17f3e4a6ccb3c9f2517f26"}]},{"name":"iam-cross-account","children":[{"name":"README.md","path":"prod/_global/iam-cross-account/README.md","sha":"6bf06985be74cf68085a78728c41cf88fc354141"},{"name":"terragrunt.hcl","path":"prod/_global/iam-cross-account/terragrunt.hcl","sha":"96f6b058d3db5871b45cd9e9c05d2387f7fa8340"}]},{"name":"iam-user-password-policy","children":[{"name":"README.md","path":"prod/_global/iam-user-password-policy/README.md","sha":"d3240490ed6005924706f6dd8a1718747ebcd8d9"},{"name":"terragrunt.hcl","path":"prod/_global/iam-user-password-policy/terragrunt.hcl","sha":"47b669ba52099812a6d52ed4fcdad48c5e32e91e"}]},{"name":"region.yaml","path":"prod/_global/region.yaml","sha":"18b7823ed017b97431d58da7bcb9a4e31299272a"},{"name":"route53-public","children":[{"name":"README.md","path":"prod/_global/route53-public/README.md","sha":"69a24d1bb0eff2a66ca9be44c0dfc864f7086960"},{"name":"terragrunt.hcl","path":"prod/_global/route53-public/terragrunt.hcl","sha":"68ed9958a62546160f9007660857c5baa95ce12b"}]}]},{"name":"empty.yaml","path":"prod/empty.yaml","sha":"5aa66daa40faeaef37eccb7b4b0fcc792233cd7b"},{"name":"terragrunt.hcl","path":"prod/terragrunt.hcl","sha":"ba18847c5969b30159af5c87a05655d3e7dc7eb8"},{"name":"us-east-1","children":[{"name":"_global","children":[{"name":"README.md","path":"prod/us-east-1/_global/README.md","sha":"37b828b038945a50e2e571ef1e755c4f9170e7cf"},{"name":"kms-master-key","children":[{"name":"README.md","path":"prod/us-east-1/_global/kms-master-key/README.md","sha":"2de4ac69670b2bf16a3da13f4bff76b5b85891b7"},{"name":"terragrunt.hcl","path":"prod/us-east-1/_global/kms-master-key/terragrunt.hcl","sha":"5e19caaa42e506f2797048979d773f2fac5bce8a"}]},{"name":"sns-topics","children":[{"name":"README.md","path":"prod/us-east-1/_global/sns-topics/README.md","sha":"7926797c3094f0e708bd761d297589bd94be873e"},{"name":"terragrunt.hcl","path":"prod/us-east-1/_global/sns-topics/terragrunt.hcl","sha":"225cf4b3fe49af57c85a1e25b7942c72cf9e6853"}]}]},{"name":"mgmt","children":[{"name":"README.md","path":"prod/us-east-1/mgmt/README.md","sha":"8a131a11632b97fec18a5e344d5c721fce24b652"},{"name":"env.yaml","path":"prod/us-east-1/mgmt/env.yaml","sha":"b514ab3187ebfb5bf467c632f27a21f5a9611bfc"},{"name":"openvpn-server","children":[{"name":"README.md","path":"prod/us-east-1/mgmt/openvpn-server/README.md","sha":"271cbe2b6f59de9ce438ed4516393fd01d64b072"},{"name":"terragrunt.hcl","path":"prod/us-east-1/mgmt/openvpn-server/terragrunt.hcl","sha":"00af46905196d2216ca0e7d7e2767a86900514ea"}]},{"name":"vpc","children":[{"name":"README.md","path":"prod/us-east-1/mgmt/vpc/README.md","sha":"758f74748caa3cabf6230c214784445e0c1f7c97"},{"name":"terragrunt.hcl","path":"prod/us-east-1/mgmt/vpc/terragrunt.hcl","sha":"a3dbfb5bb3b55e6fcf452338c69e2fdab5aa6204"}]}]},{"name":"prod","children":[{"name":"README.md","path":"prod/us-east-1/prod/README.md","sha":"f15da18661ef3624d5f63deb288bad072e93df57"},{"name":"cloudwatch-dashboard","children":[{"name":"README.md","path":"prod/us-east-1/prod/cloudwatch-dashboard/README.md","sha":"01e60cd5e9f63892e09b1d7edfa7bea8fd7d0a3d"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/cloudwatch-dashboard/terragrunt.hcl","sha":"fe0a59a0885dd19898acfd6b65b290e5b6bf279c"}]},{"name":"data-stores","children":[{"name":"elk-multi-cluster","children":[{"name":"README.md","path":"prod/us-east-1/prod/data-stores/elk-multi-cluster/README.md","sha":"b59860709b8ef7bc7746c0bd9e9a1a21d02142c8"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/data-stores/elk-multi-cluster/terragrunt.hcl","sha":"ad3c96134476a81696c73807021c875283c3dfd1"}]},{"name":"kafka","children":[{"name":"README.md","path":"prod/us-east-1/prod/data-stores/kafka/README.md","sha":"72582bdb047da4f8820f45716977d5b962c17028"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/data-stores/kafka/terragrunt.hcl","sha":"c9e85c9678126c48a4cd6fc16cc55d523194b4d8"}]},{"name":"mysql","children":[{"name":"README.md","path":"prod/us-east-1/prod/data-stores/mysql/README.md","sha":"625773572c620dcddf722d0d0d206576f57f4af7"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/data-stores/mysql/terragrunt.hcl","sha":"e88eea81774f2ff43c6ba0f4929593b2adf80e20"}]},{"name":"redis","children":[{"name":"README.md","path":"prod/us-east-1/prod/data-stores/redis/README.md","sha":"5d82990da39b55e6ac7b3bbb442d4209e62dba1f"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/data-stores/redis/terragrunt.hcl","sha":"2ab5abad0edb89d10ffebb7c279a94b5e344bce6"}]},{"name":"zookeeper","children":[{"name":"README.md","path":"prod/us-east-1/prod/data-stores/zookeeper/README.md","sha":"87b4dda769ae63cffa851b6ccf2086b617bf989d"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/data-stores/zookeeper/terragrunt.hcl","sha":"e04f530614ac4913a702c2a18e38b4fa5a1f7848"}]}]},{"name":"env.yaml","path":"prod/us-east-1/prod/env.yaml","sha":"90e2d18e481b6e35ddc57391f752874ffc0058cf"},{"name":"lambda","children":[{"name":"long-running-scheduled","children":[{"name":"README.md","path":"prod/us-east-1/prod/lambda/long-running-scheduled/README.md","sha":"274c405a65d60c6a253ca2cf24863e1025402874"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/lambda/long-running-scheduled/terragrunt.hcl","sha":"72518b7089bd107c05c281372f3cccd6d7a6a628"}]},{"name":"s3-image-processing","children":[{"name":"README.md","path":"prod/us-east-1/prod/lambda/s3-image-processing/README.md","sha":"d7e48256e90edb0896769e4bd537c22e34c42f22"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/lambda/s3-image-processing/terragrunt.hcl","sha":"87d070e374ab2b7a6860167650e26c0fc73b486a"}]}]},{"name":"networking","children":[{"name":"alb-internal","children":[{"name":"README.md","path":"prod/us-east-1/prod/networking/alb-internal/README.md","sha":"21e850d1bbe25ca3b16114b8f58d08086a687916"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/networking/alb-internal/terragrunt.hcl","sha":"cc5feacf99eebd2cd695507d9169037599c763e5"}]},{"name":"alb-public","children":[{"name":"README.md","path":"prod/us-east-1/prod/networking/alb-public/README.md","sha":"21e850d1bbe25ca3b16114b8f58d08086a687916"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/networking/alb-public/terragrunt.hcl","sha":"03af1d8d3f8a860dc443addbf610f5934f7869eb"}]},{"name":"route53-private","children":[{"name":"README.md","path":"prod/us-east-1/prod/networking/route53-private/README.md","sha":"c93f222ed15cae75ec411a4b005ad4da32548c42"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/networking/route53-private/terragrunt.hcl","sha":"f7e7c4b437c11b0340c682314deb9b08aca3a854"}]}]},{"name":"services","children":[{"name":"ecs-cluster","children":[{"name":"README.md","path":"prod/us-east-1/prod/services/ecs-cluster/README.md","sha":"d9e015edbbcd8f9e200fb00a5dde7fc7f466cd3c"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/services/ecs-cluster/terragrunt.hcl","sha":"b0eef93fabce97dfe098d6e18677fd3b1839d009"}]},{"name":"eks-cluster","children":[{"name":"README.md","path":"prod/us-east-1/prod/services/eks-cluster/README.md","sha":"239bc9a333f256845a90c786c00cd6789000bd9d"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/services/eks-cluster/terragrunt.hcl","sha":"6cd702f65352efa6710f63842666cd214b9e4109"}]},{"name":"eks-core-services","children":[{"name":"README.md","path":"prod/us-east-1/prod/services/eks-core-services/README.md","sha":"66fbf40d9982d63707eb1e7c60d78bc4aa659a0b"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/services/eks-core-services/terragrunt.hcl","sha":"3ba3473cbb4c7cd83fb23f3fa18ca624bc9de5aa"}]},{"name":"k8s-applications-namespace","children":[{"name":"README.md","path":"prod/us-east-1/prod/services/k8s-applications-namespace/README.md","sha":"39887806598180d75b0b0b0a46ea4418d75af8f1"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/services/k8s-applications-namespace/terragrunt.hcl","sha":"c9d638ac7e6367e974db2dbdf2ffc8f17473fb91"}]},{"name":"k8s-sample-app-backend-multi-account-acme","children":[{"name":"README.md","path":"prod/us-east-1/prod/services/k8s-sample-app-backend-multi-account-acme/README.md","sha":"b7524c6453a2e3bf441c953de7236ab6273e2c0f"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/services/k8s-sample-app-backend-multi-account-acme/terragrunt.hcl","sha":"e8b8df48ed310a08be55d5d3d07af9dc20fe7c12"}]},{"name":"k8s-sample-app-frontend-multi-account-acme","children":[{"name":"README.md","path":"prod/us-east-1/prod/services/k8s-sample-app-frontend-multi-account-acme/README.md","sha":"17ee9c75e9fdea8d4295ad45f2fb8a46d9241e47"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/services/k8s-sample-app-frontend-multi-account-acme/terragrunt.hcl","sha":"cab54c75aa28d2d0a1df465e3e4272fc7a154adb"}]},{"name":"sample-app-backend-multi-account-acme-asg","children":[{"name":"README.md","path":"prod/us-east-1/prod/services/sample-app-backend-multi-account-acme-asg/README.md","sha":"b848e55fea0f16a9b7ccf9c1366c6b56c9966a7a"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/services/sample-app-backend-multi-account-acme-asg/terragrunt.hcl","sha":"3bc70a7302b813667b0d9b9a19d888ce7a53e711"}]},{"name":"sample-app-backend-multi-account-acme","children":[{"name":"README.md","path":"prod/us-east-1/prod/services/sample-app-backend-multi-account-acme/README.md","sha":"f0910e01d79209f26d65fdb1e6de428fa26f9eb6"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/services/sample-app-backend-multi-account-acme/terragrunt.hcl","sha":"f6f9ecf019df9635b4a68f42816d37f1ef4722c3"}]},{"name":"sample-app-beanstalk","children":[{"name":"README.md","path":"prod/us-east-1/prod/services/sample-app-beanstalk/README.md","sha":"a6f2e03ce14753bb39e48fbf350c4aeb3aa3e6c9"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/services/sample-app-beanstalk/terragrunt.hcl","sha":"aa974300d961214d4a76f729b87e3d6d1dc90107"}]},{"name":"sample-app-frontend-multi-account-acme-asg","children":[{"name":"README.md","path":"prod/us-east-1/prod/services/sample-app-frontend-multi-account-acme-asg/README.md","sha":"a5291ba90a48e7087a2fa7e24f41f1e4f4d43a79"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/services/sample-app-frontend-multi-account-acme-asg/terragrunt.hcl","sha":"c7cdbcf4cc8effe73a0130cf07a7f5da8cca0f23"}]},{"name":"sample-app-frontend-multi-account-acme","children":[{"name":"README.md","path":"prod/us-east-1/prod/services/sample-app-frontend-multi-account-acme/README.md","sha":"691ef675dbcdb807391b0e2b8547c9f260cc12c6"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/services/sample-app-frontend-multi-account-acme/terragrunt.hcl","sha":"f0137a766733b3575863a74230dfc92ec0c94cd0"}]},{"name":"static-website","children":[{"name":"README.md","path":"prod/us-east-1/prod/services/static-website/README.md","sha":"c39ed7c607eb4d1313ea3892768bad09e7f39fd9"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/services/static-website/terragrunt.hcl","sha":"d5879453a53db71287dad837ed32e7d9b59d120e"}]}]},{"name":"vpc","children":[{"name":"README.md","path":"prod/us-east-1/prod/vpc/README.md","sha":"934095e18b4fcdb217ba8a0192c2c65e6fafb989"},{"name":"terragrunt.hcl","path":"prod/us-east-1/prod/vpc/terragrunt.hcl","sha":"521968dd6fb563a01f26d8b4662fbf4624cd21a0"}]}]},{"name":"region.yaml","path":"prod/us-east-1/region.yaml","sha":"d56afa3d82e6cea0d792e84748de56dafb0bad70"}]}]},{"name":"security","children":[{"name":"_global","children":[{"name":"README.md","path":"security/_global/README.md","sha":"d1b8a96c00211751f079fa13cac1b3417d29bf09"},{"name":"cloudtrail","children":[{"name":"README.md","path":"security/_global/cloudtrail/README.md","sha":"65aac5742b3dc183d11a7d83a31ae69afe5df2e5"},{"name":"terragrunt.hcl","path":"security/_global/cloudtrail/terragrunt.hcl","sha":"880d875fa813a2ec594b9a8ef15eb431bf540fa4"}]},{"name":"iam-cross-account","children":[{"name":"README.md","path":"security/_global/iam-cross-account/README.md","sha":"6bf06985be74cf68085a78728c41cf88fc354141"},{"name":"terragrunt.hcl","path":"security/_global/iam-cross-account/terragrunt.hcl","sha":"fef1fc1992f71bf1e0707301a038457d70ec918c"}]},{"name":"iam-groups","children":[{"name":"README.md","path":"security/_global/iam-groups/README.md","sha":"93a0e35d82a328def8047539ce7d987ab062d292"},{"name":"terragrunt.hcl","path":"security/_global/iam-groups/terragrunt.hcl","sha":"d1398a63fe6180c591186343e390e4ca1ab45085"}]},{"name":"iam-user-password-policy","children":[{"name":"README.md","path":"security/_global/iam-user-password-policy/README.md","sha":"d3240490ed6005924706f6dd8a1718747ebcd8d9"},{"name":"terragrunt.hcl","path":"security/_global/iam-user-password-policy/terragrunt.hcl","sha":"47b669ba52099812a6d52ed4fcdad48c5e32e91e"}]},{"name":"region.yaml","path":"security/_global/region.yaml","sha":"18b7823ed017b97431d58da7bcb9a4e31299272a"}]},{"name":"empty.yaml","path":"security/empty.yaml","sha":"5aa66daa40faeaef37eccb7b4b0fcc792233cd7b"},{"name":"terragrunt.hcl","path":"security/terragrunt.hcl","sha":"6cb54cf9410ee6cec86c946669e5cbe8348e7e5b"}]},{"name":"shared-services","children":[{"name":"_global","children":[{"name":"README.md","path":"shared-services/_global/README.md","sha":"d1b8a96c00211751f079fa13cac1b3417d29bf09"},{"name":"cloudtrail","children":[{"name":"README.md","path":"shared-services/_global/cloudtrail/README.md","sha":"65aac5742b3dc183d11a7d83a31ae69afe5df2e5"},{"name":"terragrunt.hcl","path":"shared-services/_global/cloudtrail/terragrunt.hcl","sha":"fb19b4438de2ba919d17f3e4a6ccb3c9f2517f26"}]},{"name":"iam-cross-account","children":[{"name":"README.md","path":"shared-services/_global/iam-cross-account/README.md","sha":"6bf06985be74cf68085a78728c41cf88fc354141"},{"name":"terragrunt.hcl","path":"shared-services/_global/iam-cross-account/terragrunt.hcl","sha":"0f540eaa0fa2fddb3c7afdead9cd4d4b71e77b11"}]},{"name":"iam-user-password-policy","children":[{"name":"README.md","path":"shared-services/_global/iam-user-password-policy/README.md","sha":"d3240490ed6005924706f6dd8a1718747ebcd8d9"},{"name":"terragrunt.hcl","path":"shared-services/_global/iam-user-password-policy/terragrunt.hcl","sha":"47b669ba52099812a6d52ed4fcdad48c5e32e91e"}]},{"name":"region.yaml","path":"shared-services/_global/region.yaml","sha":"18b7823ed017b97431d58da7bcb9a4e31299272a"},{"name":"route53-public","children":[{"name":"README.md","path":"shared-services/_global/route53-public/README.md","sha":"69a24d1bb0eff2a66ca9be44c0dfc864f7086960"},{"name":"terragrunt.hcl","path":"shared-services/_global/route53-public/terragrunt.hcl","sha":"68ed9958a62546160f9007660857c5baa95ce12b"}]}]},{"name":"empty.yaml","path":"shared-services/empty.yaml","sha":"5aa66daa40faeaef37eccb7b4b0fcc792233cd7b"},{"name":"terragrunt.hcl","path":"shared-services/terragrunt.hcl","sha":"69470dec0813da115863dbffed34fe6f1ecc3c8e"},{"name":"us-east-1","children":[{"name":"_global","children":[{"name":"README.md","path":"shared-services/us-east-1/_global/README.md","sha":"37b828b038945a50e2e571ef1e755c4f9170e7cf"},{"name":"ecr-repos","children":[{"name":"README.md","path":"shared-services/us-east-1/_global/ecr-repos/README.md","sha":"050f270033456c0a3285056f41a4427ec4ca1db1"},{"name":"terragrunt.hcl","path":"shared-services/us-east-1/_global/ecr-repos/terragrunt.hcl","sha":"0aebd1fe76c536af522f7af783dae529637f5a2b"}]},{"name":"kms-master-key","children":[{"name":"README.md","path":"shared-services/us-east-1/_global/kms-master-key/README.md","sha":"8923e2581297b44e53b3a50b23505b7e0bf85f9e"},{"name":"terragrunt.hcl","path":"shared-services/us-east-1/_global/kms-master-key/terragrunt.hcl","sha":"e3d3456c830e33007018dfa0444e1bb20950e327"}]},{"name":"sns-topics","children":[{"name":"README.md","path":"shared-services/us-east-1/_global/sns-topics/README.md","sha":"7926797c3094f0e708bd761d297589bd94be873e"},{"name":"terragrunt.hcl","path":"shared-services/us-east-1/_global/sns-topics/terragrunt.hcl","sha":"225cf4b3fe49af57c85a1e25b7942c72cf9e6853"}]}]},{"name":"mgmt","children":[{"name":"README.md","path":"shared-services/us-east-1/mgmt/README.md","sha":"8a131a11632b97fec18a5e344d5c721fce24b652"},{"name":"env.yaml","path":"shared-services/us-east-1/mgmt/env.yaml","sha":"b514ab3187ebfb5bf467c632f27a21f5a9611bfc"},{"name":"jenkins","children":[{"name":"README.md","path":"shared-services/us-east-1/mgmt/jenkins/README.md","sha":"c67253232ed9a8a685ca1659c887ae60416f2998"},{"name":"terragrunt.hcl","path":"shared-services/us-east-1/mgmt/jenkins/terragrunt.hcl","sha":"f75d4c6b36c07a20f69863e69e41b2902658fd47"}]},{"name":"openvpn-server","children":[{"name":"README.md","path":"shared-services/us-east-1/mgmt/openvpn-server/README.md","sha":"523ded2b928a312657e689db78730315ad66633b"},{"name":"terragrunt.hcl","path":"shared-services/us-east-1/mgmt/openvpn-server/terragrunt.hcl","sha":"c4f4e0a9021527bf53fe18a62814ca30ce726649"}]},{"name":"vpc","children":[{"name":"README.md","path":"shared-services/us-east-1/mgmt/vpc/README.md","sha":"758f74748caa3cabf6230c214784445e0c1f7c97"},{"name":"terragrunt.hcl","path":"shared-services/us-east-1/mgmt/vpc/terragrunt.hcl","sha":"29ff68537a532e119786f868bb2a709839792e90"}]}]},{"name":"region.yaml","path":"shared-services/us-east-1/region.yaml","sha":"d56afa3d82e6cea0d792e84748de56dafb0bad70"}]}]},{"name":"stage","children":[{"name":"_global","children":[{"name":"README.md","path":"stage/_global/README.md","sha":"d1b8a96c00211751f079fa13cac1b3417d29bf09"},{"name":"cloudtrail","children":[{"name":"README.md","path":"stage/_global/cloudtrail/README.md","sha":"65aac5742b3dc183d11a7d83a31ae69afe5df2e5"},{"name":"terragrunt.hcl","path":"stage/_global/cloudtrail/terragrunt.hcl","sha":"fb19b4438de2ba919d17f3e4a6ccb3c9f2517f26"}]},{"name":"iam-cross-account","children":[{"name":"README.md","path":"stage/_global/iam-cross-account/README.md","sha":"6bf06985be74cf68085a78728c41cf88fc354141"},{"name":"terragrunt.hcl","path":"stage/_global/iam-cross-account/terragrunt.hcl","sha":"96f6b058d3db5871b45cd9e9c05d2387f7fa8340"}]},{"name":"iam-user-password-policy","children":[{"name":"README.md","path":"stage/_global/iam-user-password-policy/README.md","sha":"d3240490ed6005924706f6dd8a1718747ebcd8d9"},{"name":"terragrunt.hcl","path":"stage/_global/iam-user-password-policy/terragrunt.hcl","sha":"47b669ba52099812a6d52ed4fcdad48c5e32e91e"}]},{"name":"region.yaml","path":"stage/_global/region.yaml","sha":"18b7823ed017b97431d58da7bcb9a4e31299272a"},{"name":"route53-public","children":[{"name":"README.md","path":"stage/_global/route53-public/README.md","sha":"69a24d1bb0eff2a66ca9be44c0dfc864f7086960"},{"name":"terragrunt.hcl","path":"stage/_global/route53-public/terragrunt.hcl","sha":"68ed9958a62546160f9007660857c5baa95ce12b"}]}]},{"name":"empty.yaml","path":"stage/empty.yaml","sha":"5aa66daa40faeaef37eccb7b4b0fcc792233cd7b"},{"name":"terragrunt.hcl","path":"stage/terragrunt.hcl","sha":"e2506d916b6362dfc1aa0192b71f388a72e79568"},{"name":"us-east-1","children":[{"name":"_global","children":[{"name":"README.md","path":"stage/us-east-1/_global/README.md","sha":"37b828b038945a50e2e571ef1e755c4f9170e7cf"},{"name":"kms-master-key","children":[{"name":"README.md","path":"stage/us-east-1/_global/kms-master-key/README.md","sha":"2ce8a7cdc4864091ba55cc930ad4e6f8dc29d535"},{"name":"terragrunt.hcl","path":"stage/us-east-1/_global/kms-master-key/terragrunt.hcl","sha":"c0c2f65c3cf60fc59e6646347d4458001a116e6b"}]},{"name":"sns-topics","children":[{"name":"README.md","path":"stage/us-east-1/_global/sns-topics/README.md","sha":"7926797c3094f0e708bd761d297589bd94be873e"},{"name":"terragrunt.hcl","path":"stage/us-east-1/_global/sns-topics/terragrunt.hcl","sha":"225cf4b3fe49af57c85a1e25b7942c72cf9e6853"}]}]},{"name":"mgmt","children":[{"name":"README.md","path":"stage/us-east-1/mgmt/README.md","sha":"8a131a11632b97fec18a5e344d5c721fce24b652"},{"name":"env.yaml","path":"stage/us-east-1/mgmt/env.yaml","sha":"b514ab3187ebfb5bf467c632f27a21f5a9611bfc"},{"name":"openvpn-server","children":[{"name":"README.md","path":"stage/us-east-1/mgmt/openvpn-server/README.md","sha":"5dcede127b26b8cfc2ed78cd1450ec7dd7d66d18"},{"name":"terragrunt.hcl","path":"stage/us-east-1/mgmt/openvpn-server/terragrunt.hcl","sha":"af54f724d3ee040688035af9ae0f41154a7dbc1c"}]},{"name":"vpc","children":[{"name":"README.md","path":"stage/us-east-1/mgmt/vpc/README.md","sha":"758f74748caa3cabf6230c214784445e0c1f7c97"},{"name":"terragrunt.hcl","path":"stage/us-east-1/mgmt/vpc/terragrunt.hcl","sha":"b2016650621679f7b9f99b93806cc0b8efb149ac"}]}]},{"name":"region.yaml","path":"stage/us-east-1/region.yaml","sha":"d56afa3d82e6cea0d792e84748de56dafb0bad70"},{"name":"stage","children":[{"name":"README.md","path":"stage/us-east-1/stage/README.md","sha":"b24ba21bf01baf19ff84a2de457697a757d905c5"},{"name":"cloudwatch-dashboard","children":[{"name":"README.md","path":"stage/us-east-1/stage/cloudwatch-dashboard/README.md","sha":"01e60cd5e9f63892e09b1d7edfa7bea8fd7d0a3d"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/cloudwatch-dashboard/terragrunt.hcl","sha":"01ed95b4b404eda346293dbe5eb78b9a74f2f5bb"}]},{"name":"data-stores","children":[{"name":"elk-single-cluster","children":[{"name":"README.md","path":"stage/us-east-1/stage/data-stores/elk-single-cluster/README.md","sha":"a90283b9240f67c38dd1bd77755a8162fa6f3999"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/data-stores/elk-single-cluster/terragrunt.hcl","sha":"7818782091e335360279369b391a3401703ddedd"}]},{"name":"kafka","children":[{"name":"README.md","path":"stage/us-east-1/stage/data-stores/kafka/README.md","sha":"72582bdb047da4f8820f45716977d5b962c17028"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/data-stores/kafka/terragrunt.hcl","sha":"26d778dddca07ead27d37e481a897659d7cec7d2"}]},{"name":"mysql","children":[{"name":"README.md","path":"stage/us-east-1/stage/data-stores/mysql/README.md","sha":"625773572c620dcddf722d0d0d206576f57f4af7"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/data-stores/mysql/terragrunt.hcl","sha":"35991621a16fb4cc8443fdf2695c23d3e658c5ac"}]},{"name":"redis","children":[{"name":"README.md","path":"stage/us-east-1/stage/data-stores/redis/README.md","sha":"5d82990da39b55e6ac7b3bbb442d4209e62dba1f"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/data-stores/redis/terragrunt.hcl","sha":"79ef1e07fde2d0dcb9673d653089da8fb3fa449a"}]},{"name":"zookeeper","children":[{"name":"README.md","path":"stage/us-east-1/stage/data-stores/zookeeper/README.md","sha":"87b4dda769ae63cffa851b6ccf2086b617bf989d"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/data-stores/zookeeper/terragrunt.hcl","sha":"045e1d8802b8b1dc93070a80d98da5b917dec655"}]}]},{"name":"env.yaml","path":"stage/us-east-1/stage/env.yaml","sha":"5767506e27e978f52524dadbbd8fb9f8ad115599"},{"name":"lambda","children":[{"name":"long-running-scheduled","children":[{"name":"README.md","path":"stage/us-east-1/stage/lambda/long-running-scheduled/README.md","sha":"274c405a65d60c6a253ca2cf24863e1025402874"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/lambda/long-running-scheduled/terragrunt.hcl","sha":"72518b7089bd107c05c281372f3cccd6d7a6a628"}]},{"name":"s3-image-processing","children":[{"name":"README.md","path":"stage/us-east-1/stage/lambda/s3-image-processing/README.md","sha":"d7e48256e90edb0896769e4bd537c22e34c42f22"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/lambda/s3-image-processing/terragrunt.hcl","sha":"02a23cc6f220d8301d40f7616d1e17f9e17448a5"}]}]},{"name":"networking","children":[{"name":"alb-internal","children":[{"name":"README.md","path":"stage/us-east-1/stage/networking/alb-internal/README.md","sha":"9ee564202c79754713107e2c3644c9cb3815922e"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/networking/alb-internal/terragrunt.hcl","sha":"9537dc7cb6dc7c9eb929a0b97a6f89025e042e57"}]},{"name":"alb-public","children":[{"name":"README.md","path":"stage/us-east-1/stage/networking/alb-public/README.md","sha":"9ee564202c79754713107e2c3644c9cb3815922e"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/networking/alb-public/terragrunt.hcl","sha":"8ea93d9b8dafad1fc2044a677dd9d0db8d768a55"}]},{"name":"route53-private","children":[{"name":"README.md","path":"stage/us-east-1/stage/networking/route53-private/README.md","sha":"c93f222ed15cae75ec411a4b005ad4da32548c42"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/networking/route53-private/terragrunt.hcl","sha":"f7e7c4b437c11b0340c682314deb9b08aca3a854"}]}]},{"name":"services","children":[{"name":"ecs-cluster","children":[{"name":"README.md","path":"stage/us-east-1/stage/services/ecs-cluster/README.md","sha":"a4970def6876c873e8f722cbb4ff168d5b95d97d"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/services/ecs-cluster/terragrunt.hcl","sha":"a42cc57f67f8a9ee2bf5bfce1fb58ea96f5e48f5"}]},{"name":"eks-cluster","children":[{"name":"README.md","path":"stage/us-east-1/stage/services/eks-cluster/README.md","sha":"3c63107a058eeb5b3118b4c569ee867c366c2762"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/services/eks-cluster/terragrunt.hcl","sha":"ec2a56580f4fbe9d5ea53b4a7bc0768a7ae90029"}]},{"name":"eks-core-services","children":[{"name":"README.md","path":"stage/us-east-1/stage/services/eks-core-services/README.md","sha":"bdfb014e5d96aff7bfcb36d6b07bd20a30ddccf1"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/services/eks-core-services/terragrunt.hcl","sha":"4c1aecc3ec52837b98978ec6fc1cd8d5564763ae"}]},{"name":"k8s-applications-namespace","children":[{"name":"README.md","path":"stage/us-east-1/stage/services/k8s-applications-namespace/README.md","sha":"41a7a39dea2f5278e9cc05d7c52eb0144fac15d1"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/services/k8s-applications-namespace/terragrunt.hcl","sha":"3665bac8be17e73ab034e2f32017c69ef209b2af"}]},{"name":"k8s-sample-app-backend-multi-account-acme","children":[{"name":"README.md","path":"stage/us-east-1/stage/services/k8s-sample-app-backend-multi-account-acme/README.md","sha":"184f8a011d291db3558dbdbb0f9d8f0f12d5d888"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/services/k8s-sample-app-backend-multi-account-acme/terragrunt.hcl","sha":"9ea86835ea625bbc341b4d8cbfbcd9b954c4feb5"}]},{"name":"k8s-sample-app-frontend-multi-account-acme","children":[{"name":"README.md","path":"stage/us-east-1/stage/services/k8s-sample-app-frontend-multi-account-acme/README.md","sha":"bf4f271d1b7d4e933a0919ee373289b03c9380fb"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/services/k8s-sample-app-frontend-multi-account-acme/terragrunt.hcl","sha":"b53766ca7b1cf18f27c115d086e3aebf697ee5f3"}]},{"name":"sample-app-backend-multi-account-acme-asg","children":[{"name":"README.md","path":"stage/us-east-1/stage/services/sample-app-backend-multi-account-acme-asg/README.md","sha":"3b3779fb30149fb17d27b9d07ff46890645744b1"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/services/sample-app-backend-multi-account-acme-asg/terragrunt.hcl","sha":"2b1ddfe35699ecff6ee4e8c164ad4c9e00d224da"}]},{"name":"sample-app-backend-multi-account-acme","children":[{"name":"README.md","path":"stage/us-east-1/stage/services/sample-app-backend-multi-account-acme/README.md","sha":"bc6fda688883bd02ec06de1dbf3abd0d7537970b"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/services/sample-app-backend-multi-account-acme/terragrunt.hcl","sha":"1dd22075941f49b593bc9bfb03f616ac8004a06d"}]},{"name":"sample-app-beanstalk","children":[{"name":"README.md","path":"stage/us-east-1/stage/services/sample-app-beanstalk/README.md","sha":"ca960ca9cf3f71d783b3fd4478503e3bdbdb5690"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/services/sample-app-beanstalk/terragrunt.hcl","sha":"4360debb24de5f877a88782858260326f9d72dbd"}]},{"name":"sample-app-frontend-multi-account-acme-asg","children":[{"name":"README.md","path":"stage/us-east-1/stage/services/sample-app-frontend-multi-account-acme-asg/README.md","sha":"ebd62ba824756666250d5a5c062c21a01a6a30cb"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/services/sample-app-frontend-multi-account-acme-asg/terragrunt.hcl","sha":"e0efa40fe276041d8bea4a543144a5591cfcead5"}]},{"name":"sample-app-frontend-multi-account-acme","children":[{"name":"README.md","path":"stage/us-east-1/stage/services/sample-app-frontend-multi-account-acme/README.md","sha":"0ce40b08cc42cacd1d1b5652d7a98c07e3a17172"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/services/sample-app-frontend-multi-account-acme/terragrunt.hcl","sha":"2507d6e2e44be9e18a120c45b083b901f98a4cf9"}]},{"name":"static-website","children":[{"name":"README.md","path":"stage/us-east-1/stage/services/static-website/README.md","sha":"c39ed7c607eb4d1313ea3892768bad09e7f39fd9"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/services/static-website/terragrunt.hcl","sha":"5dcb8cc0d74456bfa9756c29cbc70118b7c894ed"}]}]},{"name":"vpc","children":[{"name":"README.md","path":"stage/us-east-1/stage/vpc/README.md","sha":"e037370db683520d7d593adddc2125ef3798d801"},{"name":"terragrunt.hcl","path":"stage/us-east-1/stage/vpc/terragrunt.hcl","sha":"96c7ebd950aea8d3e7d6767609e9419ef407db4f"}]}]}]}]}]},"detailsContent":"<h1 class=\"preview__body--title\" id=\"accounts-and-auth\">Accounts and Auth</h1><div class=\"preview__body--border\"></div><p>In the last section, you learned about connecting to your servers using <a href=\"/repos/v0.0.1-01172020/infrastructure-live-multi-account-acme/_docs/08-ssh-vpn.md\" class=\"preview__body--description--blue\">SSH and VPN</a>. In this section,\nyou'll learn about connecting to your AWS accounts:</p>\n<ul>\n<li><a href=\"#auth-basics\" class=\"preview__body--description--blue\">Auth basics</a></li>\n<li><a href=\"#account-setup\" class=\"preview__body--description--blue\">Account setup</a></li>\n<li><a href=\"#authenticating\" class=\"preview__body--description--blue\">Authenticating</a></li>\n<li><a href=\"#kubernetes-rbac-roles-and-helm-authentication\" class=\"preview__body--description--blue\">Kubernetes RBAC Roles and Helm Authentication</a>\n<ul>\n<li><a href=\"#rbac-basics\" class=\"preview__body--description--blue\">RBAC basics</a></li>\n<li><a href=\"#relation-to-iam-roles\" class=\"preview__body--description--blue\">Relation to IAM roles</a></li>\n<li><a href=\"#namespaces-and-rbac\" class=\"preview__body--description--blue\">Namespaces and RBAC</a></li>\n<li><a href=\"#accessing-the-cluster\" class=\"preview__body--description--blue\">Accessing the cluster</a>\n<ul>\n<li><a href=\"#terragrunt--terraform\" class=\"preview__body--description--blue\">Terragrunt / Terraform</a></li>\n<li><a href=\"#kubectl\" class=\"preview__body--description--blue\">Kubectl</a></li>\n<li><a href=\"#helm\" class=\"preview__body--description--blue\">Helm</a></li>\n</ul>\n</li>\n</ul>\n</li>\n</ul>\n<h2 class=\"preview__body--subtitle\" id=\"auth-basics\">Auth basics</h2>\n<p>For an overview of AWS authentication, including how to authenticate on the command-line, we <strong>strongly</strong> recommend\nreading <a href=\"https://blog.gruntwork.io/a-comprehensive-guide-to-authenticating-to-aws-on-the-command-line-63656a686799\" class=\"preview__body--description--blue\" target=\"_blank\">A Comprehensive Guide to Authenticating to AWS on the Command\nLine</a>.</p>\n<h2 class=\"preview__body--subtitle\" id=\"account-setup\">Account setup</h2>\n<p>Each of your environments (e.g., stage, prod) is in a separate AWS account. This gives you more fine grained control\nover who can access what and improves isolation and security, as a mistake or breach in one account is unlikely to\naffect the others. The accounts are:</p>\n<ul>\n<li><strong>dev</strong>: <code>087285199408</code></li>\n<li><strong>master</strong>: <code>087285199408</code></li>\n<li><strong>prod</strong>: <code>087285199408</code></li>\n<li><strong>security</strong>: <code>087285199408</code></li>\n<li><strong>shared-services</strong>: <code>087285199408</code></li>\n<li><strong>stage</strong>: <code>087285199408</code></li>\n</ul>\n<p>Note that all IAM users are deployed in a single account called "Security." The idea is that you log into the Security\naccount and, if you need to do something in one of the other accounts, you "switch" to it by assuming an IAM Role in\nthat account (if you've been granted the necessary permissions).</p>\n<ul>\n<li><a href=\"#switching-accounts-prerequisites\" class=\"preview__body--description--blue\">Switching accounts prerequisites</a></li>\n<li><a href=\"#switching-accounts-in-the-aws-console\" class=\"preview__body--description--blue\">Switching accounts in the AWS console</a></li>\n<li><a href=\"#switching-accounts-with-cli-tools\" class=\"preview__body--description--blue\">Switching accounts with CLI tools</a></li>\n</ul>\n<h3 class=\"preview__body--subtitle\" id=\"switching-accounts-prerequisites\">Switching accounts prerequisites</h3>\n<p>If you are logged in as an IAM user in account A and you want to switch to account B, you need the following:</p>\n<ol>\n<li>\n<p>Account B must have an IAM role that explicitly allows your IAM user in account A (or all IAM users in account A)\nto assume that IAM role. We have already set this up in all accounts using the <a href=\"/repos/module-security/modules/cross-account-iam-roles\" class=\"preview__body--description--blue\">cross-account-iam-roles\nmodule</a>.</p>\n</li>\n<li>\n<p>Your IAM user in account A must have the proper IAM permissions to assume roles in account B. We have created IAM\ngroups with these permissions using the <a href=\"/repos/module-security/modules/iam-groups\" class=\"preview__body--description--blue\">iam-groups\nmodule</a>. Typically, these IAM groups\nusing the naming convention <code>_account.xxx</code>, where <code>xxx</code> is the name of an account you can switch to (e.g.\n<code>_account.stage</code>, <code>_account.prod</code>). There is also an <code>_account.all</code> group that allows you to switch to all other\naccounts. Make sure your IAM user is in the appropriate group.</p>\n</li>\n</ol>\n<p>Once you take care of the two prerequisites above, you will need two pieces of information to switch to another\naccount:</p>\n<ol>\n<li>\n<p>The ID of the account you wish to switch to. You should get this from whoever administers your AWS accounts.</p>\n</li>\n<li>\n<p>The name of the IAM role in that account you want to assume. Typically, this will be one of the <a href=\"/repos/module-security/modules/cross-account-iam-roles#resources-created\" class=\"preview__body--description--blue\">roles from the\ncross-account-iam-roles module</a></p>\n<p>such as <code>allow-read-only-access-from-other-accounts</code> or <code>allow-full-access-from-other-accounts</code>.</p>\n</li>\n</ol>\n<p>With these two pieces of data, you should be able to switch accounts in the AWS console or with AWS CLI tools as\nexplained in the following two sections.</p>\n<h3 class=\"preview__body--subtitle\" id=\"switching-accounts-in-the-aws-console\">Switching accounts in the AWS console</h3>\n<p>Check out the <a href=\"http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-console.html\" class=\"preview__body--description--blue\" target=\"_blank\">AWS Switching to a Role (AWS Console)\ndocumentation</a> for instructions\non how to switch between accounts in the AWS console with a single click.</p>\n<h3 class=\"preview__body--subtitle\" id=\"switching-with-cli-tools-including-terraform\">Switching with CLI tools (including Terraform)</h3>\n<p>The official way to assume an IAM role with AWS CLI tools is documented here: <a href=\"http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-cli.html\" class=\"preview__body--description--blue\" target=\"_blank\">AWS Switching to a Role (AWS Command\nLine Interface) documentation</a>. This\nprocess requires quite a few steps, so here are easier ways to do it:</p>\n<ol>\n<li>\n<p><a href=\"/repos/terragrunt\" class=\"preview__body--description--blue\">Terragrunt</a> has the ability to assume an IAM role before running\nTerraform. That means you can authenticate to any account by:</p>\n<ol>\n<li>\n<p>Authenticate to your Security account (the one where the IAM users are defined) using the normal process, such\nas setting the <code>AWS_ACCESS_KEY_ID</code> and <code>AWS_SECRET_ACCESS_KEY</code> environment variables for that account.</p>\n</li>\n<li>\n<p>Call Terragrunt with the <code>--terragrunt-iam-role</code> argument or set the <code>TERRAGRUNT_IAM_ROLE</code> environment variable.\nFor example, to assume the <code>allow-full-access-from-other-accounts</code> role in account <code>1111111111111</code>:\n<code>export TERRAGRUNT_IAM_ROLE=arn:aws:iam::1111111111111:role/allow-full-access-from-other-accounts</code>.</p>\n</li>\n<li>\n<p>Now you can use all your normal Terragrunt commands: e.g., <code>terragrunt plan</code>.</p>\n</li>\n</ol>\n</li>\n<li>\n<p>If you want to assume an IAM role in another account for some other AWS CLI tool, the easiest way to do it is with\nthe <a href=\"/repos/module-security/modules/aws-auth\" class=\"preview__body--description--blue\">aws-auth script</a>, which can\nreduce the authentication process to a one-liner. This tool is also useful for authenticating in the CLI when MFA\nis enabled.</p>\n</li>\n</ol>\n<h2 class=\"preview__body--subtitle\" id=\"authenticating\">Authenticating</h2>\n<p>Some best practices around authenticating to your AWS account:</p>\n<ul>\n<li><a href=\"#enable-mfa\" class=\"preview__body--description--blue\">Enable MFA</a></li>\n<li><a href=\"#use-a-password-manager\" class=\"preview__body--description--blue\">Use a password manager</a></li>\n<li><a href=\"#dont-user-the-root-user\" class=\"preview__body--description--blue\">Don't use the root user</a></li>\n</ul>\n<p>Note that most of this section comes from the <a href=\"https://docs.google.com/document/d/e/2PACX-1vTikva7hXPd2h1SSglJWhlW8W6qhMlZUxl0qQ9rUJ0OX22CQNeM-91w4lStRk9u2zQIn6lPejUbe-dl/pub\" class=\"preview__body--description--blue\" target=\"_blank\">Gruntwork Security Best Practices\ndocument</a>, so make sure to read through that for more info.</p>\n<h3 class=\"preview__body--subtitle\" id=\"enable-mfa\">Enable MFA</h3>\n<p>Always enable multi-factor authentication (MFA) for your AWS account. That is, in addition to a password, you must\nprovide a second factor to prove your identity. The best option for AWS is to install <a href=\"https://support.google.com/accounts/answer/1066447?hl=en\" class=\"preview__body--description--blue\" target=\"_blank\">Google\nAuthenticator</a> on your phone and use it to generate a one-time\ntoken as your second factor.</p>\n<h3 class=\"preview__body--subtitle\" id=\"use-a-password-manager\">Use a password manager</h3>\n<p>Never store secrets in plain text. Store your secrets using a secure password manager, such as\n<a href=\"https://www.passwordstore.org/\" class=\"preview__body--description--blue\" target=\"_blank\">pass</a>, <a href=\"https://en.wikipedia.org/wiki/Keychain_(software)\" class=\"preview__body--description--blue\" target=\"_blank\">OS X Keychain</a>, or\n<a href=\"http://keepass.info/\" class=\"preview__body--description--blue\" target=\"_blank\">KeePass</a>. You can also use cloud-based password managers, such as\n<a href=\"https://1password.com/\" class=\"preview__body--description--blue\" target=\"_blank\">1Password</a> or <a href=\"https://www.lastpass.com/\" class=\"preview__body--description--blue\" target=\"_blank\">LastPass</a>, but be aware that since they have\neveryone's passwords, they are inherently much more tempting targets for attackers. That said, any reasonable password\nmanager is better than none at all!</p>\n<h3 class=\"preview__body--subtitle\" id=\"dont-use-the-root-user\">Don't use the root user</h3>\n<p>AWS uses the <a href=\"https://aws.amazon.com/iam/\" class=\"preview__body--description--blue\" target=\"_blank\">Identity and Access Management (IAM)</a> service to manage users and their\npermissions. When you first sign up for an AWS account, you are logged in as the <em>root user</em>. This user has permissions\nto do everything in the account, so if you compromise these credentials, you’re in deep trouble.</p>\n<p>Therefore, right after signing up, you should:</p>\n<ol>\n<li>\n<p>Enable MFA on your root account. Note: we strongly recommend making a copy of the MFA secret key. This way, if you\nlose your MFA device (e.g. your iPhone), you don’t lose access to your AWS account. To make the backup, when\nactivating MFA, AWS will show you a QR code. Click the "show secret key for manual configuration" link and save that\nkey to a secure password manager.</p>\n</li>\n<li>\n<p>Make sure you use a very long and secure password. Never share that password with anyone. If you need to store it\n(as opposed to memorizing it), only store it in a secure password manager.</p>\n</li>\n<li>\n<p>Use the root account to create a separate IAM user for yourself and your team members with more limited IAM\npermissions. You should manage permissions using IAM groups. See the <a href=\"/repos/module-security/modules/iam-groups\" class=\"preview__body--description--blue\">iam-groups\nmodule</a> for details.</p>\n</li>\n<li>\n<p>Use IAM roles when you need to give limited permissions to tools (for eg, CI servers or EC2 instances).</p>\n</li>\n<li>\n<p>Require all IAM users in your account to use MFA.</p>\n</li>\n<li>\n<p>Never use the root IAM account again.</p>\n</li>\n</ol>\n<h2 class=\"preview__body--subtitle\" id=\"kubernetes-rbac-roles-and-helm-authentication\">Kubernetes RBAC Roles and Helm Authentication</h2>\n<p>Up to this point we focused on accounts and authentication in AWS. However, with EKS, Kubernetes adds another layer of\naccounts and authentication that are tied to, but not exactly the same as, AWS IAM.</p>\n<p>In this section, you'll learn about Kubernetes RBAC roles and Helm authentication:</p>\n<ul>\n<li><a href=\"#rbac-basics\" class=\"preview__body--description--blue\">RBAC basics</a></li>\n<li><a href=\"#relation-to-iam-roles\" class=\"preview__body--description--blue\">Relation to IAM roles</a></li>\n<li><a href=\"#namespaces-and-rbac\" class=\"preview__body--description--blue\">Namespaces and RBAC</a></li>\n<li><a href=\"#accessing-the-cluster\" class=\"preview__body--description--blue\">Accessing to the cluster</a>\n<ul>\n<li><a href=\"#terragrunt--terraform\" class=\"preview__body--description--blue\">Terragrunt / Terraform</a></li>\n<li><a href=\"#kubectl\" class=\"preview__body--description--blue\">Kubectl</a></li>\n<li><a href=\"#helm\" class=\"preview__body--description--blue\">Helm</a></li>\n</ul>\n</li>\n</ul>\n<h3 class=\"preview__body--subtitle\" id=\"rbac-basics\">RBAC basics</h3>\n<p><a href=\"https://kubernetes.io/docs/reference/access-authn-authz/rbac/\" class=\"preview__body--description--blue\" target=\"_blank\">Role Based Access Control (RBAC)</a> is a method to regulate\naccess to resources based on the role that individual users assume in an organization. Kubernetes allows you to define\nroles in the system that individual users inherit, and explicitly grant permissions to resources within the system to\nthose roles. The Control Plane will then honor those permissions when accessing the resources on Kubernetes through\nclients such as <code>kubectl</code>. When combined with namespaces, you can implement sophisticated control schemes that limit the\naccess of resources across the roles in your organization.</p>\n<p>The RBAC system is managed using <code>ClusterRole</code> and <code>ClusterRoleBinding</code> resources (or <code>Role</code> and <code>RoleBinding</code> resources\nif restricting to a single namespace). The <code>ClusterRole</code> (or <code>Role</code>) object defines a role in the Kubernetes system that\nhas explicit permissions on what it can and cannot do. These roles are then bound to users and groups using the\n<code>ClusterRoleBinding</code> (or <code>RoleBinding</code>) resource. An important thing to note here is that you do not explicitly create\nusers and groups using RBAC, and instead rely on the authentication system to implicitly create these entities.</p>\n<p>You can refer to <a href=\"/repos/terraform-aws-eks/modules/eks-k8s-role-mapping#examples\" class=\"preview__body--description--blue\">Gruntwork's RBAC example\nscenarios</a> for use\ncases.</p>\n<h3 class=\"preview__body--subtitle\" id=\"relation-to-iam-roles\">Relation to IAM Roles</h3>\n<p>EKS manages authentication to Kubernetes based on AWS IAM roles and users. This is done by embedding AWS IAM credentials\n(the access key and secret key) into the authentication token used to authenticate to the Kubernetes API. The API server\nthen forwards this to AWS to validate it, and then reconciles the role / user into an RBAC user and group that is then\nused to reconcile authorization rules for the API.</p>\n<p>By default all IAM roles and users (except for the role / user that deployed the cluster) has no RBAC user or groups\nassociated with it. This automatically translates the role / user into an anonymous user on the cluster, who by default\nhas no permissions. In order to allow access to the cluster, you need to explicitly bind the IAM role / user to an RBAC\nentity, and then bind <code>Roles</code> or <code>ClusterRoles</code> that explicitly grants permissions to perform actions on the cluster.\nThis mapping is handled by the <a href=\"/repos/terraform-aws-eks/modules/eks-k8s-role-mapping\" class=\"preview__body--description--blue\">eks-k8s-role-mapping\nmodule</a>, used under the hood\nin the <a href=\"/repos/infrastructure-modules-multi-account-acme/services/eks-cluster\" class=\"preview__body--description--blue\">eks-cluster infrastructure module</a>.</p>\n<p>You can read more about the relationship between IAM roles and RBAC roles in EKS in <a href=\"https://docs.aws.amazon.com/eks/latest/userguide/managing-auth.html\" class=\"preview__body--description--blue\" target=\"_blank\">the official\ndocumentation</a>.</p>\n<h3 class=\"preview__body--subtitle\" id=\"namespaces-and-rbac\">Namespaces and RBAC</h3>\n<p><a href=\"https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/\" class=\"preview__body--description--blue\" target=\"_blank\">Namespaces</a> are Kubernetes resources\nthat creates virtual partition boundaries in your cluster. The resources in each <code>Namespace</code> are isolated from other\n<code>Namespaces</code>, and can only interact with them through <code>Service</code> endpoints, unless explicit permissions are granted. This\nallows you to divide the cluster between multiple users in a way that prevents them from seeing each others' resources,\nallowing you to share clusters while protecting sensitive information.</p>\n<p>RBAC is critical in achieving isolation of <code>Namespaces</code>. The RBAC permissions can be restricted by <code>Namespace</code>. This\nallows you to bind permissions to entities such that they can only perform certain actions on resources within a\nparticular <code>Namespace</code>.</p>\n<p>Refer to the <a href=\"/repos/terraform-aws-eks/modules/eks-k8s-role-mapping#restricting-by-namespace\" class=\"preview__body--description--blue\">eks-k8s-role-mapping module\ndocs</a>\nfor an example on using RBAC to restrict actions to a particular <code>Namespace</code>.</p>\n<p>Every EKS cluster comes with two default <code>Namespaces</code>:</p>\n<ul>\n<li><code>kube-system</code>: This <code>Namespace</code> holds admin and cluster level resources. Only cluster administrators ("superusers")\nshould have access to this <code>Namespace</code>.</li>\n<li><code>default</code>: This is the default <code>Namespace</code> that is used for API calls that don't specify a particular <code>Namespace</code>.\nThis should primarily be used for development and experimentation purposes.</li>\n</ul>\n<p>Additionally, in the Reference Architecture, we create another <code>Namespace</code>: <code>applications</code>. This <code>Namespace</code> is used to\nhouse the deployed sample applications and its associated resources.</p>\n<p>Most Kubernetes tools will let you set the <code>Namespace</code> as CLI args. For example, <code>kubectl</code> supports a <code>-n</code> parameter for\nspecifying which <code>Namespace</code> you intend to run the command against. <code>kubectl</code> additionally supports overriding the\ndefault <code>Namespace</code> for your commands by binding a <code>Namespace</code> to your authentication context.</p>\n<h3 class=\"preview__body--subtitle\" id=\"accessing-the-cluster\">Accessing the cluster</h3>\n<p>As mentioned in <a href=\"#relation-to-iam-roles\" class=\"preview__body--description--blue\">Relation to IAM Roles</a>, EKS proxies Kubernetes authentication through AWS IAM\ncredentials. This means that you need to be authenticated to AWS first in order to authenticate to Kubernetes. Refer to\n<a href=\"#authenticating\" class=\"preview__body--description--blue\">the previous section on AWS authentication</a> for information on how to authenticate to AWS.</p>\n<p>There are three main ways to interact with Kubernetes in the Reference Architecture:</p>\n<ul>\n<li><a href=\"#terragrunt--terraform\" class=\"preview__body--description--blue\">Using Terragrunt / Terraform</a></li>\n<li><a href=\"#kubectl\" class=\"preview__body--description--blue\">Using kubectl</a></li>\n<li><a href=\"#helm\" class=\"preview__body--description--blue\">Using Helm</a></li>\n</ul>\n<h4 id=\"terragrunt-terraform\">Terragrunt / Terraform</h4>\n<p>When deploying Kubernetes resources using Terragrunt / Terraform, all the authentication is handled inside of Terraform\nusing a combination of EKS data sources and provider logic. What this means is that you don't have to worry about\nexplicitly authenticating to Kubernetes when going through Terraform, as long as you are authenticating to an IAM role\nthat has a valid mapping to an RBAC entity in the cluster.</p>\n<p>The one exception to this is the modules that depend on <code>helm</code>, which requires additional configuration. See the\n<a href=\"#helm\" class=\"preview__body--description--blue\">section on helm</a> for more info.</p>\n<h4 id=\"kubectl\">Kubectl</h4>\n<p>Most manual operations in Kubernetes are handled through <a href=\"https://kubernetes.io/docs/reference/kubectl/overview/\" class=\"preview__body--description--blue\" target=\"_blank\">the kubectl command line\nutility</a>. <code>kubectl</code> requires an explicit authentication\nconfiguration to access the cluster.</p>\n<p>You can use <code>kubergrunt</code> to configure your local <code>kubectl</code> client to authenticate against a deployed EKS cluster. After\nauthenticating to AWS, run:</p>\n<pre>kubergrunt eks configure --eks-<span class=\"hljs-keyword\">cluster</span>-arn $EKS_CLUSTER_ARN\n</pre>\n<p>This will add a new entry to your <code>kubectl</code> config file (defaults to <code>$HOME/.kube/config</code>) with the logic for\nauthenticating to EKS, registering it under the context name <code>$EKS_CLUSTER_ARN</code>. You can modify the name of the context\nusing the <code>--kubectl-context-name</code> CLI arg.</p>\n<p>You can verify the setup by running:</p>\n<pre><span class=\"hljs-attribute\">kubectl</span> cluster-<span class=\"hljs-literal\">info</span>\n</pre>\n<p>This will report information about the Kubernetes endpoints for the cluster only if you are authorized to access to the\ncluster. Note that you will need to be authenticated to AWS for <code>kubectl</code> to successfully authenticate to the cluster.</p>\n<p>If you have multiple clusters, you can switch the <code>kubectl</code> context using the <code>use</code> command. For example, to switch the\ncurrent context to the <code>dev</code> EKS cluster from the <code>prod</code> cluster and back:</p>\n<pre>kubectl use arn:aws:eks:us-east-<span class=\"hljs-number\">1</span>:$DEV_ACCOUNT_ID:cluster/eks-dev\nkubectl cluster-info <span class=\"hljs-comment\"># Should target the dev EKS cluster</span>\nkubectl use arn:aws:eks:us-east-<span class=\"hljs-number\">1</span>:$PROD_ACCOUNT_ID:cluster/eks-prod\nkubectl cluster-info <span class=\"hljs-comment\"># Should target the prod EKS cluster</span>\n</pre>\n<h4 id=\"helm\">Helm</h4>\n<p>Helm relies on TLS based authentication and authorization to access Tiller (the Helm Server). This is separate from the\nRBAC based authorization native to Kubernetes. Intuitively, RBAC is used to manage whether or not someone can lookup the\n<code>Pod</code> endpoint address, while the TLS authentication and authorization scheme manages whether or not you can establish a\nconnection to the Tiller server. All deployments of Tiller in the Reference Architecture uses <code>kubergrunt</code> to manage the\nTLS certificates.</p>\n<p>We highly recommend reading <a href=\"/repos/kubergrunt/HELM_GUIDE.md\" class=\"preview__body--description--blue\">Gruntwork's guide to\nhelm</a> to understand the security model surrounding\nHelm and Tiller.</p>\n<p><code>kubergrunt</code> manages the TLS certificates using Kubernetes <code>Secrets</code>, guarded by RBAC roles. A cluster administrator can\ngrant access to any RBAC entity to any Tiller deployment using the <code>kubergrunt helm grant</code> command. For example, to\ngrant access to a Tiller server deployed in the namespace <code>applications-tiller</code> to the RBAC user\n<code>allow-full-access-from-other-accounts</code>:</p>\n<pre>kubergrunt helm grant <span class=\"hljs-string\">\\</span>\n --tls-common-name allow-full-access-<span class=\"hljs-keyword\">from</span>-other-accounts <span class=\"hljs-string\">\\</span>\n --tls-org Acme Multi Account <span class=\"hljs-string\">\\</span>\n --tiller-namespace applications <span class=\"hljs-string\">\\</span>\n --rbac-user allow-full-access-<span class=\"hljs-keyword\">from</span>-other-accounts\n</pre>\n<p><strong>Note on RBAC users</strong>: The RBAC user username (<code>--rbac-user</code>) corresponds to the IAM Role or User name of the\nauthenticating AWS credentials.</p>\n<p>This generates new TLS certificate key pairs that grant access to the Tiller deployed in the <code>applications-tiller</code>\nNamespace. In addition, this creates and binds RBAC roles that allow users of the RBAC group <code>developers</code> to be able to\nread the necessary <code>Secrets</code> to download the generated TLS certificate key pairs.</p>\n<p>Now anyone who maps to the <code>developers</code> RBAC group can use the <code>kubergrunt helm configure</code> command to setup their\nhelm client to access the deployed Tiller:</p>\n<pre>kubergrunt helm configure <span class=\"hljs-string\">\\</span>\n --tiller-namespace applications-tiller <span class=\"hljs-string\">\\</span>\n --resource-namespace applications <span class=\"hljs-string\">\\</span>\n --rbac-user allow-full-access-<span class=\"hljs-keyword\">from</span>-other-accounts\n</pre>\n<p>This will:</p>\n<ul>\n<li>Download the client TLS certificate key pair generated with the <code>grant</code> command.</li>\n<li>Install the TLS certificate key pair in the helm home directory (defaults to <code>$HOME/.helm</code>).</li>\n<li>Install an environment file that sets up environment variables to target the specific helm server (defaults to\n<code>$HELM_HOME/env</code>). This environment file needs to be loaded before issuing any commands, at it sets the necessary\nenvironment variables to signal to the helm client which helm server to use. The environment variables it sets are:\n<ul>\n<li><code>HELM_HOME</code>: The helm client home directory where the TLS certs are located.</li>\n<li><code>TILLER_NAMESPACE</code>: The namespace where the helm server is installed.</li>\n<li><code>HELM_TLS_VERIFY</code>: This will be set to true to enable TLS verification.</li>\n<li><code>HELM_TLS_ENABLE</code>: This will be set to true to enable TLS authentication.</li>\n</ul>\n</li>\n</ul>\n<p>Once this is setup, Terraform modules that need to access <code>helm</code> will be able to use the downloaded credentials to\nauthenticate to Tiller. Additionally, once you source the environment file, you will be able to use the <code>helm</code> client to\ndirectly work with Tiller.</p>\n<p>If you have the <code>helm</code> client installed, you can verify your configuration setup using the <code>helm version</code> command:</p>\n<pre>helm <span class=\"hljs-built_in\">version</span>\n</pre>\n<p>If your <code>helm</code> client is configured correctly, the <code>version</code> command will output information about the deployed Tiller\ninstance that it connected to.</p>\n<h2 class=\"preview__body--subtitle\" id=\"next-steps\">Next steps</h2>\n<p>Now that you know how to authenticate, you may want to take a look through this list of <a href=\"/repos/v0.0.1-01172020/infrastructure-live-multi-account-acme/_docs/10-gruntwork-tools.md\" class=\"preview__body--description--blue\">Gruntwork\nTools</a>.</p>\n","repoName":"infrastructure-live-multi-account-acme","repoRef":"v0.0.1-01172020","serviceDescriptor":{"serviceName":"Multi-account Reference Architecture","serviceRepoName":"infrastructure-live-multi-account-acme","serviceRepoOrg":"gruntwork-io","cloudProviders":["aws"],"description":"End-to-end tech stack designed to deploy into multiple AWS accounts. Includes VPCs, EKS, ALBs, CI / CD, monitoring, alerting, VPN, DNS, and more.","imageUrl":"grunt.png","licenseType":"subscriber","technologies":["Terraform","Go","Bash","Python"],"compliance":[],"tags":[""]},"serviceCategoryName":"Reference Architecture","fileName":"09-accounts-and-auth.md","filePath":"/_docs/09-accounts-and-auth.md","title":"Repo Browser: Multi-account Reference Architecture","description":"Browse the repos in the Gruntwork Infrastructure as Code Library."}
_docs
.gitignore
