The following steps are required prior to creating the dbt Cloud infrastructure in AWS using terraform.

To connect to the aws account run aws configure --profile <PROFILE_NAME> and enter valid AWS secret values for an IAM user in the account where you will be installing the dbt Cloud application. After running the above command, make sure that the current AWS profile is set by running export AWS_PROFILE=<PROFILE_NAME> (for Mac users) or setx AWS_PROFILE <PROFILE_NAME> (for Windows users). Note that this profile will be needed later when setting the Kubernetes context after infrastructure is configured.

It is highly recommended that the environment infrastructure be created by assuming an IAM role in the AWS host account rather than by an IAM user. This can prevent loss of access to certain components, specifically in EKS (see here for information in EKS specific IAM permissions), if a user leaves an organization. The TFCreator role should be granted the AdministratorAccess policy and set up with the following Trust relationship.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::<ACCOUNT_ID>:root"
      },
      "Action": "sts:AssumeRole"
    }
  ]
}

Once created the role arn should be entered in the "creation_role_arn" variable in the vars.tf file for each environment directory. The role is assumed by Terraform in the aws provider for each environment. Note that this role will be needed again when installing dbt Cloud.

The infrastructure needed to host the dbt Cloud application in AWS must live in a VPC configured outside of this module. Examples of how to create such a VPC using Terraform can be seen in either the custom or standard examples in this module.

In order to host the dbt Cloud application, a valid domain name must be set in the domain_name variable in the (root)/vars file and each of the "hosted_zone_name" fields in the respective environment declarations of the single_tenant module. This domain name should either be established in the corresponding AWS account for the deployment, or appropriate DNS records should be created to forward traffic to the URL if the domain is managed in a separate account.

Note: When running terraform apply for the first time, the module may fail to validate the ACM certificate as this uses DNS to validate domain ownvership. If it fails, wait for the ACM certificate to become validated by AWS by monitoring the Admin Console and re-run terraform apply once validated.

After creating the infrastructure by running terraform apply the following steps must be run to configure the infrastructure for the dbt Cloud application.

After the environment configuration is complete the dbt Cloud application can be configured and installed via the Replicated (KOTS) admin console. If the optional 'create_admin_console_script' variable was set to true then a script and corresponding config file will be created to automatically install the KOTS admin console will pre-filled values populated from other related optional variables and the infrastructure build by Terraform (such as RDS hostname). This script can simply by ran from the shell with ./dbt_config.sh. Once the admin console is installed it can be accessed via localhost:8800. After entering the password and a valid license, the deployment engineer will be redirected to the config page with all values prepopulated. These values should be double checked before continuing to deploy the latest channel version of dbt Cloud.

If the create_admin_console_script variable was not set to true, the KOTS admin console can be manually configured using the following steps below.

The above environment configuration process will have created an EKS cluster with a naming convention <namespace>-<environment. To connect to the cluster run the following command using the 'AWS profile' and 'TF Creator role arn' created in the bootstrapping section:

aws eks update-kubeconfig --profile <AWS_PROFILE_NAME> --name <EKS_CLUSTER_NAME> --role-arn <TF_CREATOR_ROLE_ARN>

Once the kubeconfig is successfully updated, the namespaces on the cluster can be viewed by running kubectl get ns. The environment configuration process will have generated a namespace wilt the following syntax: dbt-cloud-<namespace>-<environment>. This namespace will be needed for the next step.

Once connected to the desired cluster, the Replicated kots administration console can be installed. First determine the by running the below commands. Note that dbt-cloud-<account>-<environment> namespace from the above step needs to be passed to the kubectl kots install command, as otherwise the command will prompt to enter a new namespace.

curl https://kots.io/install | bash
kubectl kots install dbt-cloud-v1 --namespace=<DBT-CLOUD-NAMESPACE>

Note that the kubectl kots install will prompt the user for a password for the console (a secure password is recommended). Once the admin console is installed, it can be accessed via localhost:8800. After entering the previously created admin console password and a valid license the deployment engineer can continue to the setup process to configure and deploy the dbt Cloud application.