paulu-aws / biotechblueprint Goto Github PK

In the docs, clarify bits related to AD configuration including:

• "Start by creating a user for yourself". Should this user also be added to the CorporateVpnUsers group?
• AD group creation. What scope and group type should be used for these groups?

Hey @paulu-aws!

Thanks for putting together this blueprint! We'd like to make some modifications around removing Active Directory and replacing it with SAML + SCIM provisioning, but would like to make those modifications and documentation public for others to use. Would you consider adding an open source license such as MIT, Apache 2.0, or similar so we could facilitate that?

Hey Paul, really awesome work!

Since you've added so much to this blueprint it's now kind of monolithic. I'm suggesting to decouple the infrastructure components (along with the docs) from the actual blueprint. Here's a user story to describe why:

My company started with a single AWS account. When Control Tower launched we implemented it using AWS SSO and the initial account became our master. The multi-account model enabled by Control Tower and Organizations is so powerful that we plan to create separate research accounts for our different departments, projects and fellowships.

We've chosen to stick with AWS SSO for now and don't want the AD pieces. If and when we do switch to AD, we'll want to connect to our existing installation. It turns out that BB 2.0 works just fine with AWS SSO - though to be clear, the AD instance is running and still used for VPN admin auth.

The TGW account is a revelation! But it only needs to be set up once while the BB needs to be implemented in each research account. We'd love it if the BB code could be run as a separate module, adding associations, routes, etc to the existing TGW auto-magically.

Needed to add an arbitrary prefix to the hostname in the ovpn file in order for RDP client to connect (and for routing to work properly)