Title
#infrastructure
theopolis

theopolis

09/08/2020, 3:41 AM
Hi folks, I am an AWS n00b but I control 3 things that we need to migrate from a Facebook-owned account to an osquery-owned account (the one you all are setting up). I have never used terraform before, so I am unsure what can/should be represented as code. I can describe at a high level what we need to do for the migration based on my limited understanding. S3. We have a bucket
osquery-packages
on an FB account. We can create a
osquery-packages2
on the osquery account, then use the CLI to sync all of the data. Next we delete the
osquery-packages
bucket and quickly re-create it on the osquery account, and finally sync again from
osquery-packages2
to
osquery-packages
. Route53. We have our
<http://osquery.io|osquery.io>
zone hosted here. There is a zone-transfer process we can follow, I am least worried about this. ACM. I'll have to delete the existing TLS keys and then create new ones on the osquery account. I am pretty sure I know how to do this through the AWS UI. CloudFront. We have configuration for
<http://osquery.io|osquery.io>
to reverse proxy the GH pages, to reverse proxy the S3 bucket and create a
<http://pkg.osquery.io|pkg.osquery.io>
.
CptOfEvilMinions

CptOfEvilMinions

09/08/2020, 4:07 AM
4:10 AM
I will let others comment but I think it would be best to create an empty S3 bucket via TF on the Osquery AWS account. Next, transfer items from old bucket to the new bucket. To transfer the contents you can use the AWS CLI to sync the two buckets as demonstrated in the Medium post above.
theopolis

theopolis

09/08/2020, 3:41 PM
This is a good find, I will try to do this. In the event it does not work then I don't think it's a big deal to have AWS generate a new certificate.
3:42 PM
But also, I am curious if the Terraform experts can weigh in on how Terraform plays a role in the migration?
Gavin

Gavin

09/09/2020, 8:56 PM
Once the transfer is completed we can define the resource in terraform and use terraform import pointed at the resource to import the “live” state and then manage in code going further
8:57 PM
Retrospective management in code is probably the quickest avenue to migrate off of existing infra with appropriate issues to track work required
theopolis

theopolis

09/09/2020, 11:06 PM
Sounds like a good “plan”