Build up CI/CD Pipeline with CDK - Multi Account/Region Deployments

In this guide, we will introduce a way to build up CI/CD piplelines to realize services multi account/region deployments using CDK.

Stack Architecture

Below in the graph shows the infrastructure architecture. The whole architecture spreads in four accounts. One account is for deploying pipeline whereas other three accounts are the service accounts for each of stages in development

Cross Account Setup - Console (Optional)

During the deployment, we will need to switch between four AWS accounts to check resources. To avoid the time spending on login and logout between account, instead, we will leverage roles to get access to different consoles. This step will facilitate us switch console by 1-click without logout and login.

In each of target accounts (prd, stg, dev), create a role OrganizationAccountAccessRole and configure it to trust pipeline account, and attach policy.
In pipeline account, create policies as below for each of the target account and attach to role you use that allows account. Repeat for all accounts.
Use switch role link in menu drop at top right of the console to switch between accounts.

Regional CDK Bootstrapping

Each account region combo that is deployed to must be bootstrapped. Since it is a cross-account deployment, a trust must be established during this process.

Deploying AWS CDK apps into an AWS environment may require that you provision resources the AWS CDK needs to perform the deployment. These resources include an Amazon S3 bucket for storing files and IAM roles that grant permissions needed to perform deployments. The process of provisioning these initial resources is called bootstrapping.

For each target account/region run the following CLI command (Must be ran as user with appropriate privs in the target account):

cdk bootstrap --trust <pipelineAccountId> --cloudformation-execution-policies arn:aws:iam::aws:policy/AdministratorAccess aws://<targetAccountId>/<targetRegion>

Given we are deploying to 2 regions in 3 different accounts, we must run this command 6 times

Initial Deployment of Pipeline

Pipeline Overview

./cdk/bin/pipeline.ts: Creation of CDK App for Pipeline

./cdk/lib/cdk-pipeline-stack.ts: Definition of stacks to deploy, as well as environments to deploy to.

Github Access

Create a github token here. Set the permission as below
In pipeline account/region, create Secret Manager secret to store access token for GitHub repo. The token must stored as a plaintext secret with a name of github-token:

Deploy Pipeline

Clone the repo and run command. When prompted to create security groups/deploy, accept.
```
cdk deploy CdkPipelineStack
```
Navigate to CodePipeline in Console and cancel the intial build.
Set Env Vars in the Build step of the pipeline as below.

Configure Pipeline Role

In pipeline account, create a Policy for each target account to allow Pipeline role to assume Roles created during bootstrap process

Get CDK prefix from a target account
Create policy for all 3 accounts
Attach all 3 policies to the Pipeline Build role (Very similar to what we did for cross account access in console)