How to build a new region? ¶

Prerequisite

Prerequisite ¶

Login to https://cloudsso.cisco.com/idp/startSSO.ping?PartnerSpId=https://signin.aws.amazon.com/saml and do some preparation.

Create User ¶

Create a AWS user with Access key - Programmatic access, or get an existing one to login with AWS configure

taowa2@TAOWA2-M-K0TE alert-service % aws configure
AWS Access Key ID [****************4SOW]: 
AWS Secret Access Key [****************mX5Z]: 
Default region name [us-west-1]: us-west-2
Default output format [json]:

Upload Certificate ¶

Upload SSL Certificate to AWS Certificate Manager → Certificates in the new region

Copy AMI ¶

Copy Amazon Machine Images (AMIs) ami-03a8aeab6f89710e7 from us-east-2 to us-west-2, and get a new AMI: ami-017f4e71dfc4efcf4

Query ELB-Account-ID ¶

https://docs.aws.amazon.com/elasticloadbalancing/latest/application/enable-access-logging.html

Query elb-account-id with the ID of the AWS account for Elastic Load Balancing for your Region:

US East (N. Virginia) – 127311923021
US East (Ohio) – 033677994240
US West (N. California) – 027434742980
US West (Oregon) – 797873946194
Africa (Cape Town) – 098369216593
Canada (Central) – 985666609251
Europe (Frankfurt) – 054676820928
Europe (Ireland) – 156460612806
Europe (London) – 652711504416
Europe (Milan) – 635631232127
Europe (Paris) – 009996457667
Europe (Stockholm) – 897822967062
Asia Pacific (Hong Kong) – 754344448648
Asia Pacific (Tokyo) – 582318560864
Asia Pacific (Seoul) – 600734575887
Asia Pacific (Osaka) – 383597477331
Asia Pacific (Singapore) – 114774131450
Asia Pacific (Sydney) – 783225319266
Asia Pacific (Mumbai) – 718504428378
Middle East (Bahrain) – 076674570225
South America (São Paulo) – 507241528517
AWS GovCloud (US-West) – 048591011584
AWS GovCloud (US-East) – 190560391635

Configure S3 ¶

Create a new S3 bucket called ha-gss-cisco-dist-bucket-us-west-2 and copy all folders from ha-gss-cisco-dist-bucket-us-west-1 except microservice
Go to S3 bucket gss-cisco-dist-bucket → Management, and configure a new replication rule: | prefix | microservice | | :-- | :-- | | Destination Bucket name | ha-gss-cisco-dist-bucket-us-west-2 | | IAM Role | s3crr_role_for_gss-cisco-dist-bucket_to_ha-gss-cisco-dist-bucket | | AWS KMS key for encrypting destination objects | AWS managed key (aws/s3) | | Replicate objects encrypted with AWS KMS | true |

Install AWS CLI ¶

Follow the wiki to install AWS CLI: https://docs.aws.amazon.com/cli/latest/userguide/getting-started-install.html

Get Latest EB Solution ¶

taowa2@TAOWA2-M-K0TE cloudformation % aws elasticbeanstalk list-available-solution-stacks|grep "Tomcat 8.5 Corretto 8"|grep "SolutionStackName"

        "SolutionStackName": "64bit Amazon Linux 2 v4.2.18 running Tomcat 8.5 Corretto 8",

Workflow ¶

Build RDS/Redis/MicroService/Lambda/Pipeline with Cloud Formation Template ¶

Generate microservice-parameters.json ¶

[
                {
                    "ParameterKey": "CiscoSparkBotToken",
                    "ParameterValue": "NmIxZjZlZTMtN2NkOC00NWM1LWE3NzItZGJkZWI4MzAyOWVhZDJkMThmNGYtYzQx_PF84_1eb65fdf-9643-417f-9974-ad72cae0e10f"
                },
                {
                    "ParameterKey": "ESPRepositoryBucket",
                    "ParameterValue": "ha-gss-cisco-dist-bucket-us-west-2"
                },
                {
                    "ParameterKey": "CognitoPoolId",
                    "ParameterValue": "NA"
                },
                {
                    "ParameterKey": "ServiceDomain",
                    "ParameterValue": "service-status-us-west-2.webex.com"
                },
                {
                    "ParameterKey": "DeployArtifactName",
                    "ParameterValue": "gss-service.zip"
                },
                {
                    "ParameterKey": "DBPassword",
                    "ParameterValue": "Change1140"
                },
                {
                    "ParameterKey": "EnvironmentType",
                    "ParameterValue": "stage"
                },
                {
                    "ParameterKey": "GssOAuthClientSecret",
                    "ParameterValue": "MTUyODc4MDk4MTY3Nw=="
                },
                {
                    "ParameterKey": "CiscoSparkSpaceId",
                    "ParameterValue": "Y2lzY29zcGFyazovL3VzL1JPT00vNzZiZjEwMTAtZmU0ZC0xMWU4LThmOGItMDM0NzljOTM0OGNh"
                },
                {
                    "ParameterKey": "LoggingBucketName",
                    "ParameterValue": "log-us-west-2-status.webex.com"
                },
                {
                    "ParameterKey": "SSLCertificateId",
                    "ParameterValue": "arn:aws:acm:us-west-2:656663974684:certificate/7ef2d556-ec94-4edf-8e90-1a650c84e2bc"
                },
                {
                    "ParameterKey": "SyncLambdaFunctionArn",
                    "ParameterValue": "NA"
                },
                {
                    "ParameterKey": "GssOAuthClientId",
                    "ParameterValue": "gss-web-service-prod"
                },
                {
                    "ParameterKey": "AppType",
                    "ParameterValue": "gss"
                },
                {
                    "ParameterKey": "DBUsername",
                    "ParameterValue": "master"
                },
                {
                    "ParameterKey": "CloudFormationRootPath",
                    "ParameterValue": "https://s3.us-west-2.amazonaws.com/ha-gss-cisco-dist-bucket-us-west-2"
                },
                {
                    "ParameterKey": "AmiId",
                    "ParameterValue": "ami-017f4e71dfc4efcf4"
                },
                {
                    "ParameterKey": "SolutionStackName",
                    "ParameterValue": "64bit Amazon Linux 2 v4.2.18 running Tomcat 8.5 Corretto 8"
                },
                {
                    "ParameterKey": "ELBAccountId",
                    "ParameterValue": "797873946194"
                }
            ]

Create RegionSetup ¶

aws cloudformation create-stack --stack-name RegionSetup --template-url https://ha-gss-cisco-dist-bucket-us-west-2.s3.us-west-2.amazonaws.com/cloudformation/region_setup.yaml --region us-west-2 --parameters ParameterKey=RepositoryS3Bucket,ParameterValue=ha-gss-cisco-dist-bucket-us-west-2 --tags Key=Application,Value=gss Key=Environment,Value=preprod --capabilities CAPABILITY_IAM

{

"StackId": "arn:aws:cloudformation:us-west-2:656663974684:stack/RegionSetup/a89427f0-2767-11ed-b817-025e94581e07"

}

Create gss-service-preprod-us-west-2 ¶

aws cloudformation create-stack --stack-name gss-service-preprod-us-west-2 --template-url https://ha-gss-cisco-dist-bucket-us-west-2.s3.us-west-2.amazonaws.com/cloudformation/microservice.yaml --region us-west-2 --parameters file://microservice-parameters.json --capabilities CAPABILITY_IAM

{

"StackId": "arn:aws:cloudformation:us-west-2:656663974684:stack/gss-service-preprod-us-west-2/3e25fd90-2cc5-11ed-9c48-06b7297e8ded"

}

Setup Replication with Cloud Formation Template ¶

Setup RDS Replication ¶

aws cloudformation create-stack --stack-name prod-replica-rds-us-west-2 --template-url https://ha-gss-cisco-dist-bucket-us-west-2.s3.us-west-2.amazonaws.com/cloudformation/replica_rds.yaml --region us-west-2 --parameters file://replica-rds.json --capabilities CAPABILITY_IAM

Parameters value is queried from above cloud formation output.

[
                {
                    "ParameterKey": "DBPassword",
                    "ParameterValue": "Change1140"
                },
                {
                    "ParameterKey": "DBUsername",
                    "ParameterValue": "master"
                },
                {
                    "ParameterKey": "EnvironmentType",
                    "ParameterValue": "prod"
                },
                {
                    "ParameterKey": "InternalSrvcsSecurityGrp",
                    "ParameterValue": "sg-022d644019e89fa4e"
                },
                {
                    "ParameterKey": "PrivateSubnetIds",
                    "ParameterValue": "subnet-0af5b2e83ed7b0c0b,subnet-0aa1723c730c9dd15"
                },
                {
                    "ParameterKey": "SnapshotName",
                    "ParameterValue": "replica-automated-gssprod-2022-09-05-07-09"
                },
                {
                    "ParameterKey": "VPC",
                    "ParameterValue": "vpc-0b2a86de645a9c4b0"
        }
            ]

Create KMS Key ¶

Go to KMS → Customer managed keys to Create Key

Key administrators: hz-dev

Key users: gss-service-preprod-us-west-2-pipelin-pipelineRole-SFSX0XGZ0ZMW and prod-replica-launcher-us-west-2-replicaRole-HHM5RD4X7Q7

Setup Replication Launcher ¶

aws cloudformation create-stack --stack-name prod-replica-launcher-us-west-2 --template-url https://ha-gss-cisco-dist-bucket-us-west-2.s3.us-west-2.amazonaws.com/cloudformation/replica.yaml --region us-west-2 --parameters file://replica-launcher.json --capabilities CAPABILITY_IAM

[
{
"ParameterKey": "Env1CloudFilesBucket",
"ParameterValue": "gss-service-preprod-us-west-2-cloudfiles-s3bucket-voue01fde4hh"
},
{
"ParameterKey": "Env2KmsArn",
"ParameterValue": "arn:aws:kms:us-west-2:656663974684:key/5c0afd14-1835-42c7-923e-562d9c3e9e8e"
},
{
"ParameterKey": "Env2MicroservicePipeline",
"ParameterValue": "gss-service-preprod-us-west-2-pipeline-17LY2YUFJ8EO4-microserviceDeployPipeline-9ZPM3ZDWQCBF"
},
{
"ParameterKey": "Env2RepositoryBucket",
"ParameterValue": "ha-gss-cisco-dist-bucket-us-west-2"
},
{
"ParameterKey": "Environment1Type",
"ParameterValue": "prod"
},
{
"ParameterKey": "Environment1Type",
"ParameterValue": "stage"
},
{
"ParameterKey": "Env1CloudFilesReplicaBucket",
"ParameterValue": "gss-service-prod-cloudfiles-replica-01"
},
{
"ParameterKey": "Env2WebPipeline",
"ParameterValue": ""
}
]

Create Simple Queue Service ¶

Create Message Queue: preprod-message

Expand Instance Role Permissions policies ¶

If your instances have issues to get some AWS services, you can go to IAM Role and search Instance role, such as gss-service-preprod-us-west-2-ebInstanceRole-1PMXW2YKLGTI6 and expand its policies

such as AmazonSQSFullAccess

Verify ¶

Health Check ¶

{EB VIP}/ping

such as https://gss-micr-ksreebmqd4h6.eba-mwtifh48.us-west-2.elasticbeanstalk.com/ping

Service Check ¶

{EB VIP}/customer/dashServices/891

https://gss-micr-ksreebmqd4h6.eba-mwtifh48.us-west-2.elasticbeanstalk.com/customer/dashServices/891