Infrastructure on IGAAWI docs

aws configure sso

SSO session name (Recommended): saritasa/v2/administrators
SSO start URL [None]: https://saritasa.awsapps.com/start
SSO region [None]: us-west-2
SSO registration scopes [sso:account:access]:
Attempting to automatically open the SSO authorization page in your default browser.
If the browser does not open or you wish to use a different device to authorize this request, open the following URL:

https://device.sso.us-west-2.amazonaws.com/

Then enter the code:

LWGS-RVJX
There are 3 AWS accounts available to you.
Using the account ID 965067289393
There are 2 roles available to you.
Using the role name "saritasa-administrators-role"
CLI default client Region [None]: us-west-2
CLI default output format [None]: json
CLI profile name [saritasa-administrators-role-965067289393]: saritasa/v2/administrators

To use this profile, specify the profile name using --profile, as shown:

aws s3 ls --profile saritasa/v2/administrators

then modify your ~/aws/profile and change profile saritasa-administrators-role-965067289393 to match the following. Change it’s name saritasa/v2/administrators and include credential_process as shown below:

Terraform

Thu, 19 Mar 2026 00:00:00 +0000

Teragrunt

Entire implementation is implemented as terraform. In order to use it, make sure you have terragrunt installed as per tools requirements

🚀 Terraform repository: saritasa-nest/igaawi-infra-aws

➜ tree -d
.
├── bin
├── envs
│   ├── prod
│   │   ├── apps
│   │   │   ├── api-backend
│   │   │   └── frontend
│   │   ├── aws
│   │   │   ├── backups
│   │   │   ├── billing
│   │   │   ├── ecr
│   │   │   ├── eks
│   │   │   ├── elasticache
│   │   │   ├── guardduty
│   │   │   ├── notifications
│   │   │   ├── organizations
│   │   │   ├── rds
│   │   │   ├── route53
│   │   │   ├── ses
│   │   │   ├── sso
│   │   │   └── vpc
│   │   └── platforms
│   │       ├── airbyte
│   │       ├── docs
│   │       ├── github
│   │       ├── keycloak
│   │       ├── opsgenie
│   │       ├── rattic
│   │       ├── redash
│   │       ├── reportportal
│   │       └── sentry
│   ├── root
│   │   ├── aws
│   │   │   ├── organizations
│   │   │   └── sso
│   │   └── platforms
│   │       └── terraform-state
│   └── security
│       ├── aws
│       │   ├── chatbot
│       │   ├── health
│       │   ├── inspector
│       │   ├── organizations
│       │   └── sso
│       └── platforms
│           └── statuscake
├── modules
│   ├── aws
│   │   ├── health-forwarder
│   │   └── secret-manager
│   │       └── secret
│   ├── gcp
│   │   └── service-account
│   ├── sentry-project
│   └── sso
│       └── iam-assumable-role-with-saml
├── stacks
│   ├── apps
│   │   ├── api-backend
│   │   └── frontend
│   ├── aws
│   │   ├── backups
│   │   ├── billing
│   │   ├── ecr
│   │   ├── eks
│   │   ├── elasticache
│   │   ├── guardduty
│   │   ├── notifications
│   │   ├── organizations
│   │   ├── rds
│   │   ├── route53
│   │   ├── ses
│   │   ├── sso
│   │   └── vpc
│   ├── gcp
│   └── platforms
│       ├── airbyte
│       ├── docs
│       ├── github
│       ├── keycloak
│       ├── opsgenie
│       ├── rattic
│       ├── redash
│       ├── reportportal
│       ├── sentry
│       ├── statuscake
│       └── terraform-state
└── taskfiles

Important

apps contains terraform code for business apps deployed in the infra, such as api-backend, frontend,
modules contains terraform reusable modules used in stacks/apps,
stacks contains infrastructure specific code, i.e. EKS, ECR, SSO, Route53 etc.

Apps

aws-vault exec igaawi/sso/administrators

cd envs/prod/apps/api-backend
export ENV=prod
tg init
tg apply

If you want to see specific credentials generated inside the app you can do:

Backups

Thu, 19 Mar 2026 00:00:00 +0000

Data Backup and Recovery in the IGAAWI Infrastructure

S3 Buckets

The project uses S3 buckets for storing application data. The primary production bucket is:

Backend: igaawi-prod-api-backend-bucket

The bucket has versioning enabled and CORS configured for wiperinstall.rainx.com and api.wiperinstall.rainx.com. Public read access is configured for the public/* and web/* prefixes (AI models and 3D wiper models).

Note

S3 cross-region replication is currently disabled. The replication account is configured as the root account (113727184156) and can be enabled in terraform if needed (s3_enable_replication = true in envs/prod/apps/api-backend/prod.tfvars).

See more instruction in the official documentation #1 official documentation #2

CI/CD

Thu, 19 Mar 2026 00:00:00 +0000

⚙️ CI/CD Pipeline Overview

Our CI/CD pipeline is designed to provide a secure, automated, and efficient process for building and deploying applications in the IGAAWI infrastructure. Here’s how it works.

CI/CD Flow

graph LR;
    A[Git Commit] --> B[GitHub Webhook]
    B --> C[EventListener - Tekton]
    C --> D[Pipeline]
    D --> E[Build and Push]
    E --> F[Git Update]
    F --> G[Argo CD Sync]
    G --> H[Deployment]

🚀 GitOps in CI/CD: Tekton + Argo CD

In this project, we follow the GitOps methodology, where the Git repository acts as the single source of truth for both infrastructure and application configurations.

Gitops

Thu, 19 Mar 2026 00:00:00 +0000

Argocd password

You can obtain argocd admin password from stacks/eks outputs:

aws-vault exec igaawi/sso/administrators
cd stacks/eks
export ENV=prod
tg output --json | jq -r .argocd.value

{
  "password": "HIDDEN",
  "username": "admin"
}

then proceed to argocd

You can use taskfile argocd targets:

Command	Description
`argocd:aas`	turn on sync for the argocd app, task `argocd:aas -- apps backend`
`argocd:aau`	turn off sync for the argocd app, task `argocd:aau -- apps backend`

or you can use any argocd cli commands:

DNS

Tue, 14 Oct 2025 00:00:00 +0000

Managing the Domains

The project uses two primary domains:

wiperinstall.rainx.com — main domain for API, infrastructure services (ArgoCD, Tekton, Grafana)
wiperinstall.click — customer-facing frontend domain

DNS management is handled via Amazon Route53. This means that DNS configurations—such as A records, CNAMEs, and other record types—are handled and stored in hosted zones within Route53.

The name servers (NS records) provided by Route53 were configured in the domain registrar settings. This delegates DNS resolution control to AWS Route53.