Guidance on adding new functionality to the Application app

[ranjith-aws]

Created by Chris Fregly
Moved from Issues to discussion.
Issue: #50

Is there any guidance on how to add new functionality to the Application?

Client-side

• Add angular routes (_nav.js, app.routing.js, create new submodule.routing.js)
• invalidate CloudFront cache
• copy dist/ directory to S3 bucket with "appbucket" in the name (use no-copy option to avoid the need to perform the invalidation)
• invalidate CloudFront cache
• update clients/Application/src/environments/environment*.ts (change logos, etc)

Server-side

• update buildspec.yaml with foo-service.yaml
• create a new foo-service.yaml
• add new service to shared-services/TenantRegistrationService
• add new resources in tenant-stack-master.yaml which references the repo URI's
• add new K8s Service
• update Ingress

References
Reinvent 2021 Talk: Amazon EKS SaaS deep dive: A multi-tenant EKS SaaS solution

[thecount1986]

This is very helpful. We are working on an MVP using vnext as a starting point for our solution.

1. Do you have any recommendations for on-prem solution or hybrid solution of this architecture? I was looking into Outposts vs EKS anywhere.
2. Another problem that we are looking at is how to create custom business permissions that are not necessarily tied to an AWS resource. We are building custom roles and a permission module in the user management service that should allow an Admin to create new roles(Cognito groups) and new permissions. The issue that we have now is that permissions are policies that are usually tied to access or actions on AWS resources. Like access to S3 or read access to Dynamo etc. Is there any way that we can create specific permissions inside the roles that are not related to AWS resources? For example, we want to hide modules or show them based on the user role and maybe give partial access to a module. We went with having a database to store those custom permissions.

[ranjith-aws]

That is great to hear @thecount1986. We are happy that you have been able to leverage the solution as a starting point.

1. Although I haven't personally tried it, there is no reason why this solution wouldn't work on either of those services. EKS Anywhere especially uses the same EKS Distro that we used in our example here on the cloud. But I am going to take this as an item that we will explore in the upcoming days/early next year, and see if we can run this solution on EKS Anywhere or what it would take to do that. If you are doing this before that, would love to know the results/outcome.

[ranjith-aws]

2. Looks like you are looking to build some kind of an authorization module where the users/identities are not dependent on the AWS services/resources. There are Kubernetes solutions like Open Policy Agent (OPA) Or Kyverno, but I would recommend to check out a new service that was released just this re:Invent called Amazon Verified Permissions https://aws.amazon.com/verified-permissions/, which I believe will help with what you are looking for here. Curious to know if that would work for your use case.

[thecount1986]

I was creating the Roles, Permissions table in DynamoDB and adding endpoints to the User Management Service to add fined grained permissions when you sent me this. It seems to be in preview mode and only accessible through an application. I did applied. Is there any other way to get in contact with the team behind that service for a faster turn around?

[ranjith-aws]

We might actually have some connections with that team. Let me check and will get back to you.