mbarneyjr

AWSTemplateFormatVersion: '2010-09-09'
Description: Static site hosted with Amplify Console


Parameters:
  Domain:
    Type: String
    Description: Domain name to host application
    Default: ''
  ApplicationName:

mbarneyjr

Keybase proof

I hereby claim:

• I am mbarneyjr on github.
• I am mbarneyjr (https://keybase.io/mbarneyjr) on keybase.
• I have a public key whose fingerprint is BAD3 7BE1 A51B 3DF2 85FA 38EA 9BFE 4922 CD40 FD17

To claim this, I am signing this object:

mbarneyjr

export $(aws sts assume-role --role-arn arn:aws:iam::$TARGET_ACCOUNT_ID:role/ci-access --role-session-name ci --output text --query "[['AWS_ACCESS_KEY_ID',Credentials.AccessKeyId],['AWS_SECRET_ACCESS_KEY',Credentials.SecretAccessKey],['AWS_SESSION_TOKEN',Credentials.SessionToken]][*].join(\`=\`,@)")

mbarneyjr

AWSTemplateFormatVersion: '2010-09-09'
Parameters:
  CreateBucket:
    Type: String
Conditions:
  ShouldCreateBucket: !Equals [ !Ref CreateBucket, 'yes' ]
Resources:
  Bucket:
    Condition: ShouldCreateBucket
    Type: AWS::S3::Bucket

mbarneyjr

What makes us-east-1 special?

Account:

• Root user login is tied to us-east-1 (during a us-east-1 outage, root user logins were broken) link

CloudFront:

• ACM certs must exist in us-east-1 for CloudFront to use them link
• Lambda functions used for Lambda@Edge must be deployed in us-east-1 link
• Control plane is only available in us-east-1 link

mbarneyjr

import forge from "node-forge";
import crypto, { randomUUID } from "crypto";
import { existsSync, mkdirSync, writeFileSync } from "fs";

const pki = forge.pki;

function generateKeyPair() {
  const forgeKeypair = pki.rsa.generateKeyPair(4096);
  return {
    publicKey: pki.publicKeyToPem(forgeKeypair.publicKey),