> For the complete documentation index, see [llms.txt](https://den.gitbook.io/developerplaybook/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://den.gitbook.io/developerplaybook/development-environment/accounts-aws-gcp-circleci.md).

# Accounts (AWS, GCP, CircleCI)

## Getting Started with AWS

### Signup for an [AWS](https://aws.amazon.com) account

### Create an IAM role for your use cases e.g. serverless-admin

You don't want to give the serverless-admin access to all feature of aws. Therefore you create a new IAM user that only has the rights a serverless developer needs e.g. access to AWS Lambda, Dynamodb, S3, API Gateway, CloudDeployment and Logs. You use this user for the AWS CLI and the Serverless framework.

![Go to IAM](https://412027953-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LBulIh9Wa6TPIk4F7x5%2F-LC-B9liXdgx9O4gyjyU%2F-LC-BT1P07rkfeAgAJEt%2Fscreen-shot-2018-01-20-at-22.43.56.png?alt=media\&token=52a51b1b-a1bb-49d2-a1a7-335327e9cb2a)

![Create new user](https://412027953-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LBulIh9Wa6TPIk4F7x5%2F-LC-B9liXdgx9O4gyjyU%2F-LC-BpeQVaRK2XbfhyhZ%2Fcreate-new-iam-user.png?alt=media\&token=79613570-782f-4927-8de1-aca9531bed32)

![Give it a name and select progammatic access and then next](https://412027953-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LBulIh9Wa6TPIk4F7x5%2F-LC-EG2Op9rdyoM55Lmn%2F-LC-EKR3EHR5nDMhEDwA%2Fcreate-new-iam-user.png?alt=media\&token=2f147a35-9a18-41f5-99e1-203093b9e624)

![Create a group with the permissions for api gateway, aws lambda and deploy](https://412027953-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LBulIh9Wa6TPIk4F7x5%2F-LC3w6IaYX6BkGANRcmb%2F-LC3woiZaLstAIeYIGeA%2Fcreare-iam-role.png?alt=media\&token=006da2ac-7f38-4603-9597-818e0a37f484)

![](https://412027953-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LBulIh9Wa6TPIk4F7x5%2F-LC3w6IaYX6BkGANRcmb%2F-LC3x6m9vgPlr24tTXgs%2Fcreate-iam-role-2.png?alt=media\&token=be04768b-b831-4243-9ce3-43b270751cbf)

![](https://412027953-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LBulIh9Wa6TPIk4F7x5%2F-LC3w6IaYX6BkGANRcmb%2F-LC3xBr7wE2m9P-p1Bf8%2Fcreate-group.png?alt=media\&token=3ea15668-6991-4038-ad76-04131f646171)

![](https://412027953-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LBulIh9Wa6TPIk4F7x5%2F-LC3w6IaYX6BkGANRcmb%2F-LC3xHVOBfW0be84L76h%2Fcreate-iam-role-3.png?alt=media\&token=367a9428-bbef-4d98-af28-510726b59b59)

####

![Overview of the permissions of the user:](https://412027953-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LBulIh9Wa6TPIk4F7x5%2F-LC3w6IaYX6BkGANRcmb%2F-LC3xbGEEz0EJKhN2nRy%2Fserverless-admin-iam-rights.png?alt=media\&token=db030f48-7368-44dc-aca8-076ec0902a8a)

![Create user (with group serverless-admin)](https://412027953-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LBulIh9Wa6TPIk4F7x5%2F-LC3w6IaYX6BkGANRcmb%2F-LC3xhYesea-fMTP60-D%2Fcreate-iam-role-4.png?alt=media\&token=9684bf00-779e-42e5-aa05-0cfaaefb2ab0)

![Save Access key id and secret access key:](https://412027953-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LBulIh9Wa6TPIk4F7x5%2F-LC3w6IaYX6BkGANRcmb%2F-LC3xvGU2HLhDKdrkFa8%2Fiam-role-credentials.png?alt=media\&token=330b7cd1-04de-4990-b807-396dbdf1f606)

![Never show this key in public or check it into version control. That's why I now go to user section and delete it and create a new one:](https://412027953-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LBulIh9Wa6TPIk4F7x5%2F-LC3w6IaYX6BkGANRcmb%2F-LC3y15z3RCGtXllwZts%2Fchange-iam-user-credentials.png?alt=media\&token=b80f4943-0fb9-479f-adf5-ad7ee2f09abf)

More infos on the required permissions:

{% embed url="<https://www.bountysource.com/issues/35584735-narrowing-the-serverless-iam-deployment-policy>" %}

```javascript
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "cloudformation:CreateStack",
                "cloudformation:CreateUploadBucket",
                "cloudformation:DeleteStack",
                "cloudformation:DescribeStackEvents",
                "cloudformation:DescribeStackResource",
                "cloudformation:DescribeStackResources",
                "cloudformation:UpdateStack",
                "cloudformation:DescribeStacks",
                "cloudformation:ValidateTemplate"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:GetObjectVersion",
                "s3:PutObject",
                "s3:DeleteObject",
                "s3:CreateBucket",
                "s3:DeleteBucket",
                "s3:ListBucket",
                "s3:ListBucketVersions",
                "s3:GetBucketVersioning",
                "s3:PutBucketVersioning",
                "s3:GetBucketLocation"
            ],
            "Resource": [
                "arn:aws:s3:::*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "lambda:CreateFunction",
                "lambda:PublishVersion",
                "lambda:GetFunction",
                "lambda:GetFunctionConfiguration",
                "lambda:DeleteFunction",
                "lambda:ListVersionsByFunction"
            ],
            "Resource": [
                "arn:aws:lambda:eu-central-1:*:function:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "iam:CreateRole",
                "iam:DeleteRole",
                "iam:GetRole",
                "iam:PassRole",
                "iam:DeleteRolePolicy",
                "iam:PutRolePolicy"
            ],
            "Resource": [
                "arn:aws:iam::*:role/*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:DescribeLogStreams",
                "logs:FilterLogEvents"
            ],
            "Resource": [
                "*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "cloudwatch:GetMetricStatistics"
            ],
            "Resource": [
                "*"
            ]
        }
    ]
}
```

### Install AWS CLI

```bash
sudo pip install awscli
# use the access key id and secret access ky as describe above
aws configure
# AWS Access Key ID [None]: AKIAI44QH8DHBEXAMPLE
# AWS Secret Access Key [None]: je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY
# Default region name [None]: eu-central-1
# Default output format [None]:

# for the man pages do
aws configure help
```

Source: <https://docs.aws.amazon.com/de_de/cli/latest/userguide/cli-chap-getting-started.html>

#### Configure multiple Profiles:

```
vi ~/.aws/credentials
```

```
[default]
aws_access_key_id=XXX
aws_secret_access_key=XXX

[serverless-admin]
aws_access_key_id=AKIAI44QH8DHBEXAMPLE
aws_secret_access_key=je7MtGbClwBF/2Zp9Utk/h3yCo8nvbEXAMPLEKEY
```

Set the profile:

```
export AWS_PROFILE=serverless-admin
```

Source: <https://docs.aws.amazon.com/cli/latest/userguide/cli-multiple-profiles.html>

## Securely store your keys and secrets in your rsh file

You don't want to store your secrets in plain text in a file like `.rshrc`  therefore you can use lpass cli \[[github](https://github.com/lastpass/lastpass-cli) / [documentation](https://helpdesk.lastpass.com/lastpass-command-line-application/)] and store your secrets in your osx keychain and access them only by reference.

#### Installation

```bash
brew install lastpass-cli --with-pinentry
```

#### Set variables in lastpass

Just create a secret note within lastpass:

![](https://412027953-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LBulIh9Wa6TPIk4F7x5%2F-LC9ZllK0UYYdmgnoV6s%2F-LCA-zNK7tSalkj9-XIE%2Fadd-secret-to-lastpass.png?alt=media\&token=7ebcd90c-f5c3-4523-ab59-47cd5fcd8b27)

#### Login to lpass in the command line

```bash
# login to lastpass
# check first if I am allready loggedin and finded the "access-token" folder 
if [[ $(lpass ls) != *"access-token"* ]]; then
lpass login your@email.com
fi
```

#### Set environment variable (e.g. key\_id (username) and secret(password)

```bash
export AWS_ACCESS_KEY_ID=$(lpass show aws-serverless-devops --username)
export AWS_SECRET_ACCESS_KEY=$(lpass show aws-serverless-devops --password)
```

## Getting started with GCP

* [Setup Google Cloud Functions for Serverless](https://serverless.com/framework/docs/providers/google/guide/credentials/):
  * Create a Google Cloud Billing Account
  * Create a new Google Cloud Project
  * Enable the necessary APIs
  * Get credentials
  * For serverless: Update the `provider` config in `serverless.yml`

### Accessing files in lpass

```
lpass show xxx-dev-gcp --attach att-7942806310206912061-56085
```

### Setup an ecrypted folder and sync with google drive

```
/Users/den/Desktop/secret/xxx/key.json
lock-secret-files
unlock-secret-files
```