Systems and methods for automated cloud provisioning
A method is disclosed for automating creation of an account to access to a plurality of cloud based platforms, comprising receiving an intake request; determining whether the account is requested on a first cloud platform or a second cloud platform; determining whether an environment is requested; in response to a determination that an environment is requested, creating a created environment; in response to a determination that an environment is not requested, associating an existing environment with the account; in response to a determination that an environment is requested and a determination that the account is requested on the first cloud platform, creating network handlers; creating a workspace and a repository; creating vault secrets; in response to a determination that the account is requested on the first cloud platform, and tagging at least one resource associated with the account with a resource tag.
1 . A computer implemented method for managing security policies and network configurations across multiple cloud-based accounts, the method comprising the steps of:
receiving a security policy update for an organization;
automatically generating, in response to the security policy update, event-driven triggers in a code repository;
applying, based on the event-driven triggers, the security policy update across multiple cloud-based accounts associated with the organization;
creating, for at least one of the cloud-based accounts, a private hosted zone in a virtual private cloud;
associating the private hosted zone with a shared service account, wherein the shared service account propagates domain name system (DNS) information for use by the virtual private cloud;
determining, based on intake input data, a tier designation for the at least one cloud-based account, wherein the tier designation is one of: sandbox, development, system integration testing (SIT), or production;
configuring the at least one cloud-based account based on the determined tier designation; and
updating an intake database with information relating to the security policy update, the DNS configuration, and the tier designation for the at least one cloud-based account.
2 . The method of claim 1 , further comprising providing a self-service portal for users to request cloud-based accounts.
3 . The method of claim 1 , wherein applying the security policy update comprises using a Continuous Integration and Continuous Deployment (CI/CD) pipeline to attach changes to Identity and Access Management roles without human intervention.
4 . The method of claim 1 , further comprising creating multiple workspaces associated with a single cloud-based account.
5 . The method of claim 1 , further comprising generating and sending a multi-factor authentication notification related to the at least one cloud-based account.
6 . The method of claim 1 , further comprising tagging resources associated with the at least one cloud-based account for billing and cost management purposes.
7 . The method of claim 1 , wherein the intake input data is received via a self-service portal accessible only within a local network.
8 . The method of claim 1 , further comprising looking up an application ID in an application replication database to determine whether the application ID is valid.
9 . The method of claim 1 , wherein the intake input data comprises data indicating that the account is one of a standard account, a sandbox account, and a custom account.
10 . The method of claim 1 , further comprising:
initializing a vault object;
creating a secrets engine;
initializing the secrets engine using the vault object;
creating a static single sign-on credential relating to the at least one cloud-based account;
creating a trust relationship between the single sign-on credential and the at least one cloud-based account; and
storing a key and value pair representing the single sign-on credential in a vault.
11 . The method of claim 1 , wherein the multiple cloud-based accounts comprise accounts on a first cloud-based platform and a second cloud-based platform.
12 . The method of claim 11 , wherein the first cloud-based platform is Amazon Web Services, and wherein the second cloud-based platform is Google Cloud Platform.
13 . The method of claim 12 , further comprising creating an Amazon Web Services Account using Account Vending Machine, and triggering Account Vending Machine using an event bus rule.
14 . The method of claim 12 , further comprising creating a Google Cloud Platform project by launching a vending process that combines scripts, credentials and variables to create the Google Cloud Platform project.
15 . The method of claim 1 , further comprising creating a distribution list for notification related to the at least one cloud-based account.
16 . The method of claim 1 , further comprising configuring logging to be stored in a centralized logging account associated with the at least one cloud-based account.
17 . The method of claim 1 , further comprising:
determining from role data whether an existing Active Directory group exists relating to the role data;
in response to a determination that an Active Directory group exists for the role data, associating the at least one cloud-based account with the existing Active Directory group; and
in response to a determination that an Active Directory does not exist for the role data, creating a created Active Directory group for the at least one cloud-based account according to the role data and associating the at least one cloud-based account with the created Active Directory group.
18 . The method of claim 1 , further comprising creating and sending a notification that the at least one cloud-based account has been created.
19 . The method of claim 1 , wherein the security policy update is applied without including a reference to specific cloud-based accounts.