Nested Knowledge

Changes to the Cloud Environment include:

• Provisioning new compute & storage resources
• Updating configurations & base images for compute & storage resources
• Updating Virtual Private Cloud & Security Group rules
• Provisioning new subnet IPs
• Modifying DNS records
• Updating TSL certificates

All changes are subject to:

• A change to deployment, architecture & cloud environemnt documentation in the codebase
• A review of the methodology and documented changes
  • The developer requesting changes must explain any risks associated with the change, mitigations, and advance testing methods that may be used.
• Providing a full audit log of actions taken upon deployment
• Verification via manual testing, access & network logging, load testing, etc. as appropriate by the release engineer.

Only release engineers are provided access to the Cloud Environment via IAM. Release engineer accounts have minimal necessary authorizations to make environmental changes and run standard deployments; only the technical lead of NK has administrator level access. Release engineers may only execute changes, after review. Access to the Cloud Environment itself is enabled by SSH keys. The NK technical lead may grant, revoke, or refresh these keys as needed during personel additions, removals, and potential leaks.

All Nested Knowledge developers with production access (release engineers) receive at minimum AWS Cloud Practitioner certification. New release engineers are supervised during their first 5 deployments or Cloud Environment modifications.

All Employees and Contractors who access Nested Knowledge’s information systems will be provided with and required to review the Cloud-Related Access Policy.