Managing Accounts Across AWS Partitions
summary
Salesforce extends Spinnaker Cloud Driver so one Spinnaker instance manages Target accounts across AWS partitions (Commercial, GovCloud, China) despite AWS forbidding cross-partition assume-role. Changes add multiple managing account profiles, a modified region provider, a feature flag use managing account profile, and require full ARN for assume role plus optional FIPS endpoints configuration. Implementation targets AWS Java SDK v1, adds logging, and enables EKS clusters in other partitions via kubeconfig; result: single-instance deployments across partitions, lowering operational cost and complexity.
AI-written summary · about
chapters (10)
- 0:00Introduction to talk
- 1:04Understanding AWS partitions
- 2:51Managing account credentials in Spinnaker
- 5:18Cross-partition role assumptions
- 7:23Configuring multiple profiles
- 9:09Spinnaker configuration changes
- 10:10Using FIPS endpoints in GovCloud
- 12:58Kubernetes clusters across partitions
- 13:40Upstream contributions to Spinnaker
- 14:45Q&A session
related talks
29mScaling Spinnaker for multi-region multi-cloud SaaS deployments
44mSpinnaker on AWS: A State of the Union
32mBuilding an Enterprise Grade Multi Account AWS Environment
27mSpinnaker at Salesforce: Enterprise-Level Multi-Substrate Continuous Delivery and Release Management
21mDynamic Account Management Framework for Spinnaker
57mBest practices for cloud governance at scale
51mBuilding a multi-account, multi-runtime service-oriented architecture
29mMulti Region Cloud Architecture for Data Residency Compliance