Initial Release

.github/CODEOWNERS

@@ -0,0 +1,3 @@
+# These owners will be the default owners for everything in the repo. Unless a later match takes precedence
+
+* @douglas-f ksnavely-cf

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,27 @@
+---
+name: Bug report
+about: Create a report to help us improve
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Describe the bug**
+A clear and concise description of what the bug is.
+
+**To Reproduce**
+Steps to reproduce the behavior:
+1. Go to '...'
+2. Click on '....'
+3. Scroll down to '....'
+4. See error
+
+**Expected behavior**
+A clear and concise description of what you expected to happen.
+
+**Screenshots**
+If applicable, add screenshots to help explain your problem.
+
+**Additional context**
+Add any other context about the problem here.

.github/ISSUE_TEMPLATE/enhancement-request.md

@@ -0,0 +1,20 @@
+---
+name: Enhancement request
+about: Suggest an idea for this project
+title: ''
+labels: ''
+assignees: ''
+
+---
+
+**Is your feature request related to a problem? Please describe.**
+A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+
+**Describe the solution you'd like**
+A clear and concise description of what you want to happen.
+
+**Describe alternatives you've considered**
+A clear and concise description of any alternative solutions or features you've considered.
+
+**Additional context**
+Add any other context or screenshots about the feature request here.

.github/workflows/org-checkov.yml

@@ -0,0 +1,12 @@
+name: Org Checkov
+on:
+    pull_request:
+      paths:
+        - '**.tf'
+      branches:
+        - main
+    workflow_call:
+
+jobs:
+  check-markdown:
+    uses: Coalfire-CF/Actions/.github/workflows/org-checkov.yml@main

.github/workflows/org-md-lint.yml

@@ -0,0 +1,12 @@
+name: Markdown Lint
+on:
+    pull_request:
+      paths:
+        - '**.md'
+      branches:
+        - main
+    workflow_call:
+
+jobs:
+  check-markdown:
+    uses: Coalfire-CF/Actions/.github/workflows/org-markdown-lint.yml@main

.github/workflows/org-release.yml

@@ -0,0 +1,11 @@
+name: Org Release
+on:
+    pull_request:
+        types:
+        - closed
+        branches:
+        - main
+
+jobs:
+  create-release:
+    uses: Coalfire-CF/Actions/.github/workflows/org-release.yml@main

.github/workflows/org-terraform-docs.yml

@@ -0,0 +1,8 @@
+name: Org Terraform Docs
+on:
+    pull_request:
+    workflow_call:
+
+jobs:
+  terraform-docs:
+    uses: Coalfire-CF/Actions/.github/workflows/org-terraform-docs.yml@main

.gitignore

@@ -0,0 +1,31 @@
+# Local .terraform directories
+**/.terraform/*
+.terraform.lock.hcl
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+.idea
+.idea/*
+.vscode
+.vscode/
+*.iml
+*.zip
+.DS_Store
+
+
+

CONTRIBUTING.md

@@ -0,0 +1,54 @@
+## Coalfire Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we, as contributors and project maintainers, pledge to make participation in our project and our community a harassment-free experience for everyone.
+
+## Our Values
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community. Our community reflects our company values:
+
+Respect: We believe in acknowledging the rights, beliefs, and perspectives of others.
+
+Excellence: We endeavor to adopt best practices in everything we do.
+
+Leadership: We encourage thought leadership and innovation.
+
+Integrity: We uphold the highest ethical standards in all our interactions.
+
+Teamwork: We believe in the power of working together to achieve our common goals.
+
+Enthusiasm: We approach every task with energy and eagerness.
+
+## Expected Behavior
+
+Demonstrate empathy and kindness toward other people.
+
+Be respectful of differing opinions, viewpoints, and experiences.
+
+Offer and gracefully accept constructive feedback.
+
+Show courtesy and respect in public and private communications.
+
+Avoid personal attacks directed toward other contributors.
+
+## Unacceptable Behavior
+
+Any form of discrimination and harassment is unacceptable. This includes but is not
+limited to; offensive comments related to gender, sexual orientation, race, religion, disability, physical appearance, or other protected categories.
+
+Public or private harassment, deliberate intimidation, violence, or threats of.
+
+Publishing others’ private information, such as a physical or email address, without their explicit permission.
+
+• The use of sexualized language or imagery and unwelcome sexual attention or advances.
+
+• Trolling, insulting/derogatory comments, and personal or political attacks.
+
+## Reporting & Enforcement
+
+We encourage all communities to resolve issues on their own whenever possible. If you are unable to resolve the matter for any reason, or if the behavior is threatening or harassing, report it. We are dedicated to providing an environment where participants feel welcome and safe. Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at <oss@coalfire.com>. All complaints will be reviewed and investigated promptly and fairly. Confidentiality will be maintained for the reporter of an incident.
+
+We will use our discretion in determining when and how we follow up with reported incidents.  Consequences of violating this code may include, but are not limited to, a temporary or permanent ban from project participation, removal of contributions, and reporting the incident to employers or legal authorities as appropriate.  
+
+This Code of Conduct is a living document and will evolve with the community. The project maintainers reserve the right to update this code as necessary. Any changes will be communicated to community members.

License.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2023 Coalfire Systems, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -0,0 +1,120 @@
+![Coalfire](coalfire_logo.png)
+
+## Coalfire AWS RAMPpak
+
+## Description
+Coalfire created reference architecture for FedRAMP AWS builds. This repository is used as a parent directory to deploy Coalfire-CF/`terraform-aws-<service>` modules.
+
+
+Learn more at [Coalfire OpenSource](https://coalfire.com/opensource).
+
+## Architecture
+
+![Coalfire-AWS-RAMPpak](Coalfire-AWS-RAMPpak.png)
+
+## Dependencies
+
+- AWS Account 
+- AWS CLI is installed
+
+## Resource List
+
+| Directory | Purpose |
+| --------- | ------- |
+| `aws/terraform/us-gov-west-1/management-account/day0` | Account Setup Terraform files |
+| `aws/terraform/us-gov-west-1/management-account/rds` | RDS Database Terraform files |
+| `aws/terraform/us-gov-west-1/global-vars.tf` | Global variables |
+| `aws/terraform/us-gov-west-1/networking` | Networking deployment Terraform files |
+| `aws/terraform/us-gov-west-1/org-creation` | AWS Organization Terraform files |
+| `aws/terraform/us-gov-west-1/org-onboarding` | AWS Organization Onboarding Terraform files |
+
+## Code Updates
+
+1. Update `global-vars.tf` in `aws/terraform/us-gov-west-1/global-vars.tf`
+2. Update `tstate.tf`  in each directory (when applicable). Example below:
+``` hcl
+terraform {
+  required_version = ">=1.5.0"
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = "~> 5.0"
+    }
+}
+  backend "s3" {
+    bucket         = "pak-us-gov-west-1-tf-state"
+    region         = "us-gov-west-1"
+    key            = "pak-us-gov-west-1-tfsetup.tfstate"
+    dynamodb_table = "pak-us-gov-west-1-state-lock"
+    encrypt        = true
+  }
+}
+```
+
+3. Update `remote-data.tf`in each directory (when applicable). Example below:
+``` hcl
+data "terraform_remote_state" "day0" {
+  backend = "s3"
+
+  config = {
+    bucket  = "${var.resource_prefix}-${var.aws_region}-tf-state"
+    region  = var.aws_region
+    key     = "${var.resource_prefix}-${var.aws_region}-tfsetup.tfstate"
+    profile = "pak-mgmt"
+  }
+}
+```
+3. Update `vars.tfvars` in each directory (when applicable).
+
+## Deployment Steps
+
+1. Log in with with AWS creds into AWS CLI. `aws configure'.
+2. Navigate to `aws/terraform/us-gov-west-1/management-account/day0` and run `terraform init` and `terraform plan`. If everything looks correct, then run `terraform apply`.
+3. Navigate to `aws/terraform/us-gov-west-1/org-creation` and run `terraform init` and `terraform plan`. If everything looks correct, then run `terraform apply`.
+4. Navigate to `aws/terraform/us-gov-west-1/org-onboarding` and run `terraform init` and `terraform plan`. If everything looks correct, then run `terraform apply`.
+5. Navigate to `aws/terraform/us-gov-west-1/networking` and run `terraform init` and `terraform plan`. If everything looks correct, then run `terraform apply`.
+6. Navigate to `aws/terraform/us-gov-west-1/management-account/bastion` and run `terraform init` and `terraform plan`. If everything looks correct, then run `terraform apply`.
+
+## Deployment Configurations
+
+- Ensure that the `vars.tfvars` file is never uploaded or committed to any public repository platform (e.g., GitHub, GitLab, Bitbucket, etc.). This file contains sensitive information and should be kept private.
+
+<!-- BEGIN_TF_DOCS -->
+## Requirements
+
+No requirements.
+
+## Providers
+
+No providers.
+
+## Modules
+
+No modules.
+
+## Resources
+
+No resources.
+
+## Inputs
+
+No inputs.
+
+## Outputs
+
+No outputs.
+<!-- END_TF_DOCS -->
+
+## Contributing
+
+If you're interested in contributing to our projects, please review the [Contributing Guidelines](CONTRIBUTING.md). And send an email to [our team](contributing@coalfire.com) to receive a copy of our CLA and start the onboarding process.
+
+
+## License
+
+[![License](https://img.shields.io/badge/license-MIT-blue.svg)](https://opensource.org/license/mit/)
+
+
+### Copyright
+
+Copyright © 2023 Coalfire Systems Inc.

aws/terraform/us-gov-west-1/global-vars.tf

@@ -0,0 +1,25 @@
+data "aws_caller_identity" "mgmt_account" {
+  # Get the management account ID
+  provider = aws.mgmt
+}
+
+variable "resource_prefix" {
+  type        = string
+  default     = "pak"
+  description = "A prefix that should be attached to the names of resources"
+}
+
+variable "default_aws_region" {
+  description = "The AWS region to create resources in"
+  type        = string
+  default     = "us-gov-west-1"
+}
+
+variable "global_tags" {
+  type = map(string)
+  default = {
+    managed_by    = "terraform"
+    backup_policy = "aws-backup-minimum-compliance"
+  }
+  description = "Tags to apply globally to all appropriate AWS resources (that have tagging functionality)"
+}