add project template

[philvarner]

Related issue(s)

• n/a

Proposed Changes

1. Add deploy project template to this repo, with detailed usage instructions.

Testing

This change was validated by the following observations:

1. n/a

Checklist

• I have deployed and validated this change
• Changelog
  • I have added my changes to the changelog
  • No changelog entry is necessary
• README migration
  • I have added any migration steps to the Readme
  • No migration is necessary

[hectormachin]

Suggested change

	- "arn:aws:iam::433175837143:root"
	- !Join
	- ":"
	-
	- "arn:aws:iam:"
	- !Ref GitLabRunnerAWSAccountNumber
	- "root"

[hectormachin]

Suggested change

	Default: appFilmDropDeployPolicy
	Default: appFilmDropDeployPolicy
	GitLabRunnerAWSAccountNumber:
	Type: String

[hectormachin]

Suggested change

	You can create a CloudFormation Stack from these templates with the
	following command (GitLab example shown), The Terraform state S3 Bucket name
	(discussed later) must be globally unique, so it is recommended to use where the value
	passed for `TerraformStateBucketName` is a unique bucket name based on the template
	`filmdrop-{project_name}-{region}-terraform-state-{random_string}`:
	```shell
	aws cloudformation deploy --stack-name "appFilmDropDeployRoleBootstrap" \
	--template-file bootstrap/gitlab_deploy_role_cfn.yml \
	--capabilities=CAPABILITY_NAMED_IAM \
	--parameter-overrides TerraformStateBucketName=filmdrop-stingray-us-west-2-terraform-state-20240515
	```
	You can create a CloudFormation Stack from these templates with the
	following command (GitLab example shown), the GitLabRunner AWS Account Number
	is needed to authorize the GitLab runner to assume the appFilmDropDeployRole:
	```shell
	aws cloudformation deploy --stack-name "appFilmDropDeployRoleBootstrap" \
	--template-file bootstrap/gitlab_deploy_role_cfn.yml \
	--capabilities=CAPABILITY_NAMED_IAM \
	--parameter-overrides GitLabRunnerAWSAccountNumber=123456789123

[hectormachin]

Suggested change

	Terraform stores the state of the deployment in a managed state file. When deploying via CI
	to shared environments, this state file must be stored somewhere non-local, so we use
	S3. This sets up an S3+DynamoDB Terraform backend to store this state. This
	should be created once per AWS Account + Region.
	Terraform stores the state of the deployment in a managed state file. When deploying via CI
	to shared environments, this state file must be stored somewhere non-local, so we use
	S3. This sets up an S3+DynamoDB Terraform backend to store this state. This
	should be created once per AWS Account + Region. The Terraform state S3 Bucket name
	must be globally unique, so it is recommended to use where the value
	passed for `TerraformStateBucketName` is a unique bucket name based on the template
	`filmdrop-{project_name}-{region}-terraform-state-{random_string}`:

[jkeifer]

You could just aws iam create-service-linked-role --aws-service-name opensearchservice.amazonaws.com?

[jkeifer]

I found I also had to aws iam create-service-linked-role --aws-service-name wafv2.amazonaws.com to make something using the WAF happy.

[jkeifer]

This file doesn't seem to exist. I worked out that the info was in the deploy.md file in the repo root, but it threw me when I couldn't find bootstrap instructions in the copied project.

[jkeifer]

Aren't the stac-server lambda zips included in the terraform module, and thus this build step is just duplication? I'd argue we shouldn't be including the zips in the terraform module source, but also think we should have a build step that does pull these down into a build artifact of the whole module so users don't have to worry about any of this. Especially as we add more lambdas to build, i.e., cirrus.