{"id":18524526,"url":"https://github.com/stelligent/developer-sandboxes","last_synced_at":"2025-07-24T11:09:04.254Z","repository":{"id":145835099,"uuid":"255676562","full_name":"stelligent/developer-sandboxes","owner":"stelligent","description":"Using Access Based Access Controls (Tags) in AWS to create Developer Sandboxes for EC2.","archived":false,"fork":false,"pushed_at":"2020-05-07T23:27:44.000Z","size":18,"stargazers_count":4,"open_issues_count":0,"forks_count":4,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-04-10T04:11:20.472Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stelligent.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2020-04-14T17:23:19.000Z","updated_at":"2023-01-30T19:32:36.000Z","dependencies_parsed_at":null,"dependency_job_id":"f9201694-83cb-411c-acc2-b580c87b71a1","html_url":"https://github.com/stelligent/developer-sandboxes","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/stelligent/developer-sandboxes","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Fdeveloper-sandboxes","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Fdeveloper-sandboxes/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Fdeveloper-sandboxes/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Fdeveloper-sandboxes/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stelligent","download_url":"https://codeload.github.com/stelligent/developer-sandboxes/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stelligent%2Fdeveloper-sandboxes/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266831279,"owners_count":23991471,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-24T02:00:09.469Z","response_time":99,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-06T17:42:14.900Z","updated_at":"2025-07-24T11:09:04.206Z","avatar_url":"https://github.com/stelligent.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"\n# Building Developer Sandboxes with Tags\n\nDemonstrates three solutions for building Developer Sandboxes using tags on AWS using Attribute based Access Control(ABAC).\n\n## Proof of Concept for each Solution\n\n 1. Project Based EC2 Access\n 1. Individual Access Control\n 1. Highly Flexible and Granular Access Control\n\n### Installing tools to Deploy proof of concept stacks\n\nRequirements\n\n 1. Install aws-cdk: `npm install -g aws-cdk` or `brew install aws-cdk`\n 1. Install aws-vault and add your administrator. `brew install aws-vault` or other install methods\n 1. [Setup your CDK project requirements](#setup-aws-cdk)\n 1. Finally, before deploying you need to configure your **account** and **region** values in the `app.py` file. The default region is set to `us-east-2`, and your AWS account environment can be set with an variable: `export CDK_DEFAULT_ACCOUNT=01234567890`\n 1. Now you are ready to proceed to **Deploy a Solution**\n\n### Deploy a Solution\n\nPre-flight check.\n`aws-vault exec \u003cYour Admin User\u003e -- cdk synth \"solution-1*\"`\n\nBecause our CDK app has multiple stacks, we either need to specify the stack name(s) or use a wildcard.\n\n`aws-vault exec \u003cYour Admin User\u003e -- cdk deploy \"solution-1*\"`\n\nDeploy All 3 Solutions:\n\n`aws-vault exec \u003cYour Admin User\u003e -- cdk deploy \"*\"`\n\nNote: When you deploy your region must have a default VPC. If needed, create a Default VPC.\n\n## Running Tests using aws-vault\n\nEach solution has it's own set of tests, you don't use your administrator account to run these tests. Instead you'll need to find the User created by the CloudFormation Stack. The Solution 1 username would be something like `solution-1-vahalla-projec-VahallaDeveloper4EA7C9DC-1QTP7AV1JSXPS`, which you can find under the Resources section in the CloudFormation Stack.\n\n 1. Find the Test User on the CloudFormation Stack\n 1. Create API keys for the \u003cSolution User Account\u003e that was created.\n 1. Add the User to `aws-vault`\n\nTest Solution 1\n`aws-vault exec \u003cvault profile name\u003e -- pytest tests/test_solution1_project_policy.py`\n\nTest Solution 2\n`aws-vault exec \u003cvault profile name\u003e -- pytest tests/test_solution2_username.py`\n\nTest Solution 3\n`aws-vault exec \u003cvault profile name\u003e -- pytest tests/test_solution3_flexible.py`\n\nNote: If you are using Mult-Factor Authentication (MFA) for your administrator accounts. You will need to edit your `.aws/config` profile you added to include your account MFA arn. AWS CDK does not support MFA\n\n```config\n[profile johnadmin]\nregion=us-east-2\nmfa_serial=arn:aws:iam::012345678901:mfa/john.doe.administrator\n```\n\n### Setup AWS CDK\n\nThis project is set up like a standard Python project.  The initialization\nprocess also creates a virtualenv within this project, stored under the .env\ndirectory.  To create the virtualenv it assumes that there is a `python3`\n(or `python` for Windows) executable in your path with access to the `venv`\npackage. If for any reason the automatic creation of the virtualenv fails,\nyou can create the virtualenv manually.\n\nTo manually create a virtualenv on MacOS and Linux:\n\n```bash\npython3 -m venv .env\n```\n\nAfter the init process completes and the virtualenv is created, you can use the following\nstep to activate your virtualenv.\n\n```bash\nsource .env/bin/activate\n```\n\nIf you are a Windows platform, you would activate the virtualenv like this:\n\n```Windows\n% .env\\Scripts\\activate.bat\n```\n\nOnce the virtualenv is activated, you can install the required dependencies.\n\n```bash\npip install -r requirements.txt\n```\n\nAt this point you can now synthesize the CloudFormation template for this code.\n\n```bash\ncdk synth\n```\n\nTo add additional dependencies, for example other CDK libraries, just add\nthem to your `setup.py` file and rerun the `pip install -r requirements.txt`\ncommand.\n\n### Useful commands\n\n* `cdk ls`          list all stacks in the app\n* `cdk synth`       emits the synthesized CloudFormation template\n* `cdk deploy`      deploy this stack to your default AWS account/region\n* `cdk docs`        open CDK documentation\n\n### Implementation Details\n\nEach policy in dev-sandbox/policies/sandbox.py has a permission section labeled `sid = \"PermissionsForRunningTestsOnly\"`\n\nLimitations of the Proof of Concept policies:\n\n* Users are not able to create security groups; only existing Security groups can be used.\n* No restrictions on AMI usage\n* No restrictions on EBS volumes creation\n* User's don't have the ability to create Key Pairs for ssh access.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstelligent%2Fdeveloper-sandboxes","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstelligent%2Fdeveloper-sandboxes","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstelligent%2Fdeveloper-sandboxes/lists"}