Gunasekara and Martin shared that the team desired to maintain the same Terraform modules for deploying in their commercial and GovCloud accounts. Commercial accounts are prefixed with arn:aws whereas GovCloud is prefixed with arn:aws-us-gov. personnel.ĪWS ARNs are different between commercial and GovCloud accounts. That account is also only accessed by U.S.

In order to have public DNS they stood up a commercial AWS account to house the public GovSlack DNS records. Gunasekara and Martin note that the lack of Route 53 public zones in particular caused some challenges. They created two distinct AWS organizations within GovCloud with an identical, duplicated set of child accounts for each of their dev and prod environments.ĪWS GovCloud does not possess the same service set as the AWS commercial regions do. To achieve isolation between the accounts, Gunasekara and Martin share that they 'have approached the build out using a full shared-nothing paradigm, which enables the environments to operate in completely different AWS organizations'.

This allows development teams to deploy and test their applications within a GovCloud environment before handing them over to the GovSlack team to deploy into the more restricted 'GovProd' account. persons, the 'GovDev' account is more relaxed as it does not contain any end-user data. While the 'GovProd' account is locked to only U.S. To simplify their setup at Slack, Gunasekara and Martin describe an approach of creating 'GovDev' and 'GovProd' accounts. persons to manage and access root account keys. Gunasekara and Martin note that one of the first challenges is that 'only US persons would be authorized to the production environment' as this is a core requirement of FedRAMP High. They shared challenges in adapting to unsupported services, account creation, and account isolation.Īs described by AWS, the GovCloud US region is 'n isolated AWS region designed to host sensitive data and regulated workloads in the cloud'. Archie Gunasekara, staff software engineer at Slack, and Andrew Martin, staff software engineer at Slack, recently shared their learnings in building GovSlack, an instance of Slack running on the AWS GovCloud region.

Slack on aws