Overview
TalentIdPipeline-Infra-CDK is the foundational infrastructure layer for the entire SG Advanced Tech software estate. It defines the VPC that all cloud-hosted systems operate within, and the primary MongoDB EC2 instance used by the core estate. Without this infrastructure, no cloud-hosted system in the estate can run.Architecture
The diagram source is the draw.io file at
images/software/developer/estate/infra/talentidpipeline-infra-cdk/architecture.drawio. To change the diagram, edit that source in draw.io, re-export it as PNG to architecture.png in the same folder, and commit both.Key Facts
What It Provisions
TalentIdPipeline-Infra-CDK is an AWS CDK project (written in Python) that provisions:- A VPC used by all cloud-hosted systems in the estate, including SG-Infra
- A shared MongoDB EC2 instance used by TalentID:Coaching, TalentID:Global, GKL Platform and Telemetry
- Other complementary AWS infrastructure
This repo is defined in Python CDK rather than the preferred TypeScript stack. It was originally created for the TalentID platform by Nick from AWS and has since been adapted into the shared infrastructure layer for all systems.
Repositories
Systems That Depend On This
Every cloud-hosted system in the estate depends on this repo for the VPC:
Kart Programming is the only system with no dependency on this repo.
Detailed Documentation
Architecture and Deployment Pipeline
The CDK app, the self-mutating pipeline, the three stacks, and how a change reaches production.
Networking and Connectivity
The shared VPC, subnets, security groups and the private API Gateway endpoint.
Shared MongoDB Instance
The EC2-hosted MongoDB, its provisioning, TLS and credentials.
Backups and Disaster Recovery
Nightly backups, retention and the recovery picture.
Integration Surface and Configuration Contract
Buckets, IAM users, SNS topics and the SSM parameters other systems consume.
Security, Risks and Technical Debt
IAM posture, known risks and the SG-Infra migration direction.
Notes
- This is a legacy infrastructure pattern. SG-Infra is the target pattern for new and migrated systems going forward.
- Despite being legacy, this repo is not going away in the short term. It remains a hard dependency for the VPC across all systems, including SG-Infra itself.
- The shared MongoDB instance has no data isolation between TalentID:Coaching, TalentID:Global, GKL Platform and Telemetry at the infrastructure level.