Skip to main content

Kickoff checklist

Everything from this module on one page. Copy it into the project repo as KICKOFF.md, tick items as you finish them, and walk through it with the project lead at the end of week two. Each heading links to the page with the steps.

1. Ownership and access​

  • OWNERSHIP.md filled in and signed off by the client.
  • Accounts that sell or receive money are in the client's legal entity.
  • Team mailboxes exist.

2. Long lead-time accounts​

  • Legal entity details document complete.
  • D-U-N-S confirmed or requested.
  • Apple organisation enrolment submitted.
  • Google Play organisation account submitted.
  • Merchant KYC started; legal pages live.

3. GitHub organisation​

  • Team plan, name checked, 2FA required, base permission "No permission".
  • Teams: admins, developers, read-only.
  • Secret scanning, push protection, Dependabot on.
  • Repos named <product>-<component>, or the client's documented scheme.
  • Squash only, auto-delete branches, rulesets on main, staging, dev.

4. AWS organisation​

  • Management account: root MFA, budget alarm.
  • Workloads, Shared, Sandbox OUs; dev, staging, prod, shared, sandbox accounts.
  • Identity Center with MFA; everyone signed in with aws sso login.
  • CloudTrail, GuardDuty, S3 Block Public Access, SCPs.
  • Terraform state bucket per account; quota requests sent.

5. Domain, DNS and certificates​

  • Existing records copied; registrar points at Route 53.
  • dev and staging zones delegated.
  • Certificates issued in the main region and us-east-1.

6. First repo and pipeline​

  • Service from the template, no template names left.
  • Secrets in SSM.
  • dev-v-0.1.0 deployed; /health returns 200 on dev.

7. Services​

  • Sentry: a test error arrived with a readable trace.
  • Email: a test email passes SPF, DKIM, DMARC; prod has production access.
  • Monitoring: alarms tested; uptime check on.
  • Push: test push on a real iPhone and Android phone.
  • Crashlytics: test crash arrived with readable frames.
  • Analytics: event plan in repo; consent gating works.
  • AI providers: spend limits set; every key tested.

Security baseline​

  • Everyone has MFA everywhere; no IAM users for people.
  • No secrets in any repo, remote URL or app bundle.
  • The Security checklist is started.
Last updated on