Skip to content

Commit 24b353a

Browse files
megan-bower4megan-bower4
authored
Merge pull request #566 from NHSDigital/release/2025-04-02
Release/2025 04 02
2 parents 2210a5a + f19e7e8 commit 24b353a

File tree

31 files changed

+673
-136
lines changed

31 files changed

+673
-136
lines changed

‎.github/workflows/_deploy.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ jobs:
4747
branch_name=${branch_name#*refs/tags/}
4848
echo "branch_name=${branch_name}" >> $GITHUB_OUTPUT
4949
50-
# BACKUPS_LOGIC (Source account needs layers building)
50+
# Source account for immutable backups needs layers building
5151
build:
5252
runs-on: [self-hosted, ci]
5353
needs: get-branch-from-workflow-file
@@ -62,14 +62,14 @@ jobs:
6262
save-to-cache: "true"
6363
restore-from-cache: "false"
6464
cache-suffix: ${{ env.CACHE_NAME }}
65-
- if: ${{ env.SCOPE != 'per_workspace' && inputs.account == 'dev'}}
65+
- if: ${{ env.SCOPE != 'per_workspace' && (inputs.account == 'prod' || inputs.account == 'dev') }}
6666
uses: ./.github/actions/make/
6767
with:
6868
command: build
6969
save-to-cache: "true"
7070
restore-from-cache: "false"
7171
cache-suffix: ${{ env.CACHE_NAME }}
72-
- if: ${{ env.SCOPE != 'per_workspace' && inputs.account != 'dev'}}
72+
- if: ${{ env.SCOPE != 'per_workspace' && (inputs.account != 'prod' && inputs.account != 'dev' )}}
7373
uses: ./.github/actions/make/
7474
with:
7575
command: poetry--update

‎CHANGELOG.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,9 @@
11
# Changelog
22

3+
## 2025-04-02
4+
- [PI-872] Enable backups in PROD
5+
- [PI-873] Update support policy to have 2 policies
6+
37
## 2025-04-01
48
- [PI-848] Add info box to swaager explaining prodID usage in non-prod envs
59
- [PI-870] Sonarcloud fixes

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2025.04.01
1+
2025.04.02

‎changelog/2025-04-02.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
- [PI-872] Enable backups in PROD
2+
- [PI-873] Update support policy to have 2 policies

‎infrastructure/terraform/per_account/backups/aws-backups.tf‎

Lines changed: 38 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,17 @@
1-
data "aws_secretsmanager_secret" "source_account_id" {
2-
name = "backups-source-account-id"
1+
data "aws_secretsmanager_secret" "source_account_id_prod" {
2+
name = "backups-source-account-id-prod"
33
}
44

5-
data "aws_secretsmanager_secret_version" "source_account_id" {
6-
secret_id = data.aws_secretsmanager_secret.source_account_id.id
5+
data "aws_secretsmanager_secret_version" "source_account_id_prod" {
6+
secret_id = data.aws_secretsmanager_secret.source_account_id_prod.id
7+
}
8+
9+
data "aws_secretsmanager_secret" "source_account_id_dev" {
10+
name = "backups-source-account-id-dev"
11+
}
12+
13+
data "aws_secretsmanager_secret_version" "source_account_id_dev" {
14+
secret_id = data.aws_secretsmanager_secret.source_account_id_dev.id
715
}
816

917

@@ -15,12 +23,33 @@ resource "aws_kms_key" "destination_backup_key" {
1523
enable_key_rotation = true
1624
}
1725

18-
module "destination" {
26+
module "destination_prod" {
27+
source = "../modules/aws-backup-destination"
28+
29+
source_account_name = "prod" # please note that the assigned value would be the prefix in aws_backup_vault.vault.name - change to dev/prod
30+
account_id = var.assume_account
31+
source_account_id = data.aws_secretsmanager_secret_version.source_account_id_prod.secret_string
32+
kms_key = aws_kms_key.destination_backup_key.arn
33+
enable_vault_protection = false
34+
}
35+
36+
###
37+
# Destination vault ARN output
38+
###
39+
40+
output "destination_vault_arn_prod" {
41+
# The ARN of the backup vault in the destination account is needed by
42+
# the source account to copy backups into it.
43+
value = module.destination_prod.vault_arn
44+
}
45+
46+
47+
module "destination_dev" {
1948
source = "../modules/aws-backup-destination"
2049

21-
source_account_name = "dev" # please note that the assigned value would be the prefix in aws_backup_vault.vault.name - change to dev/prod BACKUPS_LOGIC
50+
source_account_name = "dev" # please note that the assigned value would be the prefix in aws_backup_vault.vault.name - change to dev/prod
2251
account_id = var.assume_account
23-
source_account_id = data.aws_secretsmanager_secret_version.source_account_id.secret_string
52+
source_account_id = data.aws_secretsmanager_secret_version.source_account_id_dev.secret_string
2453
kms_key = aws_kms_key.destination_backup_key.arn
2554
enable_vault_protection = false
2655
}
@@ -29,8 +58,8 @@ module "destination" {
2958
# Destination vault ARN output
3059
###
3160

32-
output "destination_vault_arn" {
61+
output "destination_vault_arn_dev" {
3362
# The ARN of the backup vault in the destination account is needed by
3463
# the source account to copy backups into it.
35-
value = module.destination.vault_arn
64+
value = module.destination_dev.vault_arn
3665
}

‎infrastructure/terraform/per_account/backups/parameters/main.tf‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -28,8 +28,13 @@ JSON
2828
}
2929

3030

31-
resource "aws_secretsmanager_secret" "source-account-id-for-backup" {
32-
name = "${terraform.workspace}-source-account-id"
31+
resource "aws_secretsmanager_secret" "source-account-id-for-backup-prod" {
32+
name = "${terraform.workspace}-source-account-id-prod"
33+
description = "ID of the account we want to backup"
34+
}
35+
36+
resource "aws_secretsmanager_secret" "source-account-id-for-backup-dev" {
37+
name = "${terraform.workspace}-source-account-id-dev"
3338
description = "ID of the account we want to backup"
3439
}
3540

‎infrastructure/terraform/per_account/dev/aws-backups.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,3 @@
1-
# BACKUPS_LOGIC
21
data "aws_secretsmanager_secret" "destination_vault_arn" {
32
name = "destination_vault_arn"
43
}

‎infrastructure/terraform/per_account/dev/main.tf‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,7 +96,6 @@ resource "aws_route53_zone" "dev-ns" {
9696
name = "api.cpm.dev.national.nhs.uk"
9797
}
9898

99-
# BACKUPS_LOGIC
10099
module "layers" {
101100
for_each = toset(var.layers)
102101
source = "../../modules/api_worker/api_layer"
@@ -106,7 +105,6 @@ module "layers" {
106105
source_path = "${path.module}/../../../../src/layers/${each.key}/dist/${each.key}.zip"
107106
}
108107

109-
# BACKUPS_LOGIC
110108
module "third_party_layers" {
111109
for_each = toset(var.third_party_layers)
112110
source = "../../modules/api_worker/api_layer"

‎infrastructure/terraform/per_account/dev/parameters/main.tf‎

Lines changed: 2 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -55,8 +55,8 @@ resource "aws_secretsmanager_secret" "ldap-changelog-password" {
5555
name = "${terraform.workspace}-ldap-changelog-password"
5656
}
5757

58-
resource "aws_secretsmanager_secret" "etl_notify_slack_webhook_url" {
59-
name = "${terraform.workspace}--etl-notify-slack-webhook-url"
58+
resource "aws_secretsmanager_secret" "notify_slack_webhook_url" {
59+
name = "${terraform.workspace}-notify-slack-webhook-url"
6060
}
6161

6262
resource "aws_secretsmanager_secret" "apigee-app-client-info" {
@@ -67,12 +67,10 @@ resource "aws_secretsmanager_secret" "external-id" {
6767
name = "${terraform.workspace}-external-id"
6868
}
6969

70-
# BACKUPS_LOGIC
7170
resource "aws_secretsmanager_secret" "destination_vault_arn" {
7271
name = "destination_vault_arn"
7372
}
7473

75-
# BACKUPS_LOGIC
7674
resource "aws_secretsmanager_secret" "destination_account_id" {
7775
name = "destination_account_id"
7876
}

‎infrastructure/terraform/per_account/dev/parameters/vars.tf‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,12 +30,10 @@ variable "workspace_type" {
3030
default = "PERSISTENT"
3131
}
3232

33-
# BACKUPS_LOGIC
3433
variable "layers" {
3534
type = list(string)
3635
}
3736

38-
# BACKUPS_LOGIC
3937
variable "third_party_layers" {
4038
type = list(string)
4139
}

0 commit comments

Comments
 (0)