Skip to content

Commit 4204d34

Browse files
megan-bower4megan-bower4
committed
feature/PI-872-enable_immutable_backups_on_prod Move backups source account from dev to prod
1 parent 00461af commit 4204d34

File tree

15 files changed

+54
-130
lines changed

15 files changed

+54
-130
lines changed

‎.github/workflows/_deploy.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -47,7 +47,7 @@ jobs:
4747
branch_name=${branch_name#*refs/tags/}
4848
echo "branch_name=${branch_name}" >> $GITHUB_OUTPUT
4949
50-
# BACKUPS_LOGIC (Source account needs layers building)
50+
# Source account for immutable backups needs layers building
5151
build:
5252
runs-on: [self-hosted, ci]
5353
needs: get-branch-from-workflow-file
@@ -62,14 +62,14 @@ jobs:
6262
save-to-cache: "true"
6363
restore-from-cache: "false"
6464
cache-suffix: ${{ env.CACHE_NAME }}
65-
- if: ${{ env.SCOPE != 'per_workspace' && inputs.account == 'dev'}}
65+
- if: ${{ env.SCOPE != 'per_workspace' && inputs.account == 'prod'}}
6666
uses: ./.github/actions/make/
6767
with:
6868
command: build
6969
save-to-cache: "true"
7070
restore-from-cache: "false"
7171
cache-suffix: ${{ env.CACHE_NAME }}
72-
- if: ${{ env.SCOPE != 'per_workspace' && inputs.account != 'dev'}}
72+
- if: ${{ env.SCOPE != 'per_workspace' && inputs.account != 'prod'}}
7373
uses: ./.github/actions/make/
7474
with:
7575
command: poetry--update

‎infrastructure/terraform/per_account/backups/aws-backups.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ resource "aws_kms_key" "destination_backup_key" {
1818
module "destination" {
1919
source = "../modules/aws-backup-destination"
2020

21-
source_account_name = "dev" # please note that the assigned value would be the prefix in aws_backup_vault.vault.name - change to dev/prod BACKUPS_LOGIC
21+
source_account_name = "prod" # please note that the assigned value would be the prefix in aws_backup_vault.vault.name - change to dev/prod
2222
account_id = var.assume_account
2323
source_account_id = data.aws_secretsmanager_secret_version.source_account_id.secret_string
2424
kms_key = aws_kms_key.destination_backup_key.arn

‎infrastructure/terraform/per_account/dev/main.tf‎

Lines changed: 0 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -95,23 +95,3 @@ resource "aws_s3_bucket_logging" "truststore_to_access_logs" {
9595
resource "aws_route53_zone" "dev-ns" {
9696
name = "api.cpm.dev.national.nhs.uk"
9797
}
98-
99-
# BACKUPS_LOGIC
100-
module "layers" {
101-
for_each = toset(var.layers)
102-
source = "../../modules/api_worker/api_layer"
103-
name = each.key
104-
python_version = var.python_version
105-
layer_name = "${local.project}--${replace(terraform.workspace, "_", "-")}--${replace(each.key, "_", "-")}"
106-
source_path = "${path.module}/../../../../src/layers/${each.key}/dist/${each.key}.zip"
107-
}
108-
109-
# BACKUPS_LOGIC
110-
module "third_party_layers" {
111-
for_each = toset(var.third_party_layers)
112-
source = "../../modules/api_worker/api_layer"
113-
name = each.key
114-
python_version = var.python_version
115-
layer_name = "${local.project}--${replace(terraform.workspace, "_", "-")}--${replace(each.key, "_", "-")}"
116-
source_path = "${path.module}/../../../../src/layers/third_party/dist/${each.key}.zip"
117-
}

‎infrastructure/terraform/per_account/dev/parameters/main.tf‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -55,24 +55,10 @@ resource "aws_secretsmanager_secret" "ldap-changelog-password" {
5555
name = "${terraform.workspace}-ldap-changelog-password"
5656
}
5757

58-
resource "aws_secretsmanager_secret" "etl_notify_slack_webhook_url" {
59-
name = "${terraform.workspace}--etl-notify-slack-webhook-url"
60-
}
61-
6258
resource "aws_secretsmanager_secret" "apigee-app-client-info" {
6359
name = "${terraform.workspace}--apigee-app-client-info"
6460
}
6561

6662
resource "aws_secretsmanager_secret" "external-id" {
6763
name = "${terraform.workspace}-external-id"
6864
}
69-
70-
# BACKUPS_LOGIC
71-
resource "aws_secretsmanager_secret" "destination_vault_arn" {
72-
name = "destination_vault_arn"
73-
}
74-
75-
# BACKUPS_LOGIC
76-
resource "aws_secretsmanager_secret" "destination_account_id" {
77-
name = "destination_account_id"
78-
}

‎infrastructure/terraform/per_account/dev/parameters/vars.tf‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,3 @@ variable "workspace_type" {
2929
type = string
3030
default = "PERSISTENT"
3131
}
32-
33-
# BACKUPS_LOGIC
34-
variable "layers" {
35-
type = list(string)
36-
}
37-
38-
# BACKUPS_LOGIC
39-
variable "third_party_layers" {
40-
type = list(string)
41-
}

‎infrastructure/terraform/per_account/dev/vars.tf‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -28,18 +28,3 @@ variable "budget_limit" {
2828
default = "1050"
2929
type = string
3030
}
31-
32-
# BACKUPS_LOGIC
33-
variable "python_version" {
34-
default = "python3.12"
35-
}
36-
37-
# BACKUPS_LOGIC
38-
variable "layers" {
39-
type = list(string)
40-
}
41-
42-
# BACKUPS_LOGIC
43-
variable "third_party_layers" {
44-
type = list(string)
45-
}

‎infrastructure/terraform/per_account/modules/notify/main.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
data "aws_secretsmanager_secret" "slack_webhook_url" {
2-
name = "${var.environment}--etl-notify-slack-webhook-url"
2+
name = "${var.environment}-notify-slack-webhook-url"
33
}
44

55
data "aws_secretsmanager_secret_version" "slack_webhook_url" {

infrastructure/terraform/per_account/dev/aws-backups.tf renamed to infrastructure/terraform/per_account/prod/aws-backups.tf

File renamed without changes.

‎infrastructure/terraform/per_account/prod/main.tf‎

Lines changed: 14 additions & 63 deletions
Original file line numberDiff line numberDiff line change
@@ -96,69 +96,20 @@ resource "aws_route53_zone" "prod-ns" {
9696
name = "api.cpm.national.nhs.uk"
9797
}
9898

99-
module "snapshot_bucket" {
100-
source = "terraform-aws-modules/s3-bucket/aws"
101-
version = "3.15.2"
102-
bucket = "${local.project}--${replace(terraform.workspace, "_", "-")}--snapshot"
103-
versioning = {
104-
enabled = true
105-
}
106-
tags = {
107-
Name = "${local.project}--${replace(terraform.workspace, "_", "-")}--snapshot"
108-
}
99+
module "layers" {
100+
for_each = toset(var.layers)
101+
source = "../../modules/api_worker/api_layer"
102+
name = each.key
103+
python_version = var.python_version
104+
layer_name = "${local.project}--${replace(terraform.workspace, "_", "-")}--${replace(each.key, "_", "-")}"
105+
source_path = "${path.module}/../../../../src/layers/${each.key}/dist/${each.key}.zip"
109106
}
110-
resource "aws_s3_bucket_policy" "snapshot_bucket_policy" {
111-
bucket = module.snapshot_bucket.s3_bucket_id
112107

113-
policy = jsonencode({
114-
Version = "2012-10-17",
115-
Statement = [
116-
{
117-
Sid = "AWSAccessLogDeliveryWrite",
118-
Effect = "Allow",
119-
Principal = {
120-
Service = "logging.s3.amazonaws.com"
121-
},
122-
Action = "s3:PutObject",
123-
Resource = "${module.snapshot_bucket.s3_bucket_arn}/*"
124-
},
125-
{
126-
Sid = "AWSAccessLogDeliveryAclCheck",
127-
Effect = "Allow",
128-
Principal = {
129-
Service = "logging.s3.amazonaws.com"
130-
},
131-
Action = "s3:GetBucketAcl",
132-
Resource = "${module.snapshot_bucket.s3_bucket_arn}"
133-
},
134-
{
135-
Sid = "denyInsecureTransport",
136-
Effect = "Deny",
137-
Principal = "*",
138-
Action = "s3:*",
139-
Resource = [
140-
"${module.snapshot_bucket.s3_bucket_arn}",
141-
"${module.snapshot_bucket.s3_bucket_arn}/*"
142-
],
143-
Condition = {
144-
Bool = {
145-
"aws:SecureTransport" = "false"
146-
}
147-
}
148-
},
149-
{
150-
Sid = "AllowDynamoDBExport",
151-
Effect = "Allow",
152-
Principal = {
153-
Service = "dynamodb.amazonaws.com"
154-
},
155-
Action = [
156-
"s3:PutObject",
157-
"s3:AbortMultipartUpload",
158-
"s3:ListMultipartUploadParts"
159-
],
160-
Resource = "${module.snapshot_bucket.s3_bucket_arn}/*"
161-
}
162-
]
163-
})
108+
module "third_party_layers" {
109+
for_each = toset(var.third_party_layers)
110+
source = "../../modules/api_worker/api_layer"
111+
name = each.key
112+
python_version = var.python_version
113+
layer_name = "${local.project}--${replace(terraform.workspace, "_", "-")}--${replace(each.key, "_", "-")}"
114+
source_path = "${path.module}/../../../../src/layers/third_party/dist/${each.key}.zip"
164115
}

‎infrastructure/terraform/per_account/prod/parameters/main.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,6 +59,18 @@ resource "aws_secretsmanager_secret" "ldap-changelog-password" {
5959
name = "${terraform.workspace}-ldap-changelog-password"
6060
}
6161

62+
resource "aws_secretsmanager_secret" "notify_slack_webhook_url" {
63+
name = "${terraform.workspace}-notify-slack-webhook-url"
64+
}
65+
6266
resource "aws_secretsmanager_secret" "external-id" {
6367
name = "${terraform.workspace}-external-id"
6468
}
69+
70+
resource "aws_secretsmanager_secret" "destination_vault_arn" {
71+
name = "destination_vault_arn"
72+
}
73+
74+
resource "aws_secretsmanager_secret" "destination_account_id" {
75+
name = "destination_account_id"
76+
}

0 commit comments

Comments
 (0)