Merge pull request #530 from NHSDigital/release/2025-03-07

jameslinnell · web-flow · commit 4c7afc62f382 · 2025-03-10T11:04:41.000Z
Release/2025 03 07
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## 2025-03-07
+- [PI-383] External ID
+- [PI-838] product_team includes product_team_id
+
 ## 2025-03-05
 - [PI-833] Read product by productID
 - [PI-832] product_team_id as a key in product_team
diff --git a/VERSION b/VERSION
@@ -1 +1 @@
-2025.03.05
+2025.03.07
diff --git a/changelog/2025-03-07.md b/changelog/2025-03-07.md
@@ -0,0 +1,2 @@
+- [PI-383] External ID
+- [PI-838] product_team includes product_team_id
diff --git a/infrastructure/swagger/07_components--schemas--domain.yaml b/infrastructure/swagger/07_components--schemas--domain.yaml
@@ -83,6 +83,8 @@ components:
           type: string
         cpm_product_team_id:
           type: string
+        product_team_id:
+          type: string
         ods_code:
           type: string
         status:
@@ -107,7 +109,8 @@ components:
       example:
         id: "P.1X3-XXX"
         name: "Sample Product"
-        cpm_product_team_id: "55e86121-3826-468c-a6f0-dd0f1fbc0259"
+        product_team_id: "55e86121-3826-468c-a6f0-dd0f1fbc0259"
+        cpm_product_team_id: "a9a9694d-001b-45ce-9f2a-6c9bf80ae0d0"
         ods_code: "F5H1R"
         keys: []
         status: "active"
diff --git a/infrastructure/terraform/per_account/dev/parameters/main.tf b/infrastructure/terraform/per_account/dev/parameters/main.tf
@@ -66,3 +66,7 @@ resource "aws_secretsmanager_secret" "apigee-app-client-info" {
 resource "aws_secretsmanager_secret" "apigee-sds-app-key" {
   name = "${terraform.workspace}-apigee-sds-app-key"
 }
+
+resource "aws_secretsmanager_secret" "external-id" {
+  name = "${terraform.workspace}-external-id"
+}
diff --git a/infrastructure/terraform/per_account/dev/parameters/provider.tf b/infrastructure/terraform/per_account/dev/parameters/provider.tf
@@ -2,7 +2,8 @@ provider "aws" {
   region = local.region
 
   assume_role {
-    role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    role_arn    = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    external_id = var.external_id
   }
 
   default_tags {
diff --git a/infrastructure/terraform/per_account/dev/parameters/vars.tf b/infrastructure/terraform/per_account/dev/parameters/vars.tf
@@ -8,6 +8,8 @@ variable "assume_account" {
 
 variable "assume_role" {}
 
+variable "external_id" {}
+
 variable "environment" {}
 
 variable "deletion_protection_enabled" {
diff --git a/infrastructure/terraform/per_account/dev/provider.tf b/infrastructure/terraform/per_account/dev/provider.tf
@@ -2,7 +2,8 @@ provider "aws" {
   region = local.region
 
   assume_role {
-    role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    role_arn    = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    external_id = var.external_id
   }
 
   default_tags {
diff --git a/infrastructure/terraform/per_account/dev/vars.tf b/infrastructure/terraform/per_account/dev/vars.tf
@@ -8,6 +8,8 @@ variable "assume_account" {
 
 variable "assume_role" {}
 
+variable "external_id" {}
+
 variable "environment" {}
 
 variable "expiration_date" {
diff --git a/infrastructure/terraform/per_account/int/parameters/main.tf b/infrastructure/terraform/per_account/int/parameters/main.tf
@@ -61,3 +61,7 @@ resource "aws_secretsmanager_secret" "etl_notify_slack_webhook_url" {
 resource "aws_secretsmanager_secret" "apigee-sds-app-key" {
   name = "${terraform.workspace}-apigee-sds-app-key"
 }
+
+resource "aws_secretsmanager_secret" "external-id" {
+  name = "${terraform.workspace}-external-id"
+}
diff --git a/infrastructure/terraform/per_account/int/parameters/provider.tf b/infrastructure/terraform/per_account/int/parameters/provider.tf
@@ -2,7 +2,8 @@ provider "aws" {
   region = local.region
 
   assume_role {
-    role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    role_arn    = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    external_id = var.external_id
   }
 
   default_tags {
diff --git a/infrastructure/terraform/per_account/int/parameters/vars.tf b/infrastructure/terraform/per_account/int/parameters/vars.tf
@@ -8,6 +8,8 @@ variable "assume_account" {
 
 variable "assume_role" {}
 
+variable "external_id" {}
+
 variable "environment" {}
 
 variable "deletion_protection_enabled" {
diff --git a/infrastructure/terraform/per_account/int/provider.tf b/infrastructure/terraform/per_account/int/provider.tf
@@ -2,7 +2,8 @@ provider "aws" {
   region = local.region
 
   assume_role {
-    role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    role_arn    = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    external_id = var.external_id
   }
 
   default_tags {
diff --git a/infrastructure/terraform/per_account/int/vars.tf b/infrastructure/terraform/per_account/int/vars.tf
@@ -8,6 +8,8 @@ variable "assume_account" {
 
 variable "assume_role" {}
 
+variable "external_id" {}
+
 variable "environment" {}
 
 variable "expiration_date" {
diff --git a/infrastructure/terraform/per_account/prod/parameters/main.tf b/infrastructure/terraform/per_account/prod/parameters/main.tf
@@ -62,3 +62,7 @@ resource "aws_secretsmanager_secret" "etl_notify_slack_webhook_url" {
 resource "aws_secretsmanager_secret" "apigee-sds-app-key" {
   name = "${terraform.workspace}-apigee-sds-app-key"
 }
+
+resource "aws_secretsmanager_secret" "external-id" {
+  name = "${terraform.workspace}-external-id"
+}
diff --git a/infrastructure/terraform/per_account/prod/parameters/provider.tf b/infrastructure/terraform/per_account/prod/parameters/provider.tf
@@ -2,7 +2,8 @@ provider "aws" {
   region = local.region
 
   assume_role {
-    role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    role_arn    = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    external_id = var.external_id
   }
 
   default_tags {
diff --git a/infrastructure/terraform/per_account/prod/parameters/vars.tf b/infrastructure/terraform/per_account/prod/parameters/vars.tf
@@ -8,6 +8,8 @@ variable "assume_account" {
 
 variable "assume_role" {}
 
+variable "external_id" {}
+
 variable "environment" {}
 
 variable "deletion_protection_enabled" {
diff --git a/infrastructure/terraform/per_account/prod/provider.tf b/infrastructure/terraform/per_account/prod/provider.tf
@@ -2,7 +2,8 @@ provider "aws" {
   region = local.region
 
   assume_role {
-    role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    role_arn    = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    external_id = var.external_id
   }
 
   default_tags {
diff --git a/infrastructure/terraform/per_account/prod/vars.tf b/infrastructure/terraform/per_account/prod/vars.tf
@@ -8,6 +8,8 @@ variable "assume_account" {
 
 variable "assume_role" {}
 
+variable "external_id" {}
+
 variable "environment" {}
 
 variable "expiration_date" {
diff --git a/infrastructure/terraform/per_account/qa/parameters/main.tf b/infrastructure/terraform/per_account/qa/parameters/main.tf
@@ -62,3 +62,7 @@ resource "aws_secretsmanager_secret" "etl_notify_slack_webhook_url" {
 resource "aws_secretsmanager_secret" "apigee-sds-app-key" {
   name = "${terraform.workspace}-apigee-sds-app-key"
 }
+
+resource "aws_secretsmanager_secret" "external-id" {
+  name = "${terraform.workspace}-external-id"
+}
diff --git a/infrastructure/terraform/per_account/qa/parameters/provider.tf b/infrastructure/terraform/per_account/qa/parameters/provider.tf
@@ -2,7 +2,8 @@ provider "aws" {
   region = local.region
 
   assume_role {
-    role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    role_arn    = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    external_id = var.external_id
   }
 
   default_tags {
diff --git a/infrastructure/terraform/per_account/qa/parameters/vars.tf b/infrastructure/terraform/per_account/qa/parameters/vars.tf
@@ -8,6 +8,8 @@ variable "assume_account" {
 
 variable "assume_role" {}
 
+variable "external_id" {}
+
 variable "environment" {}
 
 variable "deletion_protection_enabled" {
diff --git a/infrastructure/terraform/per_account/qa/provider.tf b/infrastructure/terraform/per_account/qa/provider.tf
@@ -2,7 +2,8 @@ provider "aws" {
   region = local.region
 
   assume_role {
-    role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    role_arn    = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    external_id = var.external_id
   }
 
   default_tags {
diff --git a/infrastructure/terraform/per_account/qa/vars.tf b/infrastructure/terraform/per_account/qa/vars.tf
@@ -8,6 +8,8 @@ variable "assume_account" {
 
 variable "assume_role" {}
 
+variable "external_id" {}
+
 variable "environment" {}
 
 variable "expiration_date" {
diff --git a/infrastructure/terraform/per_account/ref/parameters/main.tf b/infrastructure/terraform/per_account/ref/parameters/main.tf
@@ -66,3 +66,7 @@ resource "aws_secretsmanager_secret" "apigee-app-client-info" {
 resource "aws_secretsmanager_secret" "apigee-sds-app-key" {
   name = "${terraform.workspace}-apigee-sds-app-key"
 }
+
+resource "aws_secretsmanager_secret" "external-id" {
+  name = "${terraform.workspace}-external-id"
+}
diff --git a/infrastructure/terraform/per_account/ref/parameters/provider.tf b/infrastructure/terraform/per_account/ref/parameters/provider.tf
@@ -2,7 +2,8 @@ provider "aws" {
   region = local.region
 
   assume_role {
-    role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    role_arn    = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    external_id = var.external_id
   }
 
   default_tags {
diff --git a/infrastructure/terraform/per_account/ref/parameters/vars.tf b/infrastructure/terraform/per_account/ref/parameters/vars.tf
@@ -8,6 +8,8 @@ variable "assume_account" {
 
 variable "assume_role" {}
 
+variable "external_id" {}
+
 variable "environment" {}
 
 variable "deletion_protection_enabled" {
diff --git a/infrastructure/terraform/per_account/ref/provider.tf b/infrastructure/terraform/per_account/ref/provider.tf
@@ -2,7 +2,8 @@ provider "aws" {
   region = local.region
 
   assume_role {
-    role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    role_arn    = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    external_id = var.external_id
   }
 
   default_tags {
diff --git a/infrastructure/terraform/per_account/ref/vars.tf b/infrastructure/terraform/per_account/ref/vars.tf
@@ -8,6 +8,8 @@ variable "assume_account" {
 
 variable "assume_role" {}
 
+variable "external_id" {}
+
 variable "environment" {}
 
 variable "expiration_date" {
diff --git a/infrastructure/terraform/per_workspace/provider.tf b/infrastructure/terraform/per_workspace/provider.tf
@@ -2,7 +2,8 @@ provider "aws" {
   region = local.region
 
   assume_role {
-    role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    role_arn    = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"
+    external_id = var.external_id
   }
 
   default_tags {
diff --git a/infrastructure/terraform/per_workspace/vars.tf b/infrastructure/terraform/per_workspace/vars.tf
@@ -8,6 +8,8 @@ variable "assume_account" {
 
 variable "assume_role" {}
 
+variable "external_id" {}
+
 variable "environment" {}
 
 variable "deletion_protection_enabled" {
diff --git a/pyproject.toml b/pyproject.toml
@@ -1,6 +1,6 @@
 [tool.poetry]
 name = "connecting-party-manager"
-version = "2025.03.05"
+version = "2025.03.07"
 description = "Repository for the Connecting Party Manager API and related services"
 authors = ["NHS England"]
 license = "LICENSE.md"
@@ -61,7 +61,7 @@ click = "^8.1.7"
 optional = true
 
 [tool.poetry.group.local.dependencies]
-ipython = "^8.17.2"
+ipython = "^9.0.1"
 
 # [tool.poetry.group.sds_update]
 # optional = true
diff --git a/scripts/infrastructure/policies/role-trust-policy.json b/scripts/infrastructure/policies/role-trust-policy.json
@@ -7,7 +7,11 @@
         "AWS": "arn:aws:iam::${MGMT_ACCOUNT_ID}:root"
       },
       "Action": "sts:AssumeRole",
-      "Condition": {}
+      "Condition": {
+        "StringEquals": {
+          "sts:ExternalId": "${EXTERNAL_ID}"
+        }
+      }
     }
   ]
 }
diff --git a/scripts/infrastructure/roles.mk b/scripts/infrastructure/roles.mk
@@ -8,3 +8,6 @@ manage--non-mgmt-policies: aws--login ## Create or update IAM Policies
 
 manage--non-mgmt-test-policies: aws--login ## Create or update IAM Policies
 	@AWS_ACCESS_KEY_ID=$(AWS_ACCESS_KEY_ID) AWS_SECRET_ACCESS_KEY=$(AWS_SECRET_ACCESS_KEY) AWS_SESSION_TOKEN=$(AWS_SESSION_TOKEN) bash $(PATH_TO_INFRASTRUCTURE)/roles/manage-non-mgmt-aws-support-integration-policies.sh
+
+manage--non-mgmt-trust-policies: aws--login ## Create or update IAM Policies
+	@AWS_ACCESS_KEY_ID=$(AWS_ACCESS_KEY_ID) AWS_SECRET_ACCESS_KEY=$(AWS_SECRET_ACCESS_KEY) AWS_SESSION_TOKEN=$(AWS_SESSION_TOKEN) bash $(PATH_TO_INFRASTRUCTURE)/roles/manage-non-mgmt-aws-trust-policy.sh
diff --git a/scripts/infrastructure/roles/manage-non-mgmt-aws-roles.sh b/scripts/infrastructure/roles/manage-non-mgmt-aws-roles.sh
@@ -32,11 +32,11 @@ else
   fi
 fi
 MGMT_ID_PARAMETER_STORE="nhse-cpm--${ENV}--mgmt-account-id-v1.0.0"
-
+EXTERNAL_ID_PARAMETER_STORE="${ENV}-external-id"
 if aws secretsmanager describe-secret --secret-id "$MGMT_ID_PARAMETER_STORE" --region "$AWS_REGION_NAME" &> /dev/null; then
   # Secret exists, retrieve its value
   MGMT_ACCOUNT_ID=$(aws secretsmanager get-secret-value --secret-id "$MGMT_ID_PARAMETER_STORE" --region "$AWS_REGION_NAME" --query 'SecretString' --output text)
-
+  EXTERNAL_ID=$(aws secretsmanager get-secret-value --secret-id "$EXTERNAL_ID_PARAMETER_STORE" --region "$AWS_REGION_NAME" --query 'SecretString' --output text)
   #
   # Create the NHSDeploymentRole that will be used for deployment and CI/CD in All Deployment environments
   #
diff --git a/scripts/infrastructure/roles/manage-non-mgmt-aws-trust-policy.sh b/scripts/infrastructure/roles/manage-non-mgmt-aws-trust-policy.sh
@@ -0,0 +1,47 @@
+#!/bin/bash
+
+function _substitute_environment_variables() {
+  eval "cat << EOF
+$(cat $1)
+EOF"
+}
+
+AWS_REGION_NAME="eu-west-2"
+ACCOUNT_ID=$(aws sts get-caller-identity | jq -r .Account)
+
+ENV="dev"
+
+#
+# Check we're not running this against MGMT
+#
+. "./scripts/aws/helpers.sh"
+if _validate_current_account "MGMT"; then
+  echo "Please login to non-mgmt profile before running this script"
+  exit 1
+else
+  if _validate_current_account "PROD"; then
+    ENV="prod"
+  elif _validate_current_account "INT"; then
+    ENV="int"
+  elif _validate_current_account "QA"; then
+    ENV="qa"
+  elif _validate_current_account "INT"; then
+    ENV="int"
+  elif _validate_current_account "REF"; then
+    ENV="ref"
+  fi
+fi
+EXTERNAL_ID_PARAMETER_STORE="${ENV}-external-id"
+MGMT_ID_PARAMETER_STORE="nhse-cpm--${ENV}--mgmt-account-id-v1.0.0"
+
+EXTERNAL_ID=$(aws secretsmanager get-secret-value --secret-id "$EXTERNAL_ID_PARAMETER_STORE" --region "$AWS_REGION_NAME" --query 'SecretString' --output text)
+MGMT_ACCOUNT_ID=$(aws secretsmanager get-secret-value --secret-id "$MGMT_ID_PARAMETER_STORE" --region "$AWS_REGION_NAME" --query 'SecretString' --output text)
+
+tf_assume_role_policy=$(_substitute_environment_variables ./scripts/infrastructure/policies/role-trust-policy.json)
+aws iam update-assume-role-policy --role-name NHSDeploymentRole --policy-document "${tf_assume_role_policy}"
+aws iam update-assume-role-policy --role-name NHSSmokeTestRole --policy-document "${tf_assume_role_policy}"
+
+if [ "$ENV" != "prod" ]; then
+  aws iam update-assume-role-policy --role-name NHSDevelopmentRole --policy-document "${tf_assume_role_policy}"
+  aws iam update-assume-role-policy --role-name NHSTestCIRole --policy-document "${tf_assume_role_policy}"
+fi
diff --git a/scripts/infrastructure/terraform/terraform-commands.sh b/scripts/infrastructure/terraform/terraform-commands.sh
diff --git a/scripts/infrastructure/terraform/terraform-utils.sh b/scripts/infrastructure/terraform/terraform-utils.sh
diff --git a/src/api/createCpmProduct/tests/test_index.py b/src/api/createCpmProduct/tests/test_index.py
diff --git a/src/api/deleteCpmProduct/tests/test_index.py b/src/api/deleteCpmProduct/tests/test_index.py
diff --git a/src/api/tests/feature_tests/features/createCpmProduct.success.feature b/src/api/tests/feature_tests/features/createCpmProduct.success.feature
diff --git a/src/api/tests/feature_tests/features/readCpmProduct.success.feature b/src/api/tests/feature_tests/features/readCpmProduct.success.feature
diff --git a/src/api/tests/feature_tests/features/searchCpmProduct.success.feature b/src/api/tests/feature_tests/features/searchCpmProduct.success.feature
diff --git a/src/layers/domain/core/cpm_product/v1.py b/src/layers/domain/core/cpm_product/v1.py
diff --git a/src/layers/domain/core/product_team/v1.py b/src/layers/domain/core/product_team/v1.py
diff --git a/src/test_helpers/aws_session.py b/src/test_helpers/aws_session.py

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1,2 @@`
	`1`	`+- [PI-383] External ID`
	`2`	`+- [PI-838] product_team includes product_team_id`
Original file line number	Diff line number	Diff line change
`@@ -66,3 +66,7 @@ resource "aws_secretsmanager_secret" "apigee-app-client-info" {`
`66`	`66`	`resource "aws_secretsmanager_secret" "apigee-sds-app-key" {`
`67`	`67`	`name = "${terraform.workspace}-apigee-sds-app-key"`
`68`	`68`	`}`
	`69`	`+`
	`70`	`+resource "aws_secretsmanager_secret" "external-id" {`
	`71`	`+ name = "${terraform.workspace}-external-id"`
	`72`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -2,7 +2,8 @@ provider "aws" {`
`2`	`2`	`region = local.region`
`3`	`3`
`4`	`4`	`assume_role {`
`5`		`- role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"`
	`5`	`+ role_arn = "arn:aws:iam::${var.assume_account}:role/${var.assume_role}"`
	`6`	`+ external_id = var.external_id`
`6`	`7`	`}`
`7`	`8`
`8`	`9`	`default_tags {`
Original file line number	Diff line number	Diff line change
`@@ -61,3 +61,7 @@ resource "aws_secretsmanager_secret" "etl_notify_slack_webhook_url" {`
`61`	`61`	`resource "aws_secretsmanager_secret" "apigee-sds-app-key" {`
`62`	`62`	`name = "${terraform.workspace}-apigee-sds-app-key"`
`63`	`63`	`}`
	`64`	`+`
	`65`	`+resource "aws_secretsmanager_secret" "external-id" {`
	`66`	`+ name = "${terraform.workspace}-external-id"`
	`67`	`+}`