Skip to content

Commit e953139

Browse files
megan-bower4megan-bower4
committed
Merge branch 'feature/PI-407-immutable_backups' into release/2025-03-26
2 parents f4e30b9 + 7d415a7 commit e953139

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

74 files changed

+2094
-43
lines changed

‎.github/workflows/_deploy.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -167,7 +167,7 @@ jobs:
167167
- uses: actions/checkout@v4
168168
with:
169169
ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
170-
- if: ${{ env.ACCOUNT != 'mgmt'}}
170+
- if: ${{ env.ACCOUNT != 'mgmt' && env.ACCOUNT != 'backups' }}
171171
uses: ./.github/actions/make/
172172
with:
173173
command: test--smoke WORKSPACE="${{ env.WORKSPACE }}" ACCOUNT="${{ env.ACCOUNT }}"

‎.github/workflows/_deploy_backups.yml‎

Lines changed: 162 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,162 @@
1+
on:
2+
workflow_call:
3+
inputs:
4+
account:
5+
description: The AWS account being deployed
6+
type: string
7+
required: true
8+
workspace:
9+
description: The Terraform workspace being deployed
10+
type: string
11+
required: true
12+
scope:
13+
description: The Terraform scope being deployed
14+
type: string
15+
required: true
16+
17+
permissions:
18+
id-token: write
19+
contents: read
20+
actions: write
21+
22+
env:
23+
ACCOUNT: ${{ inputs.account }}
24+
WORKSPACE: ${{ inputs.workspace }}
25+
CACHE_NAME: ${{ inputs.workspace }}-${{ inputs.account }}-${{ inputs.scope }}
26+
SCOPE: ${{ inputs.scope }}
27+
CI_ROLE_NAME: ${{ secrets.CI_ROLE_NAME }}
28+
29+
jobs:
30+
parse-secrets:
31+
runs-on: [self-hosted, ci]
32+
steps:
33+
- id: parse-secrets
34+
run: |
35+
echo "::add-mask::${{ secrets.CI_ROLE_NAME }}"
36+
37+
get-branch-from-workflow-file:
38+
runs-on: [self-hosted, ci]
39+
needs: [parse-secrets]
40+
outputs:
41+
branch_name: ${{ steps.get_branch.outputs.branch_name }}
42+
steps:
43+
- id: get_branch
44+
run: |
45+
workflow_ref=${{ github.workflow_ref }}
46+
branch_name=${workflow_ref#*refs/heads/}
47+
branch_name=${branch_name#*refs/tags/}
48+
echo "branch_name=${branch_name}" >> $GITHUB_OUTPUT
49+
50+
build:
51+
runs-on: [self-hosted, ci]
52+
needs: get-branch-from-workflow-file
53+
steps:
54+
- uses: actions/checkout@v4
55+
with:
56+
ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
57+
- if: ${{ env.SCOPE == 'per_workspace'}}
58+
uses: ./.github/actions/make/
59+
with:
60+
command: build
61+
save-to-cache: "true"
62+
restore-from-cache: "false"
63+
cache-suffix: ${{ env.CACHE_NAME }}
64+
- if: ${{ env.SCOPE != 'per_workspace'}}
65+
uses: ./.github/actions/make/
66+
with:
67+
command: poetry--update
68+
save-to-cache: "true"
69+
restore-from-cache: "false"
70+
cache-suffix: ${{ env.CACHE_NAME }}
71+
72+
terraform--init:
73+
needs: [get-branch-from-workflow-file, build]
74+
runs-on: [self-hosted, ci]
75+
steps:
76+
- uses: actions/checkout@v4
77+
with:
78+
ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
79+
- uses: ./.github/actions/terraform/
80+
with:
81+
command: init
82+
account: ${{ env.ACCOUNT }}
83+
workspace: ${{ env.WORKSPACE }}
84+
scope: ${{ env.SCOPE }}
85+
restore-from-cache: "true"
86+
save-to-cache: "true"
87+
cache-suffix: ${{ env.CACHE_NAME }}
88+
89+
terraform--plan:
90+
needs: [get-branch-from-workflow-file, terraform--init]
91+
runs-on: [self-hosted, ci]
92+
steps:
93+
- uses: actions/checkout@v4
94+
with:
95+
ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
96+
- uses: ./.github/actions/terraform/
97+
with:
98+
command: plan
99+
account: ${{ env.ACCOUNT }}
100+
workspace: ${{ env.WORKSPACE }}
101+
scope: ${{ env.SCOPE }}
102+
restore-from-cache: "true"
103+
save-to-cache: "true"
104+
cache-suffix: ${{ env.CACHE_NAME }}
105+
106+
terraform--apply:
107+
needs: [get-branch-from-workflow-file, terraform--plan]
108+
environment: ${{ inputs.account }}
109+
runs-on: [self-hosted, ci]
110+
steps:
111+
- uses: actions/checkout@v4
112+
with:
113+
ref: ${{ needs.get-branch-from-workflow-file.outputs.branch_name }}
114+
- uses: ./.github/actions/terraform/
115+
with:
116+
command: apply
117+
account: ${{ env.ACCOUNT }}
118+
workspace: ${{ env.WORKSPACE }}
119+
scope: ${{ env.SCOPE }}
120+
restore-from-cache: "true"
121+
save-to-cache: "true"
122+
cache-suffix: ${{ env.CACHE_NAME }}
123+
124+
set-success:
125+
name: Set Success
126+
needs: [terraform--apply]
127+
runs-on: [self-hosted, ci]
128+
steps:
129+
- name: Set success env var
130+
run: echo "success"
131+
outputs:
132+
success: "succeeded"
133+
134+
message-slack:
135+
name: Notify slack of deployment
136+
needs: [get-branch-from-workflow-file, set-success]
137+
if: always()
138+
runs-on: [self-hosted, ci]
139+
140+
steps:
141+
- name: Catch failed steps
142+
id: catch-failed-step
143+
uses: ./.github/actions/catch-failed-step
144+
- name: Send job result to slack
145+
id: slack
146+
uses: slackapi/[email protected]
147+
with:
148+
webhook-type: webhook-trigger
149+
payload: |
150+
{
151+
"action_url": "${{ format('{0}/{1}/actions/runs/{2}/attempts/{3}', github.server_url, github.repository, github.run_id, github.run_attempt) }}",
152+
"attempt": ${{ github.run_attempt }},
153+
"account": "${{ env.ACCOUNT }}",
154+
"workspace": "${{ env.WORKSPACE }}",
155+
"caller": "${{ github.triggering_actor }}",
156+
"scope": "${{ env.SCOPE }}",
157+
"branch": "${{ needs.get-branch-from-workflow-file.outputs.branch_name }}",
158+
"result": "${{ needs.set-success.outputs.success && needs.set-success.outputs.success || 'failed' }}",
159+
"result_detail": "${{ needs.set-success.outputs.success && 'None' || steps.catch-failed-step.outputs.failed-step-name }}"
160+
}
161+
env:
162+
SLACK_WEBHOOK_URL: ${{ secrets.DEPLOY_ENV_SLACK_HOOK_URL }}

‎.github/workflows/deploy-backups-account-wide-resources.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
name: "Deploy: Account Wide - Backups"
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
account:
7+
description: Account to deploy
8+
required: true
9+
default: backups
10+
jobs:
11+
deploy:
12+
uses: ./.github/workflows/_deploy_backups.yml
13+
with:
14+
account: ${{ inputs.account }}
15+
workspace: ${{ inputs.account }}
16+
scope: "per_account/${{ inputs.account }}"
17+
secrets: inherit # pragma: allowlist secret
18+
19+
run-name: Deploying account wide to nonprod workspace - ${{ inputs.account }}

‎.github/workflows/deploy-parameters-backups.yml‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
name: "Deploy: Parameters - Backups"
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
account:
7+
description: Account to deploy
8+
required: true
9+
default: backups
10+
11+
jobs:
12+
deploy:
13+
uses: ./.github/workflows/_deploy_backups.yml
14+
with:
15+
account: ${{ inputs.account }}
16+
workspace: ${{ inputs.account }}
17+
scope: "per_account/${{ inputs.account }}/parameters"
18+
secrets: inherit # pragma: allowlist secret
19+
20+
run-name: Deploying parameters to nonprod workspace - ${{ inputs.account }}

‎infrastructure/terraform/etc/backups.tfvars‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
account_name = "backups"
2+
environment = "backups"

‎infrastructure/terraform/modules/api_worker/api_lambda/lambda.tf‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
module "lambda_function" {
2+
source = "terraform-aws-modules/lambda/aws"
3+
version = "6.0.0"
4+
5+
function_name = var.lambda_name
6+
description = "${replace(var.name, "_", "-")} lambda function"
7+
handler = "api.${var.name}.index.handler"
8+
runtime = var.python_version
9+
timeout = 10
10+
memory_size = var.memory_size
11+
12+
timeouts = {
13+
create = "5m"
14+
update = "5m"
15+
delete = "5m"
16+
}
17+
18+
create_current_version_allowed_triggers = false
19+
allowed_triggers = var.allowed_triggers
20+
environment_variables = var.environment_variables
21+
22+
create_package = false
23+
local_existing_package = var.source_path
24+
25+
tags = {
26+
Name = replace(var.name, "_", "-")
27+
}
28+
29+
layers = var.layers
30+
31+
trusted_entities = var.trusted_entities
32+
attach_policy_json = var.attach_policy_json
33+
policy_json = var.policy_json
34+
35+
attach_policy_statements = var.attach_policy_statements
36+
policy_statements = var.policy_statements
37+
}

‎infrastructure/terraform/modules/api_worker/api_lambda/outputs.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
output "lambda_arn" {
2+
value = module.lambda_function.lambda_function_arn
3+
}
4+
5+
output "lambda_role_arn" {
6+
value = module.lambda_function.lambda_role_arn
7+
}
8+
9+
output "lambda_role_name" {
10+
value = module.lambda_function.lambda_role_name
11+
}
12+
13+
output "metadata" {
14+
value = {
15+
lambda_invoke_arn = module.lambda_function.lambda_function_invoke_arn
16+
authoriser_iam_role = module.lambda_function.lambda_role_arn
17+
authoriser_name = var.lambda_name
18+
}
19+
}

‎infrastructure/terraform/modules/api_worker/api_lambda/vars.tf‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
variable "name" {}
2+
3+
variable "python_version" {
4+
}
5+
6+
variable "lambda_name" {
7+
default = ""
8+
}
9+
10+
variable "layers" {
11+
type = list(string)
12+
}
13+
14+
variable "source_path" {}
15+
16+
variable "attach_policy_json" {
17+
default = false
18+
}
19+
20+
variable "policy_json" {
21+
default = ""
22+
}
23+
24+
variable "trusted_entities" {
25+
default = []
26+
}
27+
28+
variable "allowed_triggers" {
29+
default = {}
30+
}
31+
32+
variable "environment_variables" {
33+
default = {}
34+
}
35+
36+
variable "attach_policy_statements" {
37+
default = false
38+
}
39+
40+
variable "policy_statements" {
41+
default = {}
42+
}
43+
44+
variable "memory_size" {
45+
default = 128
46+
}

‎infrastructure/terraform/modules/api_worker/api_layer/layer.tf‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
module "lambda_layer" {
2+
source = "terraform-aws-modules/lambda/aws"
3+
version = "6.0.0"
4+
5+
timeouts = {
6+
create = "5m"
7+
update = "5m"
8+
delete = "5m"
9+
}
10+
11+
create_layer = true
12+
13+
layer_name = var.layer_name
14+
description = "${replace(var.name, "_", "-")} lambda layer"
15+
compatible_runtimes = [var.python_version]
16+
17+
create_package = false
18+
local_existing_package = var.source_path
19+
environment_variables = var.environment_variables
20+
21+
tags = {
22+
Name = replace(var.name, "_", "-")
23+
}
24+
}

‎infrastructure/terraform/modules/api_worker/api_layer/outputs.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
output "layer_arn" {
2+
value = module.lambda_layer.lambda_layer_arn
3+
}
4+
5+
output "name" {
6+
value = var.name
7+
}

0 commit comments

Comments
 (0)