Feature/eli 702 code signing #617
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,244 @@ | ||
| name: "Updated - 3. CD | Deploy to Test" | ||
|
|
||
| #on: | ||
| # workflow_run: | ||
| # workflows: ["2. CD | Deploy to Dev"] | ||
| # types: [completed] | ||
|
|
||
| concurrency: | ||
| group: test-deployments | ||
| cancel-in-progress: false | ||
|
|
||
| permissions: | ||
| contents: read | ||
| id-token: write | ||
| actions: read | ||
|
|
||
| jobs: | ||
| metadata: | ||
| name: "Resolve metadata from triggering run" | ||
| runs-on: ubuntu-latest | ||
| if: ${{ github.event.workflow_run.conclusion == 'success' }} | ||
| outputs: | ||
| terraform_version: ${{ steps.vars.outputs.terraform_version }} | ||
| tag: ${{ steps.tag.outputs.name }} | ||
| steps: | ||
| - name: "Checkout exact commit from CI/CD publish" | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| ref: ${{ github.event.workflow_run.head_sha }} | ||
|
|
||
| - name: "Set CI/CD variables" | ||
| id: vars | ||
| run: | | ||
| echo "terraform_version=$(grep '^terraform' .tool-versions | cut -f2 -d' ')" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: "Resolve the dev-* tag for this commit" | ||
| id: tag | ||
| run: | | ||
| git fetch --tags --force | ||
| SHA="${{ github.event.workflow_run.head_sha }}" | ||
| TAG=$(git tag --points-at "$SHA" | grep '^dev-' | sort -r | head -n1 || true) | ||
| if [ -z "$TAG" ]; then | ||
| echo "No dev-* tag found on $SHA" >&2 | ||
| exit 1 | ||
| fi | ||
| echo "name=$TAG" >> $GITHUB_OUTPUT | ||
| echo "Resolved tag: $TAG" | ||
|
|
||
| sign-lambda-artifact: | ||
| name: "Sign lambda artifact for TEST" | ||
| runs-on: ubuntu-latest | ||
| needs: [metadata] | ||
| environment: test | ||
| timeout-minutes: 45 | ||
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| outputs: | ||
| bucket_name: ${{ steps.tf_output.outputs.bucket_name }} | ||
| steps: | ||
| - name: "Checkout same commit" | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| ref: ${{ github.event.workflow_run.head_sha }} | ||
|
|
||
| - name: "Setup Terraform" | ||
| uses: hashicorp/setup-terraform@v3 | ||
| with: | ||
| terraform_version: ${{ needs.metadata.outputs.terraform_version }} | ||
|
|
||
| - name: "Configure AWS Credentials" | ||
| uses: aws-actions/configure-aws-credentials@v6 | ||
| with: | ||
| role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role | ||
| aws-region: eu-west-2 | ||
|
|
||
| - name: "Download lambda artefact from dev workflow" | ||
| uses: actions/download-artifact@v7 | ||
| with: | ||
| name: lambda-${{ needs.metadata.outputs.tag }} | ||
| path: ./dist | ||
| run-id: ${{ github.event.workflow_run.id }} | ||
| github-token: ${{ github.token }} | ||
|
|
||
| - name: "Terraform Init (TEST api-layer)" | ||
| env: | ||
| ENVIRONMENT: test | ||
| WORKSPACE: "default" | ||
| run: | | ||
| echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=init" | ||
| make terraform env=$ENVIRONMENT stack=api-layer tf-command=init workspace=$WORKSPACE | ||
| working-directory: ./infrastructure | ||
|
|
||
|
Collaborator
There was a problem hiding this comment. I'm not clear on intention here - no apply step, which would presumably block, unless the intention is to run the other workflow, to deploy the codesigning infra, then ths to test it out / turn it on?
Contributor
Author
There was a problem hiding this comment. its to get the outputs from the init so that we can use them in the signing step below (120)
Contributor
Author
There was a problem hiding this comment. then once we have a signed lambda we can do the next job in this workflow - deploy which does the tf apply |
||
| - name: "Extract S3 bucket name from Terraform output" | ||
| id: tf_output | ||
| run: | | ||
| BUCKET=$(terraform output -raw lambda_artifact_bucket) | ||
| PROFILE=$(terraform output -raw lambda_signing_profile_name) | ||
| echo "bucket_name=$BUCKET" >> $GITHUB_OUTPUT | ||
| echo "signing_profile_name=$PROFILE" >> $GITHUB_OUTPUT | ||
| working-directory: ./infrastructure/stacks/api-layer | ||
|
|
||
| - name: "Upload unsigned lambda artifact to S3" | ||
|
Collaborator
There was a problem hiding this comment. I'm wondering now whether each environment will need to sign, as we're using separate accounts (so Prod has no reason to trust PreProd etc....) |
||
| run: | | ||
| aws s3 cp ./dist/lambda.zip \ | ||
| s3://${{ steps.tf_output.outputs.bucket_name }}/unsigned/${{ needs.metadata.outputs.tag }}/lambda.zip \ | ||
| --region eu-west-2 | ||
|
|
||
| - name: "Get uploaded source object version" | ||
| id: source_object | ||
| run: | | ||
| VERSION_ID=$(aws s3api head-object \ | ||
| --bucket "${{ steps.tf_output.outputs.bucket_name }}" \ | ||
| --key "unsigned/${{ needs.metadata.outputs.tag }}/lambda.zip" \ | ||
| --query 'VersionId' \ | ||
| --output text \ | ||
| --region eu-west-2) | ||
| echo "version_id=$VERSION_ID" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: "Start signing job" | ||
| id: signing | ||
| env: | ||
| SIGNING_PROFILE_NAME: ${{ steps.tf_output.outputs.signing_profile_name }} | ||
| run: | | ||
| JOB_ID=$(aws signer start-signing-job \ | ||
| --source "s3={bucketName=${{ steps.tf_output.outputs.bucket_name }},key=unsigned/${{ needs.metadata.outputs.tag }}/lambda.zip,version=${{ steps.source_object.outputs.version_id }}}" \ | ||
| --destination "s3={bucketName=${{ steps.tf_output.outputs.bucket_name }},prefix=signed/${{ needs.metadata.outputs.tag }}/}" \ | ||
| --profile-name "$SIGNING_PROFILE_NAME" \ | ||
| --query 'jobId' \ | ||
| --output text \ | ||
| --region eu-west-2) | ||
| echo "job_id=$JOB_ID" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: "Wait for signing job" | ||
| run: | | ||
| aws signer wait successful-signing-job \ | ||
| --job-id "${{ steps.signing.outputs.job_id }}" \ | ||
| --region eu-west-2 | ||
|
|
||
| - name: "Resolve signed artifact location" | ||
| id: signed_object | ||
| run: | | ||
| SIGNED_BUCKET=$(aws signer describe-signing-job \ | ||
| --job-id "${{ steps.signing.outputs.job_id }}" \ | ||
| --region eu-west-2 \ | ||
| --query 'signedObject.s3.bucketName' \ | ||
| --output text) | ||
|
|
||
| SIGNED_KEY=$(aws signer describe-signing-job \ | ||
| --job-id "${{ steps.signing.outputs.job_id }}" \ | ||
| --region eu-west-2 \ | ||
| --query 'signedObject.s3.key' \ | ||
| --output text) | ||
|
|
||
| echo "bucket_name=$SIGNED_BUCKET" >> $GITHUB_OUTPUT | ||
| echo "object_key=$SIGNED_KEY" >> $GITHUB_OUTPUT | ||
|
|
||
| - name: "Download signed lambda artifact" | ||
| run: | | ||
| aws s3 cp \ | ||
| "s3://${{ steps.signed_object.outputs.bucket_name }}/${{ steps.signed_object.outputs.object_key }}" \ | ||
| ./dist/lambda.zip \ | ||
| --region eu-west-2 | ||
|
|
||
| - name: "Upload signed lambda artifact for current workflow" | ||
| uses: actions/upload-artifact@v6 | ||
| with: | ||
| name: lambda-${{ needs.metadata.outputs.tag }} | ||
| path: ./dist/lambda.zip | ||
|
|
||
| deploy: | ||
| name: "Deploy to TEST (approval required)" | ||
| runs-on: ubuntu-latest | ||
| needs: [metadata, sign-lambda-artifact] | ||
| environment: test | ||
| timeout-minutes: 10080 | ||
| permissions: | ||
| id-token: write | ||
| contents: read | ||
| steps: | ||
| - name: "Checkout same commit" | ||
| uses: actions/checkout@v6 | ||
| with: | ||
| ref: ${{ github.event.workflow_run.head_sha }} | ||
|
|
||
| - name: "Setup Terraform" | ||
| uses: hashicorp/setup-terraform@v3 | ||
| with: | ||
| terraform_version: ${{ needs.metadata.outputs.terraform_version }} | ||
|
|
||
| - name: "Download signed lambda artefact" | ||
| uses: actions/download-artifact@v7 | ||
| with: | ||
| name: lambda-${{ needs.metadata.outputs.tag }} | ||
| path: ./dist | ||
|
|
||
| - name: "Configure AWS Credentials" | ||
| uses: aws-actions/configure-aws-credentials@v6 | ||
| with: | ||
| role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/service-roles/github-actions-api-deployment-role | ||
| aws-region: eu-west-2 | ||
|
|
||
| - name: "Terraform Apply (TEST)" | ||
| env: | ||
| ENVIRONMENT: test | ||
| WORKSPACE: "default" | ||
| TF_VAR_API_CA_CERT: ${{ secrets.API_CA_CERT }} | ||
| TF_VAR_API_CLIENT_CERT: ${{ secrets.API_CLIENT_CERT }} | ||
| TF_VAR_API_PRIVATE_KEY_CERT: ${{ secrets.API_PRIVATE_KEY_CERT }} | ||
| TF_VAR_SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }} | ||
| TF_VAR_SPLUNK_HEC_ENDPOINT: ${{ secrets.SPLUNK_HEC_ENDPOINT }} | ||
| TF_VAR_OPERATOR_EMAILS: ${{ vars.SECRET_ROTATION_OPERATOR_EMAILS }} | ||
| TF_VAR_PROXYGEN_PRIVATE_KEY_PTL: ${{ secrets.PROXYGEN_PRIVATE_KEY_PTL }} | ||
| TF_VAR_PROXYGEN_PRIVATE_KEY_PROD: ${{ secrets.PROXYGEN_PRIVATE_KEY_PROD }} | ||
| run: | | ||
| mkdir -p ./build | ||
| echo "Deploying tag: ${{ needs.metadata.outputs.tag }}" | ||
| echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=networking tf-command=apply" | ||
| make terraform env=$ENVIRONMENT stack=networking tf-command=apply workspace=$WORKSPACE | ||
| echo "Running: make terraform env=$ENVIRONMENT workspace=$WORKSPACE stack=api-layer tf-command=apply" | ||
| make terraform env=$ENVIRONMENT stack=api-layer tf-command=apply workspace=$WORKSPACE | ||
| working-directory: ./infrastructure | ||
|
|
||
| - name: "Validate Feature Toggles" | ||
| env: | ||
| ENV: test | ||
| run: | | ||
| pip install boto3 | ||
| python scripts/feature_toggle/validate_toggles.py | ||
|
|
||
| - name: "Upload signed lambda artifact to S3" | ||
| run: | | ||
| aws s3 cp ./dist/lambda.zip \ | ||
| s3://${{ needs.sign-lambda-artifact.outputs.bucket_name }}/artifacts/${{ needs.metadata.outputs.tag }}/lambda.zip \ | ||
| --region eu-west-2 | ||
|
|
||
| regression-tests: | ||
| name: "Regression Tests" | ||
| needs: deploy | ||
| uses: ./.github/workflows/regression-tests.yml | ||
| with: | ||
| ENVIRONMENT: "test" | ||
| VERSION_NUMBER: "main" | ||
| secrets: inherit | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -130,4 +130,3 @@ jobs: | |
| ENVIRONMENT: "test" | ||
| VERSION_NUMBER: "main" | ||
| secrets: inherit | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| locals { | ||
| enable_lambda_code_signing = false | ||
| # enable_lambda_code_signing = contains(["test", "preprod", "prod"], var.environment) | ||
| # For the next deployment ^ | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,29 @@ | ||
| resource "aws_signer_signing_profile" "lambda_signing" { | ||
| name = "${terraform.workspace == "default" ? "" : "${terraform.workspace}"}EligibilityApiLambdaSigningProfile" | ||
| #aws signer is strict with names, does not like hyphens or underscores | ||
|
|
||
| platform_id = "AWSLambda-SHA384-ECDSA" | ||
|
|
||
| signature_validity_period { | ||
| value = 365 | ||
| type = "DAYS" | ||
| } | ||
| } | ||
|
|
||
| resource "aws_lambda_code_signing_config" "signing_config" { | ||
| allowed_publishers { | ||
| signing_profile_version_arns = [ | ||
| aws_signer_signing_profile.lambda_signing.version_arn | ||
| ] | ||
| } | ||
|
|
||
| policies { | ||
| untrusted_artifact_on_deployment = "Enforce" | ||
| } | ||
|
|
||
TOEL2 marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| description = "Only allow Lambda bundles signed by our trusted signer profile" | ||
| } | ||
|
|
||
| output "lambda_signing_profile_name" { | ||
|
Collaborator
There was a problem hiding this comment. this might need to be added to outputs.tf in the module, then potentially re-output in the stack (in infrastructure/stacks/api-layer/lambda.tf ?) |
||
| value = aws_signer_signing_profile.lambda_signing.name | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Likewise (to below comment), this should still have the iams roles deployment