[registration-cleaning-worker] Use dedicated security group for accessing Postgres

[jacobwinch]

What does this change?

The Notifications VPC has a “default group”. Prior to this PR, registration-cleaning-worker used this group to gain access to the RDS database (via the RDS proxy). This approach to networking does not follow the principle of least privilege, as any network interface in the VPC can implicitly reach the CODE and PROD databases.

In #1636 a new security group was created, with the intention of services joining it only if they need database access. This will ultimately allow us to remove the “default group”, thus improving our security posture by moving towards the principle of least privilege.

This PR updates registration-cleaning-worker to use the new security group / approach¹.

How has this change been tested?

I've deployed this to CODE to check that the new CFN / Riff-Raff wiring is valid.

However, testing the actual behaviour of this Lambda seems tricky (#1527), so I'd like to merge this and confirm that it works in PROD by checking the logs / SQS metrics.

How can we measure success?

This is a step towards removing the "default group", which improves our security posture and allows us to standardise on a single approach following the changes made in #1636.

Have we considered potential risks?

As mentioned above, testing this in CODE is tricky.

'Testing' this in PROD (after merging to main) should be low risk because this Lambda processes a queue (and has a dead letter queue):

mobile-n10n/notificationworkerlambda/registration-cleaning-worker-cfn.yaml

Lines 44 to 61 in 146259b

	Dlq:
	Type: AWS::SQS::Queue
	Sqs:
	Type: AWS::SQS::Queue
	Properties:
	VisibilityTimeout: 300
	MessageRetentionPeriod: 3600 # 1 hour
	RedrivePolicy:
	deadLetterTargetArn: !GetAtt Dlq.Arn
	maxReceiveCount: 5
	Tags:
	- Key: Stage
	Value: !Ref Stage
	- Key: Stack
	Value: !Ref Stack
	- Key: App
	Value: !Ref App

So if anything goes wrong we can just rollback and re-drive the messages.

As far as I can tell there will be no negative impact caused by taking a bit longer than normal to tidy up invalid tokens.

Footnotes

1. Note that all of the above applies regardless of whether the application connects to the RDS instance directly or whether it goes via the RDS proxy, because the RDS instance and the RDS proxy share the same security group (created here). ↩

[github-actions]

Deploy build 5469 of mobile-n10n:notificationworkerlambda to CODE

All deployment options

• Deploy build 5469 of mobile-n10n:notificationworkerlambda to CODE
• Deploy parts of build 5469 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[github-actions]

Deploy build 5164 of mobile-n10n:registration to CODE

All deployment options

• Deploy build 5164 of mobile-n10n:registration to CODE
• Deploy parts of build 5164 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[github-actions]

Deploy build 5137 of mobile-n10n:slomonitor to CODE

All deployment options

• Deploy build 5137 of mobile-n10n:slomonitor to CODE
• Deploy parts of build 5137 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[github-actions]

Deploy build 4786 of mobile-n10n:football to CODE

All deployment options

• Deploy build 4786 of mobile-n10n:football to CODE
• Deploy parts of build 4786 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[github-actions]

Deploy build 4822 of mobile-n10n:fakebreakingnewslambda to CODE

All deployment options

• Deploy build 4822 of mobile-n10n:fakebreakingnewslambda to CODE
• Deploy parts of build 4822 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[github-actions]

Deploy build 4950 of mobile-n10n:notification to CODE

All deployment options

• Deploy build 4950 of mobile-n10n:notification to CODE
• Deploy parts of build 4950 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[github-actions]

Deploy build 5071 of mobile-n10n:report to CODE

All deployment options

• Deploy build 5071 of mobile-n10n:report to CODE
• Deploy parts of build 5071 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[jacobwinch]

This has been deployed successfully.

These logs show that we are deleting records as expected and the SQS metrics suggest that all messages are being processed as expected.