[expired-registration-cleaner] Use dedicated security group for accessing Postgres

[jacobwinch]

What does this change?

The Notifications VPC has a “default group”. Prior to this PR, expired-registration-cleaner used this group to gain access to the RDS database (via the RDS proxy). This approach to networking does not follow the principle of least privilege, as any network interface in the VPC can implicitly reach the CODE and PROD databases.

In #1636 a new security group was created, with the intention of services joining it only if they need database access. This will ultimately allow us to remove the “default group”, thus improving our security posture by moving towards the principle of least privilege.

This PR updates expired-registration-cleaner to use the new security group / approach¹.

How has this change been tested?

This Lambda runs once a day at 23:04:00 UTC:

mobile-n10n/notificationworkerlambda/expired-registration-cleaner-cfn.yaml

Lines 112 to 119 in 6d95de2

	DailyEvent:
	Type: AWS::Events::Rule
	Properties:
	Description: Event sent to process the previous day of data
	ScheduleExpression: cron(4 23 * * ? *)
	Targets:
	- Id: Lambda
	Arn: !GetAtt Lambda.Arn

It looks for old tokens and deletes them from the DB:

mobile-n10n/notificationworkerlambda/src/main/scala/com/gu/notifications/worker/ExpiredRegistrationCleaner.scala

Lines 21 to 26 in 6d95de2

	def handleRequest(): Unit = {
	val olderThanDays = 300
	val rowCount = registrationService.deleteByDate(olderThanDays).unsafeRunSync()
	logger.info(s"Deleted $rowCount rows older than $olderThanDays days")
	}
	}

I have deployed to CODE and invoked the Lambda manually.

Unfortunately I don't think there is any test data for the Lambda to delete, although the logs look the same as those from last night, which suggests that it could run the query as normal.

How can we measure success?

This is a step towards removing the "default group", which improves our security posture and allows us to standardise on a single approach following the changes made in #1636.

Have we considered potential risks?

I don't think there are any significant risks in this case. As mentioned above, I wasn't able to test token deletion due to the state of the CODE DB, so I will also double check the logs for this one in PROD after merging.

Footnotes

1. Note that all of the above applies regardless of whether the application connects to the RDS instance directly or whether it goes via the RDS proxy, because the RDS instance and the RDS proxy share the same security group (created here). ↩

[github-actions]

Deploy build 5471 of mobile-n10n:notificationworkerlambda to CODE

All deployment options

• Deploy build 5471 of mobile-n10n:notificationworkerlambda to CODE
• Deploy parts of build 5471 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[github-actions]

Deploy build 5165 of mobile-n10n:registration to CODE

All deployment options

• Deploy build 5165 of mobile-n10n:registration to CODE
• Deploy parts of build 5165 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[github-actions]

Deploy build 5138 of mobile-n10n:slomonitor to CODE

All deployment options

• Deploy build 5138 of mobile-n10n:slomonitor to CODE
• Deploy parts of build 5138 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[github-actions]

Deploy build 4787 of mobile-n10n:football to CODE

All deployment options

• Deploy build 4787 of mobile-n10n:football to CODE
• Deploy parts of build 4787 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[github-actions]

Deploy build 4823 of mobile-n10n:fakebreakingnewslambda to CODE

All deployment options

• Deploy build 4823 of mobile-n10n:fakebreakingnewslambda to CODE
• Deploy parts of build 4823 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[github-actions]

Deploy build 4951 of mobile-n10n:notification to CODE

All deployment options

• Deploy build 4951 of mobile-n10n:notification to CODE
• Deploy parts of build 4951 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[github-actions]

Deploy build 5072 of mobile-n10n:report to CODE

All deployment options

• Deploy build 5072 of mobile-n10n:report to CODE
• Deploy parts of build 5072 to CODE by previewing it first
• What's on CODE right now?

---

From guardian/actions-riff-raff.

[jacobwinch]

As mentioned above, I wasn't able to test token deletion due to the state of the CODE DB, so I will also double check the logs for this one in PROD after merging.

This was deployed successfully yesterday morning and it seems to have run correctly late last night.