Skip to content

Commit 2dc848a

Browse files
Benito Visonegithub-advanced-security[bot]
Benito Visone
and
github-advanced-security[bot]
authored
feat: lambda pdv reconciler (#867)
* feat: add lambda-pdv-reconciler deploy lambda * feat: add lambda-pdv-reconciler lambda code * feat: remove lambda from vpc * feat: add PDV_BASE_URL env var and pdv_base_url tf var * feat: add logs * Potential fix for code scanning alert no. 57: Workflow does not contain permissions Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
1 parent 9621a14 commit 2dc848a

File tree

15 files changed

+217
-41
lines changed

15 files changed

+217
-41
lines changed

‎.github/workflows/deploy-lambda-pdv-reconciler.yml‎

Lines changed: 102 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
name: Deploy Lambda PDV reconciler
2+
permissions:
3+
contents: read
4+
5+
on:
6+
push:
7+
branches:
8+
- "main"
9+
paths:
10+
- "**/src/oneid/oneid-lambda-pdv-reconciler/**"
11+
workflow_dispatch:
12+
inputs:
13+
environment:
14+
description: 'Choose environment'
15+
type: choice
16+
required: true
17+
default: dev
18+
options:
19+
- dev
20+
- uat
21+
- prod
22+
jobs:
23+
setup:
24+
runs-on: ubuntu-22.04
25+
outputs:
26+
matrix: ${{ steps.setmatrix.outputs.matrix }}
27+
28+
steps:
29+
- name: Set Dynamic Env Matrix
30+
id: setmatrix
31+
run: |
32+
echo "github.ref ${{ github.ref }}"
33+
echo "event name ${{ github.event_name }}"
34+
35+
if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
36+
if [ "${{ github.event.inputs.environment }}" == "prod" ]; then
37+
matrixStringifiedObject="{\"include\":[{\"environment\":\"prod\", \"region\":\"eu-south-1\"}, {\"environment\":\"prod\", \"region\":\"eu-central-1\"}]}"
38+
else
39+
matrixStringifiedObject="{\"include\":[{\"environment\":\"${{ github.event.inputs.environment }}\", \"region\":\"eu-south-1\"}]}"
40+
fi
41+
else
42+
matrixStringifiedObject="{\"include\":[{\"environment\":\"dev\", \"region\":\"eu-south-1\"}, {\"environment\":\"uat\", \"region\":\"eu-south-1\"}, {\"environment\":\"prod\", \"region\":\"eu-south-1\"}, {\"environment\":\"prod\", \"region\":\"eu-central-1\"}]}"
43+
fi
44+
45+
echo "matrix=$matrixStringifiedObject" >> $GITHUB_OUTPUT
46+
47+
build:
48+
runs-on: ubuntu-22.04
49+
steps:
50+
- name: Checkout code
51+
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
52+
53+
- name: Zip Lambda
54+
working-directory: src/oneid/oneid-lambda-pdv-reconciler
55+
run: |
56+
mkdir -p ./target && zip -r target/oneid-lambda-pdv-reconciler.zip . -x "*.dist-info/*" -x "target/*"
57+
58+
- name: Archive build artifacts
59+
uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808
60+
with:
61+
name: pdv-reconciler-lambda
62+
path: ./src/oneid/oneid-lambda-pdv-reconciler/target/oneid-lambda-pdv-reconciler.zip
63+
64+
deploy:
65+
name: Deploy lambda pdv reconciler ${{ matrix.environment }}-${{ matrix.region }}
66+
if: ${{ needs.setup.outputs.matrix != '' }}
67+
runs-on: ubuntu-22.04
68+
needs: [ setup, build ]
69+
strategy:
70+
matrix: ${{ fromJson(needs.setup.outputs.matrix) }}
71+
72+
continue-on-error: false
73+
environment: ${{ matrix.environment == 'prod' && format('{0}/{1}', matrix.environment, matrix.region) || matrix.environment }}
74+
env:
75+
ENV_SHORT: ${{ fromJSON('{"dev":"d","uat":"u","prod":"p"}')[matrix.environment] }}
76+
REGION_SHORT: ${{ fromJSON('{"eu-south-1":"es-1","eu-central-1":"ec-1"}')[matrix.region] }}
77+
permissions:
78+
id-token: write
79+
contents: read
80+
81+
steps:
82+
- name: Download build artifacts
83+
uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e
84+
with:
85+
name: pdv-reconciler-lambda
86+
path: ./src/oneid/oneid-lambda-pdv-reconciler/target
87+
88+
- name: Configure AWS Credentials
89+
uses: aws-actions/configure-aws-credentials@e3dd6a429d7300a6a4c196c26e071d42e0343502
90+
with:
91+
role-to-assume: ${{ vars.IAM_ROLE_DEPLOY_LAMBDA }}
92+
aws-region: ${{ matrix.region }}
93+
94+
- name: Update Lambda function (${{ matrix.environment }})
95+
run: |
96+
aws s3 cp src/oneid/oneid-lambda-pdv-reconciler/target/oneid-lambda-pdv-reconciler.zip s3://${{vars.LAMBDA_CODE_BUCKET_NAME}}/${{vars.LAMBDA_PDV_RECONCILER_KEY}}
97+
98+
- name: Deploy Lambda function (${{ matrix.environment }})
99+
run: |
100+
aws lambda update-function-code \
101+
--function-name oneid-${{ env.REGION_SHORT }}-${{ env.ENV_SHORT }}-pdv-reconciler \
102+
--s3-bucket ${{vars.LAMBDA_CODE_BUCKET_NAME}} --s3-key ${{vars.LAMBDA_PDV_RECONCILER_KEY}}

‎src/infra/dev/eu-south-1/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,6 +176,7 @@
176176
| <a name="input_metadata_info"></a> [metadata\_info](#input\_metadata\_info) | # Metadata Info variables## | <pre>object({<br/> acs_url = string<br/> slo_url = string<br/> })</pre> | <pre>{<br/> "acs_url": "/saml/acs",<br/> "slo_url": "/saml/slo"<br/>}</pre> | no |
177177
| <a name="input_number_of_images_to_keep"></a> [number\_of\_images\_to\_keep](#input\_number\_of\_images\_to\_keep) | Number of images to keeps in ECR. | `number` | `5` | no |
178178
| <a name="input_pairwise_enabled"></a> [pairwise\_enabled](#input\_pairwise\_enabled) | Enable PDV pairwise feature | `bool` | `true` | no |
179+
| <a name="input_pdv_base_url"></a> [pdv\_base\_url](#input\_pdv\_base\_url) | PDV base URL | `string` | `"https://api.dev.pdv.pagopa.it"` | no |
179180
| <a name="input_r53_dns_zone"></a> [r53\_dns\_zone](#input\_r53\_dns\_zone) | # R53 DNS zone ## | <pre>object({<br/> name = string<br/> comment = string<br/> })</pre> | <pre>{<br/> "comment": "Oneidentity dev zone.",<br/> "name": "dev.oneid.pagopa.it"<br/>}</pre> | no |
180181
| <a name="input_repository_image_tag_mutability"></a> [repository\_image\_tag\_mutability](#input\_repository\_image\_tag\_mutability) | The tag mutability setting for the repository. Must be one of: MUTABLE or IMMUTABLE. Defaults to IMMUTABLE | `string` | `"MUTABLE"` | no |
181182
| <a name="input_rest_api_throttle_settings"></a> [rest\_api\_throttle\_settings](#input\_rest\_api\_throttle\_settings) | Rest api throttle settings. | <pre>object({<br/> burst_limit = number<br/> rate_limit = number<br/> })</pre> | <pre>{<br/> "burst_limit": 100,<br/> "rate_limit": 50<br/>}</pre> | no |

‎src/infra/dev/eu-south-1/main.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -251,7 +251,7 @@ module "backend" {
251251
},
252252
{
253253
name = "PDV_BASE_URL"
254-
value = "https://api.dev.pdv.pagopa.it"
254+
value = var.pdv_base_url
255255
},
256256
{
257257
name = "PDV_ERROR_QUEUE_URL"
@@ -555,7 +555,8 @@ module "backend" {
555555
vpc_tls_security_group_endpoint_id = module.network.security_group_vpc_tls_id
556556
pdv_errors_queue_arn = module.sqs.sqs_queue_arn
557557
environment_variables = {
558-
"LOG_LEVEL" = var.app_log_level
558+
"LOG_LEVEL" = var.app_log_level
559+
"PDV_BASE_URL" = var.pdv_base_url
559560
}
560561
}
561562

‎src/infra/dev/eu-south-1/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -772,3 +772,9 @@ variable "pairwise_enabled" {
772772
default = true
773773
description = "Enable PDV pairwise feature"
774774
}
775+
776+
variable "pdv_base_url" {
777+
type = string
778+
default = "https://api.dev.pdv.pagopa.it"
779+
description = "PDV base URL"
780+
}

‎src/infra/modules/backend/lambda.tf‎

Lines changed: 13 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -987,12 +987,8 @@ module "pdv_reconciler_lambda" {
987987
ignore_source_code_hash = true
988988

989989

990-
attach_policy_json = true
991-
policy_json = data.aws_iam_policy_document.pdv_reconciler_lambda.json
992-
attach_network_policy = true
993-
994-
vpc_subnet_ids = var.pdv_reconciler_lambda.vpc_subnet_ids
995-
vpc_security_group_ids = [module.security_group_lambda_pdv_reconciler.security_group_id]
990+
attach_policy_json = true
991+
policy_json = data.aws_iam_policy_document.pdv_reconciler_lambda.json
996992

997993
publish = true
998994

@@ -1030,36 +1026,20 @@ data "aws_iam_policy_document" "pdv_reconciler_lambda" {
10301026
var.pdv_reconciler_lambda.pdv_errors_queue_arn
10311027
]
10321028
}
1029+
statement {
1030+
effect = "Allow"
1031+
actions = [
1032+
"ssm:Describe*",
1033+
"ssm:Get*",
1034+
"ssm:List*"
1035+
]
1036+
resources = [
1037+
"arn:aws:ssm:${var.aws_region}:${var.account_id}:parameter/pdv/*"
1038+
]
1039+
}
10331040

10341041
}
10351042

1036-
module "security_group_lambda_pdv_reconciler" {
1037-
source = "terraform-aws-modules/security-group/aws"
1038-
version = "4.17.2"
1039-
1040-
name = "${var.pdv_reconciler_lambda.name}-sg"
1041-
description = "Security Group for Lambda Egress"
1042-
1043-
vpc_id = var.pdv_reconciler_lambda.vpc_id
1044-
1045-
egress_cidr_blocks = []
1046-
egress_ipv6_cidr_blocks = []
1047-
1048-
# Prefix list ids to use in all egress rules in this module
1049-
egress_prefix_list_ids = [
1050-
]
1051-
1052-
egress_rules = ["https-443-tcp"]
1053-
}
1054-
1055-
resource "aws_vpc_security_group_egress_rule" "pdv_reconciler_sec_group_egress_rule" {
1056-
security_group_id = module.security_group_lambda_pdv_reconciler.security_group_id
1057-
from_port = 443
1058-
ip_protocol = "tcp"
1059-
to_port = 443
1060-
referenced_security_group_id = var.pdv_reconciler_lambda.vpc_tls_security_group_endpoint_id
1061-
}
1062-
10631043
## Cert Expiration Lambda ##
10641044
data "aws_iam_policy_document" "cert_exp_checker_lambda" {
10651045
statement {

‎src/infra/prod/eu-central-1/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,7 @@ No outputs.
142142
| <a name="input_metadata_info"></a> [metadata\_info](#input\_metadata\_info) | # Metadata Info variables## | <pre>object({<br/> acs_url = string<br/> slo_url = string<br/> })</pre> | <pre>{<br/> "acs_url": "/saml/acs",<br/> "slo_url": "/saml/slo"<br/>}</pre> | no |
143143
| <a name="input_number_of_images_to_keep"></a> [number\_of\_images\_to\_keep](#input\_number\_of\_images\_to\_keep) | Number of images to keeps in ECR. | `number` | `10` | no |
144144
| <a name="input_pairwise_enabled"></a> [pairwise\_enabled](#input\_pairwise\_enabled) | Enable PDV pairwise feature | `bool` | `true` | no |
145+
| <a name="input_pdv_base_url"></a> [pdv\_base\_url](#input\_pdv\_base\_url) | PDV base URL | `string` | `"https://api.pdv.pagopa.it"` | no |
145146
| <a name="input_r53_dns_zone"></a> [r53\_dns\_zone](#input\_r53\_dns\_zone) | # R53 DNS zone ## | <pre>object({<br/> name = string<br/> comment = string<br/> })</pre> | <pre>{<br/> "comment": "Oneidentity prod hosted zone.",<br/> "name": "oneid.pagopa.it"<br/>}</pre> | no |
146147
| <a name="input_repository_image_tag_mutability"></a> [repository\_image\_tag\_mutability](#input\_repository\_image\_tag\_mutability) | The tag mutability setting for the repository. Must be one of: MUTABLE or IMMUTABLE. Defaults to IMMUTABLE | `string` | `"MUTABLE"` | no |
147148
| <a name="input_rest_api_throttle_settings"></a> [rest\_api\_throttle\_settings](#input\_rest\_api\_throttle\_settings) | Rest api throttle settings. | <pre>object({<br/> burst_limit = number<br/> rate_limit = number<br/> })</pre> | <pre>{<br/> "burst_limit": 500,<br/> "rate_limit": 300<br/>}</pre> | no |

‎src/infra/prod/eu-central-1/main.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,7 @@ module "backend" {
174174
},
175175
{
176176
name = "PDV_BASE_URL"
177-
value = "https://api.pdv.pagopa.it"
177+
value = var.pdv_base_url
178178
},
179179
{
180180
name = "PDV_ERROR_QUEUE_URL"
@@ -230,7 +230,8 @@ module "backend" {
230230
vpc_tls_security_group_endpoint_id = module.network.security_group_vpc_tls_id
231231
pdv_errors_queue_arn = module.sqs.sqs_queue_arn
232232
environment_variables = {
233-
"LOG_LEVEL" = var.app_log_level
233+
"LOG_LEVEL" = var.app_log_level
234+
"PDV_BASE_URL" = var.pdv_base_url
234235
}
235236
}
236237

‎src/infra/prod/eu-central-1/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -677,3 +677,9 @@ variable "pairwise_enabled" {
677677
default = true
678678
description = "Enable PDV pairwise feature"
679679
}
680+
681+
variable "pdv_base_url" {
682+
type = string
683+
default = "https://api.pdv.pagopa.it"
684+
description = "PDV base URL"
685+
}

‎src/infra/prod/eu-south-1/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,7 @@
166166
| <a name="input_metadata_info"></a> [metadata\_info](#input\_metadata\_info) | # Metadata Info variables## | <pre>object({<br/> acs_url = string<br/> slo_url = string<br/> })</pre> | <pre>{<br/> "acs_url": "/saml/acs",<br/> "slo_url": "/saml/slo"<br/>}</pre> | no |
167167
| <a name="input_number_of_images_to_keep"></a> [number\_of\_images\_to\_keep](#input\_number\_of\_images\_to\_keep) | Number of images to keeps in ECR. | `number` | `10` | no |
168168
| <a name="input_pairwise_enabled"></a> [pairwise\_enabled](#input\_pairwise\_enabled) | Enable PDV pairwise feature | `bool` | `true` | no |
169+
| <a name="input_pdv_base_url"></a> [pdv\_base\_url](#input\_pdv\_base\_url) | PDV base URL | `string` | `"https://api.pdv.pagopa.it"` | no |
169170
| <a name="input_r53_dns_zone"></a> [r53\_dns\_zone](#input\_r53\_dns\_zone) | # R53 DNS zone ## | <pre>object({<br/> name = string<br/> comment = string<br/> })</pre> | <pre>{<br/> "comment": "Oneidentity prod hosted zone.",<br/> "name": "oneid.pagopa.it"<br/>}</pre> | no |
170171
| <a name="input_repository_image_tag_mutability"></a> [repository\_image\_tag\_mutability](#input\_repository\_image\_tag\_mutability) | The tag mutability setting for the repository. Must be one of: MUTABLE or IMMUTABLE. Defaults to IMMUTABLE | `string` | `"MUTABLE"` | no |
171172
| <a name="input_rest_api_throttle_settings"></a> [rest\_api\_throttle\_settings](#input\_rest\_api\_throttle\_settings) | Rest api throttle settings. | <pre>object({<br/> burst_limit = number<br/> rate_limit = number<br/> })</pre> | <pre>{<br/> "burst_limit": 500,<br/> "rate_limit": 300<br/>}</pre> | no |

‎src/infra/prod/eu-south-1/main.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -223,7 +223,7 @@ module "backend" {
223223
},
224224
{
225225
name = "PDV_BASE_URL"
226-
value = "https://api.pdv.pagopa.it"
226+
value = var.pdv_base_url
227227
},
228228
{
229229
name = "PDV_ERROR_QUEUE_URL"
@@ -452,7 +452,8 @@ module "backend" {
452452
vpc_tls_security_group_endpoint_id = module.network.security_group_vpc_tls_id
453453
pdv_errors_queue_arn = module.sqs.sqs_queue_arn
454454
environment_variables = {
455-
"LOG_LEVEL" = var.app_log_level
455+
"LOG_LEVEL" = var.app_log_level
456+
"PDV_BASE_URL" = var.pdv_base_url
456457
}
457458
}
458459

0 commit comments

Comments
 (0)