Merge pull request #4215 from ministryofjustice/performance-hub/runbo…

…ok-review

Runbook review and infra code cleanup

terraform/environments/performance-hub/README.md

@@ -9,17 +9,18 @@ _If you have any questions surrounding this page please post in the `#performanc
 
 ### **Last review date:**
 
-18th October 2022
+1st December 2023
 
 ### **Description:**
 
 The HMPPS Performance Hub is a .NET Framework application with SQL Server database, which ingests data from various sources to produce performance metrics and reports for prisons and probation.
 
-It only holds aggreagted or anonymised information. Data ingestion is generally via manual upload of Excel and CSV files rather than direct feeds from other systems.
+It only holds aggreagted or anonymised information. Data ingestion is generally via manual upload of Excel and CSV files rather than direct feeds from other systems (exceptions explained below under dependencies).
 
 ### **Service URLs:**
 
 Prod: [https://hmpps-performance-hub.service.justice.gov.uk/](https://hmpps-performance-hub.service.justice.gov.uk/)
+
 Preprod: [https://staging.hmpps-performance-hub.service.justice.gov.uk/](https://staging.hmpps-performance-hub.service.justice.gov.uk/)
 
 ### **Incident response hours:**
@@ -47,15 +48,13 @@ Modernisation Platform
 
 GitHub repo: [https://github.com/ministryofjustice/performance-hub](https://github.com/ministryofjustice/performance-hub)
 
-GOV.UK Notify account: [https://www.notifications.service.gov.uk/services/1c1d15f2-46b4-4167-a8f1-18f5d65bd6f9](https://www.notifications.service.gov.uk/services/1c1d15f2-46b4-4167-a8f1-18f5d65bd6f9)
-
 ### **Expected speed and frequency of releases:**
 
-The typical release cycle is weekly to preprod and monthly to prod.
+The typical release cycle is weekly to preprod and monthly to prod. This is determined by stakeholder review cycles rather than technical reasons.
 
 ### **Automatic alerts:**
 
-Unhandled exceptions and serious errors generate email alerts to <[email protected]>
+Unhandled exceptions and errors generate email alerts to <[email protected]>
 
 ### **Impact of an outage:**
 
@@ -69,10 +68,12 @@ There are no official out of hours response arrangements (see ["imapct of an out
 
 ### **Consumers of this service:**
 
-There are no direct consumers of the application. The Performance Hub does periodically drop data exports into an Analytical Platform landing bucket (a "push" to the AP rather than a "pull"), but the AP itself does not depend on this data.
+There are no direct consumers of the application. The Performance Hub does periodically drop data exports into an Analytical Platform landing bucket via Data Engineering's [register-my-data](https://github.com/ministryofjustice/register-my-data/tree/main/stacks/hmpps-performance-hub) service.
 
 ### **Services consumed by this:**
 
-The Performance Hub periodically performs automatic overnight data imports of data dropped into an Analyical Platform bucket. There are "manual" alternatives to this if it fails - users can upload data into the application directly.
+The Performance Hub periodically performs automatic overnight data imports of data dropped into an Analyical Platform bucket. This is done via the [data-engineering-exports](https://github.com/moj-analytical-services/data-engineering-exports/blob/main/push_datasets/) service (for example `prison_incidents.yaml`, `prison_performance.yaml`). Note this is held in the `moj-analytical-services` GitHub organisation.
+
+There are "manual" alternatives to this if it fails - users can upload data into the application directly.
 
-There is also a dependency on the GOV.UK Notify serice (see ["other URLs"](#other-urls) above).
+There is also a dependency on the GOV.UK Notify service.

terraform/environments/performance-hub/iam.tf

@@ -1,78 +0,0 @@
-#------------------------------------------------------------------------------
-# IAM for S3 data movement operations to and from the Analytical Platform (AP)
-# 
-#------------------------------------------------------------------------------
-
-# S3 bucket access policy for AP landing bucket (data pushed from 
-# Performance Hub to a bucket in the AP account - hence hard-coded bucket name)
-
-# resource "aws_iam_role" "s3_ap_landing_role" {
-#   name               = "${local.application_name}-s3-ap-landing-role"
-#   assume_role_policy = jsonencode({
-#     Version = "2012-10-17"
-#     Statement = [
-#         {
-#             Sid: "MOJAnalyticalPlatformListBucket",
-#             Effect: "Allow",
-#             Action: [
-#                 "s3:ListBucket",
-#                 "s3:GetBucketLocation"
-#             ],
-#             "Resource": "arn:aws:s3:::hmpps-performance-hub-landing"
-#         },
-#         {
-#             Sid: "MOJAnalyticalPlatformWriteBucket",
-#             Effect: "Allow",
-#             Action: [
-#                 "s3:PutObject",
-#                 "s3:PutObjectAcl",
-#                 "s3:GetObject"
-#             ],
-#             Resource: "arn:aws:s3:::hmpps-performance-hub-landing/*"
-#         }
-#     ]
-#   })
-#   tags = merge(
-#     local.tags,
-#     {
-#       Name = "${local.application_name}-s3-ap-landing-role"
-#     }
-#   )
-# }
-
-
-# S3 bucket access policy for Performance Hub landing bucket (data pushed from 
-# AP to a bucket in this account)
-# Legacy account was arn:aws:iam::677012035582:policy/land-data-access-policy
-resource "aws_iam_policy" "s3_hub_Landing_policy" {
-  name   = "${local.application_name}-s3-hub-landing-policy"
-  policy = <<EOF
-{
-  "Version": "2012-10-17",
-    "Statement": [
-        {
-            "Sid": "HubLandBucketLevel",
-            "Effect": "Allow",
-            "Action": [
-                "s3:ListBucket"
-            ],
-            "Resource": [
-                "${module.ap_landing_bucket.bucket.arn}"
-            ]
-        },
-        {
-            "Sid": "HubLandObjectLevel",
-            "Effect": "Allow",
-            "Action": [
-                "s3:GetObjectAcl",
-                "s3:GetObject",
-                "s3:DeleteObject"
-            ],
-            "Resource": [
-                "${module.ap_landing_bucket.bucket.arn}/*"
-            ]
-        }
-    ]
-}
-EOF
-}

terraform/environments/performance-hub/secrets.tf

@@ -140,6 +140,7 @@ resource "aws_secretsmanager_secret_version" "ap_export_secret_access_key" {
 resource "aws_secretsmanager_secret" "pecs_basm_prod_access_key_id" {
   #checkov:skip=CKV_AWS_149
   name = "pecs_basm_prod_access_key_id"
+  recovery_window_in_days = 0
   tags = merge(
     local.tags,
     {
@@ -156,6 +157,7 @@ resource "aws_secretsmanager_secret_version" "pecs_basm_prod_access_key_id" {
 resource "aws_secretsmanager_secret" "pecs_basm_prod_secret_access_key" {
   #checkov:skip=CKV_AWS_149
   name = "pecs_basm_prod_secret_access_key"
+  recovery_window_in_days = 0
   tags = merge(
     local.tags,
     {