Skip to content

Commit

Permalink
NIT-1267 rebuild test db
Browse files Browse the repository at this point in the history
  • Loading branch information
@pbasumatary
pbasumatary committed May 28, 2024
1 parent 18876bf commit b2d09e5
Show file tree
Hide file tree
Showing 7 changed files with 82 additions and 43 deletions.
1 change: 1 addition & 0 deletions terraform/environments/delius-core/locals_development.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ locals {
legacy_engineering_vpc_cidr = "10.161.98.0/25"
ec2_user_ssh_key = file("${path.module}/files/.ssh/${terraform.workspace}/ec2-user.pub")
homepage_path = "/"
has_mis_environment = true
}

ldap_config_dev = {
Expand Down
3 changes: 2 additions & 1 deletion terraform/environments/delius-core/locals_test.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ locals {
legacy_engineering_vpc_cidr = "10.161.98.0/25"
ec2_user_ssh_key = file("${path.module}/files/.ssh/${terraform.workspace}/ec2-user.pub")
homepage_path = "/"
has_mis_environment = false
}

ldap_config_test = {
Expand All @@ -34,7 +35,7 @@ locals {
instance_policies = {
"business_unit_kms_key_access" = aws_iam_policy.business_unit_kms_key_access
}
standby_count = 0
standby_count = 0
ebs_volumes = {
"/dev/sdb" = { label = "app", size = 200 } # /u01
"/dev/sdc" = { label = "app", size = 100 } # /u02
Expand Down
9 changes: 4 additions & 5 deletions terraform/environments/delius-core/modules/components/oracle_db_shared/iam.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -151,17 +151,16 @@ data "aws_iam_policy_document" "db_access_to_secrets_manager" {
]
effect = "Allow"
resources = [
aws_secretsmanager_secret.delius_core_dba_passwords.arn,
aws_secretsmanager_secret.delius_core_application_passwords.arn
aws_secretsmanager_secret.delius_core_dba_passwords.arn
]
}
}

data "aws_iam_policy_document" "allow_access_to_delius_application_passwords" {
statement {
sid = "DbAccessToDeliusSecretsManager"
sid = "DbAccessToDeliusSecretsManager"
actions = ["secretsmanager:GetSecretValue"]
effect = "Allow"
effect = "Allow"
resources = [
"arn:aws:secretsmanager:*:${local.delius_account_id}:secret:delius-core-${var.env_name}-oracle-db-application-passwords-*"
]
Expand All @@ -171,7 +170,7 @@ data "aws_iam_policy_document" "allow_access_to_delius_application_passwords" {
data "aws_iam_policy_document" "combined_policy_documents" {
source_policy_documents = flatten([
data.aws_iam_policy_document.db_access_to_secrets_manager.json,
var.db_suffix == "mis-db" ? [data.aws_iam_policy_document.allow_access_to_delius_application_passwords.json] : []])
var.db_suffix == "mis-db" ? [data.aws_iam_policy_document.allow_access_to_delius_application_passwords.json] : []])
}

resource "aws_iam_policy" "db_access_to_secrets_manager" {
Expand Down
36 changes: 0 additions & 36 deletions terraform/environments/delius-core/modules/components/oracle_db_shared/secrets.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,39 +32,3 @@ resource "aws_secretsmanager_secret_version" "delius_core_dba_passwords" {
]
}
}

resource "aws_secretsmanager_secret" "delius_core_application_passwords" {
name = local.application_secret_name
description = "Application Users Credentials"
kms_key_id = var.account_config.kms_keys.general_shared
tags = var.tags
}

data "aws_iam_policy_document" "delius_core_application_passwords" {
statement {
sid = "MisAWSAccountToReadTheSecret"
effect = "Allow"
principals {
type = "AWS"
identifiers = ["arn:aws:iam::${local.mis_account_id}:role/instance-role-delius-mis-${var.env_name}-mis-db-1"]
}
actions = ["secretsmanager:GetSecretValue"]
resources = [aws_secretsmanager_secret.delius_core_application_passwords.arn]
}
}

resource "aws_secretsmanager_secret_policy" "delius_core_application_passwords" {
count = var.account_info.application_name == "delius-core" ? 1 : 0
secret_arn = aws_secretsmanager_secret.delius_core_application_passwords.arn
policy = data.aws_iam_policy_document.delius_core_application_passwords.json
}

resource "aws_secretsmanager_secret_version" "delius_core_application_passwords" {
secret_id = aws_secretsmanager_secret.delius_core_application_passwords.id
secret_string = "REPLACE"
lifecycle {
ignore_changes = [
secret_string
]
}
}
64 changes: 63 additions & 1 deletion terraform/environments/delius-core/modules/delius_environment/database.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,7 @@ module "oracle_db_standby" {
environment_config = var.environment_config
subnet_id = var.account_config.ordered_private_subnet_ids[(count.index + length(module.oracle_db_primary)) % 3]
availability_zone = "eu-west-2${lookup(local.availability_zone_map, (count.index + length(module.oracle_db_primary)) % 3, "a")}"
tags = merge(local.tags, { "Patch Group" = "oracle_db_patchgroup" })
tags = merge(local.tags, { "Patch Group" = "oracle_db_patchgroup" })
user_data = templatefile(
"${path.module}/templates/userdata.sh.tftpl",
var.db_config.ansible_user_data_config
Expand All @@ -120,3 +120,65 @@ module "oracle_db_standby" {
aws.core-vpc = aws.core-vpc
}
}

resource "aws_secretsmanager_secret" "delius_core_application_passwords_secret" {
count = local.has_mis_environment ? 1 : 0

name = local.application_secret_name
description = "Application Users Credentials"
kms_key_id = var.account_config.kms_keys.general_shared
tags = var.tags
}

data "aws_iam_policy_document" "delius_core_application_passwords_policy_doc" {

count = local.has_mis_environment ? 1 : 0
statement {
sid = "MisAWSAccountToReadTheSecret"
effect = "Allow"
principals {
type = "AWS"
identifiers = ["arn:aws:iam::${local.mis_account_id}:role/instance-role-delius-mis-${var.env_name}-mis-db-1"]
}
actions = ["secretsmanager:GetSecretValue"]
resources = [aws_secretsmanager_secret.delius_core_application_passwords_secret[count.index].arn]
}
}

resource "aws_secretsmanager_secret_policy" "delius_core_application_passwords_pol" {
count = local.has_mis_environment ? 1 : 0

secret_arn = aws_secretsmanager_secret.delius_core_application_passwords_secret[count.index].arn
policy = data.aws_iam_policy_document.delius_core_application_passwords_policy_doc[count.index].json
}

resource "aws_secretsmanager_secret_version" "delius_core_application_passwords" {
count = local.has_mis_environment ? 1 : 0

secret_id = aws_secretsmanager_secret.delius_core_application_passwords_secret[count.index].id
secret_string = "REPLACE"
lifecycle {
ignore_changes = [
secret_string
]
}
}

data "aws_iam_policy_document" "db_access_to_secrets_manager" {
count = local.has_mis_environment ? 1 : 0
statement {
sid = "DbAccessToSecretsManager"
actions = [
"secretsmanager:Describe*",
"secretsmanager:Get*",
"secretsmanager:ListSecret*",
"secretsmanager:Put*",
"secretsmanager:RestoreSecret",
"secretsmanager:Update*"
]
effect = "Allow"
resources = [
aws_secretsmanager_secret.delius_core_application_passwords_secret[count.index].arn
]
}
}
6 changes: 6 additions & 0 deletions terraform/environments/delius-core/modules/delius_environment/locals.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -37,4 +37,10 @@ locals {
"217.138.45.110/32", # Unilink AOVPN
]
all_ingress_ips = concat(local.globalprotect_ips, local.unilink_ips)

secret_prefix = "${var.account_info.application_name}-${var.env_name}-oracle-${var.db_suffix}"
application_secret_name = "${local.secret_prefix}-application-passwords"
mis_account_id = var.platform_vars.environment_management.account_ids[join("-", ["delius-mis", var.account_info.mp_environment])]

has_mis_environment = lookup(var.environment_config, "has_mis_environment", false)
}
6 changes: 6 additions & 0 deletions terraform/environments/delius-core/modules/delius_environment/variables.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -106,3 +106,9 @@ variable "enable_platform_backups" {
type = bool
default = null
}

variable "db_suffix" {
description = "identifier to append to name e.g. dsd, boe"
type = string
default = "db"
}

0 comments on commit b2d09e5

Please sign in to comment.