Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add sso-readonly provider to platform_providers #4931

Merged
merged 2 commits into from
Feb 12, 2024

Conversation

dms1981
Copy link
Contributor

@dms1981 dms1981 commented Feb 12, 2024

Adds a new provider block - aws.sso-readonly - to allow customers to conduct data call lookups against SSO/IdentityStore in the MOJ root account.

Also adds an example showing a data call based off of the Hashicorp documentation.

@dms1981 dms1981 requested a review from a team as a code owner February 12, 2024 13:03
@github-actions github-actions bot added the environments-repository Used to exclude PRs from this repo in our Slack PR update label Feb 12, 2024
@dms1981 dms1981 had a problem deploying to laa-oem-development February 12, 2024 13:05 — with GitHub Actions Failure
@dms1981 dms1981 temporarily deployed to hmpps-intelligence-management-development February 12, 2024 13:05 — with GitHub Actions Inactive
@dms1981 dms1981 had a problem deploying to cdpt-ifs-development February 12, 2024 13:05 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to data-and-insights-wepi-development February 12, 2024 13:05 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to corporate-staff-rostering-development February 12, 2024 13:05 — with GitHub Actions Failure
Copy link
Contributor

TFSEC Scan Success

Show Output ```hcl

TFSEC will check the following folders:
terraform/environments/corporate-staff-rostering


Running TFSEC in terraform/environments/corporate-staff-rostering
Excluding the following checks: AWS095

======================================================
tfsec is joining the Trivy family

tfsec will continue to remain available
for the time being, although our engineering
attention will be directed at Trivy going forward.

You can read more here:
aquasecurity/tfsec#1994

timings
──────────────────────────────────────────
disk i/o 1.667455ms
parsing 257.904758ms
adaptation 150.655µs
checks 10.194379ms
total 269.917247ms

counts
──────────────────────────────────────────
modules downloaded 0
modules processed 5
blocks processed 291
files read 76

results
──────────────────────────────────────────
passed 1
ignored 1
critical 0
high 0
medium 0
low 0

No problems detected!

tfsec_exitcode=0

</details> #### `Checkov Scan` Failed
<details><summary>Show Output</summary>

```hcl

*****************************

Checkov will check the following folders:
terraform/environments/corporate-staff-rostering

*****************************

Running Checkov in terraform/environments/corporate-staff-rostering
2024-02-12 13:05:52,707 [MainThread  ] [WARNI]  Failed to download module github.com/ministryofjustice/modernisation-platform-terraform-lambda-function:None (for external modules, the --download-external-modules flag is required)
terraform scan results:

Passed checks: 142, Failed checks: 1, Skipped checks: 26

Check: CKV_TF_1: "Ensure Terraform module sources use a commit hash"
	FAILED for resource: ad-clean-up-lambda
	File: /lambda.tf:7-33
	Guide: https://docs.prismacloud.io/en/enterprise-edition/policy-reference/supply-chain-policies/terraform-policies/ensure-terraform-module-sources-use-git-url-with-commit-hash-revision

		7  | module "ad-clean-up-lambda" {
		8  |   source = "github.com/ministryofjustice/modernisation-platform-terraform-lambda-function" # ref for V3.1
		9  |   count  = local.environment == "test" ? 1 : 0                                             # temporary whilst on-going work
		10 | 
		11 | 
		12 |   application_name = local.lambda_ad_object_cleanup.function_name
		13 |   function_name    = local.lambda_ad_object_cleanup.function_name
		14 |   description      = "Lambda to remove corresponding computer object from Active Directory upon server termination"
		15 |   package_type     = "Zip"
		16 |   filename         = data.archive_file.ad-cleanup-lambda.output_path
		17 |   source_code_hash = data.archive_file.ad-cleanup-lambda.output_base64sha256
		18 |   handler          = "lambda_function.lambda_handler"
		19 |   runtime          = "python3.8"
		20 | 
		21 |   create_role = false
		22 |   lambda_role = aws_iam_role.lambda-ad-role[count.index].arn
		23 | 
		24 |   vpc_subnet_ids         = tolist(data.aws_subnets.shared-private.ids)
		25 |   vpc_security_group_ids = [module.baseline.security_groups["domain"].id]
		26 | 
		27 |   tags = merge(
		28 |     local.tags,
		29 |     {
		30 |       Name = "ad-object-clean-up-lambda"
		31 |     },
		32 |   )
		33 | }


checkov_exitcode=1

CTFLint Scan Failed

Show Output
*****************************

Setting default tflint config...
Running tflint --init...
Installing "terraform" plugin...
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.5.0)
tflint will check the following folders:
terraform/environments/corporate-staff-rostering

*****************************

Running tflint in terraform/environments/corporate-staff-rostering
Excluding the following checks: terraform_unused_declarations
2 issue(s) found:

Warning: Module source "github.com/ministryofjustice/modernisation-platform-terraform-lambda-function" is not pinned (terraform_module_pinned_source)

  on terraform/environments/corporate-staff-rostering/lambda.tf line 8:
   8:   source = "github.com/ministryofjustice/modernisation-platform-terraform-lambda-function" # ref for V3.1

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_module_pinned_source.md

Warning: Missing version constraint for provider "archive" in `required_providers` (terraform_required_providers)

  on terraform/environments/corporate-staff-rostering/lambda.tf line 35:
  35: data "archive_file" "ad-cleanup-lambda" {

Reference: https://github.com/terraform-linters/tflint-ruleset-terraform/blob/v0.5.0/docs/rules/terraform_required_providers.md

tflint_exitcode=2

Trivy Scan

Show Output

@dms1981 dms1981 had a problem deploying to electronic-monitoring-data-development February 12, 2024 13:06 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to digital-prison-reporting-development February 12, 2024 13:06 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to cdpt-chaps-development February 12, 2024 13:06 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to observability-platform-development February 12, 2024 13:06 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to delius-jitbit-development February 12, 2024 13:06 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to data-platform-apps-and-tools-development February 12, 2024 13:07 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to laa-ccms-infra-azure-ad-sso-development February 12, 2024 13:07 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to nomis-data-hub-development February 12, 2024 13:07 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to delius-mis-development February 12, 2024 13:07 — with GitHub Actions Failure
@dms1981 dms1981 temporarily deployed to tariff-development February 12, 2024 13:07 — with GitHub Actions Inactive
@dms1981 dms1981 had a problem deploying to nomis-combined-reporting-development February 12, 2024 13:07 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to performance-hub-development February 12, 2024 13:07 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to pra-register-development February 12, 2024 13:07 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to delius-core-development February 12, 2024 13:07 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to wardship-development February 12, 2024 13:07 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to ccms-ebs-upgrade-development February 12, 2024 13:07 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to hmpps-domain-services-development February 12, 2024 13:07 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to ccms-ebs-development February 12, 2024 13:08 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to xhibit-portal-development February 12, 2024 13:08 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to digital-prison-reporting-test February 12, 2024 13:09 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to hmpps-domain-services-test February 12, 2024 13:09 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to tipstaff-development February 12, 2024 13:09 — with GitHub Actions Failure
@dms1981 dms1981 had a problem deploying to nomis-combined-reporting-test February 12, 2024 13:10 — with GitHub Actions Failure
@dms1981 dms1981 merged commit bf6c452 into main Feb 12, 2024
342 of 411 checks passed
@dms1981 dms1981 deleted the feature/6035-identity-store branch February 12, 2024 15:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
environments-repository Used to exclude PRs from this repo in our Slack PR update
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants