Skip to content

Commit

Permalink
Merge pull request #340 from ministryofjustice/nd-386-3
Browse files Browse the repository at this point in the history
Nd 386 3
  • Loading branch information
jamesgreen-moj authored Jul 3, 2024
2 parents 08a2356 + 3fe21d2 commit da04a14
Show file tree
Hide file tree
Showing 8 changed files with 177 additions and 13 deletions.
6 changes: 5 additions & 1 deletion Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -75,9 +75,13 @@ init-upgrade: ## terraform init -upgrade
$(DOCKER_RUN) terraform init -upgrade --backend-config="key=terraform.$$ENV.state"
.PHONY: import
import: ## terraform import e.g. (make import IMPORT_ARGUMENT=module.foo.bar some_resource)
import: ## terraform import e.g. (make import IMPORT_ARGUMENT="module.foo.bar some_resource")
$(DOCKER_RUN) terraform import $$IMPORT_ARGUMENT
.PHONY: rm
rm: ## terraform import e.g. (make rm RM_ARGUMENT="module.foo.bar")
$(DOCKER_RUN) terraform state rm $$RM_ARGUMENT
.PHONY: workspace-list
workspace-list: ## terraform workspace list
$(DOCKER_RUN) terraform workspace list
Expand Down
1 change: 0 additions & 1 deletion buildspec.yml
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,6 @@ env:
TF_VAR_dns_load_balancer_private_ip_eu_west_2b: "/staff-device/dns/$ENV/load_balancer_private_ip_eu_west_2b"
TF_VAR_dns_route53_resolver_ip_eu_west_2a: "/staff-device/dns/$ENV/dns_route53_resolver_ip_eu_west_2a"
TF_VAR_dns_route53_resolver_ip_eu_west_2b: "/staff-device/dns/$ENV/dns_route53_resolver_ip_eu_west_2b"
TF_VAR_admin_sentry_dsn: "/staff-device/admin/sentry_dsn"
TF_VAR_dns_private_zone: "/staff-device/admin/$ENV/dns_private_zone"
TF_VAR_bastion_allowed_ingress_ip: "/staff-device/corsham_testing/bastion_allowed_ingress_ip"
TF_VAR_bastion_allowed_egress_ip: "/staff-device/corsham_testing/bastion_allowed_egress_ip"
Expand Down
36 changes: 27 additions & 9 deletions data.tf
Original file line number Diff line number Diff line change
Expand Up @@ -21,39 +21,57 @@ data "aws_secretsmanager_secret_version" "xsiam_secrets_version" {
}

data "aws_ssm_parameter" "dhcp_db_username" {
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.current.account_id}:parameter/codebuild/dhcp/${var.env}/db/username"
provider = "aws.env"
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.target_account.account_id}:parameter/codebuild/dhcp/${terraform.workspace}/db/username"
#depends_on = [aws_ssm_parameter.codebuild_dhcp_env_db_username]
}

data "aws_ssm_parameter" "dhcp_db_password" {
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.current.account_id}:parameter/codebuild/dhcp/${var.env}/db/password"
provider = "aws.env"
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.target_account.account_id}:parameter/codebuild/dhcp/${terraform.workspace}/db/password"
#depends_on = [aws_ssm_parameter.codebuild_dhcp_env_db_password]
}

data "aws_ssm_parameter" "admin_db_username" {
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.current.account_id}:parameter/codebuild/dhcp/${var.env}/admin/db/username"
provider = "aws.env"
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.target_account.account_id}:parameter/codebuild/dhcp/${terraform.workspace}/admin/db/username"
#depends_on = [aws_ssm_parameter.codebuild_dhcp_env_admin_db_username]
}

data "aws_ssm_parameter" "admin_db_password" {
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.current.account_id}:parameter/codebuild/dhcp/${var.env}/admin/db/password"
provider = "aws.env"
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.target_account.account_id}:parameter/codebuild/dhcp/${terraform.workspace}/admin/db/password"
#depends_on = [aws_ssm_parameter.codebuild_dhcp_env_admin_db_password]
}

data "aws_ssm_parameter" "dns_private_zone" {
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.current.account_id}:parameter/staff-device/admin/${var.env}/dns_private_zone"
provider = "aws.env"
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.target_account.account_id}:parameter/staff-device/admin/${terraform.workspace}/dns_private_zone"
#depends_on = [aws_ssm_parameter.staff_device_admin_env_dns_private_zone]
}

data "aws_ssm_parameter" "api_basic_auth_username" {
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.current.account_id}:parameter/codebuild/dhcp/${var.env}/admin/api/basic_auth_username"
provider = "aws.env"
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.target_account.account_id}:parameter/codebuild/dhcp/${terraform.workspace}/admin/api/basic_auth_username"
#depends_on = [aws_ssm_parameter.codebuild_dhcp_env_admin_api_basic_auth_username]
// "http basic auth username for the dhcp-stats api endpoint"
}

data "aws_ssm_parameter" "api_basic_auth_password" {
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.current.account_id}:parameter/codebuild/dhcp/${var.env}/admin/api/basic_auth_password"
provider = "aws.env"
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.target_account.account_id}:parameter/codebuild/dhcp/${terraform.workspace}/admin/api/basic_auth_password"
#depends_on = [aws_ssm_parameter.codebuild_dhcp_env_admin_api_basic_auth_password]
// "http basic auth password for the dhcp-stats api endpoint"
}

data "aws_ssm_parameter" "dhcp_load_balancer_private_ip_eu_west_2a" {
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.current.account_id}:parameter/staff-device/dhcp/${var.env}/load_balancer_private_ip_eu_west_2a"
provider = "aws.env"
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.target_account.account_id}:parameter/staff-device/dhcp/${terraform.workspace}/load_balancer_private_ip_eu_west_2a"
#depends_on = [aws_ssm_parameter.staff_device_dhcp_env_load_balancer_private_ip_eu_west_2a]
}

data "aws_ssm_parameter" "dhcp_load_balancer_private_ip_eu_west_2b" {
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.current.account_id}:parameter/staff-device/dhcp/${var.env}/load_balancer_private_ip_eu_west_2b"
provider = "aws.env"
name = "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.target_account.account_id}:parameter/staff-device/dhcp/${terraform.workspace}/load_balancer_private_ip_eu_west_2b"
#depends_on = [aws_ssm_parameter.staff_device_dhcp_env_load_balancer_private_ip_eu_west_2b]
}
4 changes: 3 additions & 1 deletion main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,9 @@ terraform {
}
}

data "aws_caller_identity" "current" {}
data "aws_caller_identity" "target_account" {
provider = "aws.env"
}

provider "mysql" {
endpoint = module.dhcp.rds.endpoint
Expand Down
13 changes: 13 additions & 0 deletions modules/admin/outputs.tf
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,19 @@ output "admin_db_identifier" {
value = aws_db_instance.admin_db.identifier
}

output "admin_db_details" {
value = jsondecode(<<EOF
{
"engine": "${aws_db_instance.admin_db.engine}",
"host": "${aws_db_instance.admin_db.endpoint}",
"port": "${aws_db_instance.admin_db.port}",
"dbname": "${aws_db_instance.admin_db.db_name}",
"dbClusterIdentifier": "${aws_db_instance.admin_db.identifier}"
}
EOF
)
}

output "admin_url" {
value = aws_route53_record.admin_app.fqdn
}
Expand Down
13 changes: 13 additions & 0 deletions modules/dhcp/outputs.tf
Original file line number Diff line number Diff line change
Expand Up @@ -107,3 +107,16 @@ output "security_group_ids" {
dhcp_server = aws_security_group.dhcp_server.id
}
}

output "dhcp_db_details" {
value = jsondecode(<<EOF
{
"engine": "${aws_db_instance.dhcp_server_db.engine}",
"host": "${aws_db_instance.dhcp_server_db.endpoint}",
"port": "${aws_db_instance.dhcp_server_db.port}",
"dbname": "${aws_db_instance.dhcp_server_db.db_name}",
"dbClusterIdentifier": "${aws_db_instance.dhcp_server_db.identifier}"
}
EOF
)
}
2 changes: 1 addition & 1 deletion modules/dns/ecs_task_definition.tf
Original file line number Diff line number Diff line change
Expand Up @@ -34,7 +34,7 @@ resource "aws_ecs_task_definition" "server_task" {
"secrets": [
{
"name": "SENTRY_DSN",
"valueFrom": "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.current.account_id}:parameter/staff-device/dhcp/sentry_dsn"
"valueFrom": "arn:aws:ssm:eu-west-2:${data.aws_caller_identity.current.account_id}:parameter/staff-device/dns/sentry_dsn"
}
],
"image": "${module.dns_dhcp_common.ecr.repository_url}",
Expand Down
115 changes: 115 additions & 0 deletions secrets_manager.tf
Original file line number Diff line number Diff line change
@@ -0,0 +1,115 @@
resource "aws_secretsmanager_secret" "codebuild_dhcp_env_admin_db" {
name = "/codebuild/dhcp/${terraform.workspace}/admin/db"
provider = "aws.env"
}

resource "aws_secretsmanager_secret_version" "codebuild_dhcp_env_admin_db" {
provider = "aws.env"
secret_id = aws_secretsmanager_secret.codebuild_dhcp_env_admin_db.id
secret_string = jsonencode(
merge(
{
"username" : "adminuser",
"password" : random_password.codebuild_dhcp_env_admin_db.result
},
module.admin.admin_db_details
)
)
}

resource "random_password" "codebuild_dhcp_env_admin_db" {
length = 24
special = true
override_special = "_!%^"

lifecycle {
ignore_changes = [
length,
override_special
]
}
}

resource "aws_secretsmanager_secret" "codebuild_dhcp_env_db" {
name = "/codebuild/dhcp/${terraform.workspace}/db"
provider = "aws.env"
}

resource "aws_secretsmanager_secret_version" "codebuild_dhcp_env_db" {
provider = "aws.env"
secret_id = aws_secretsmanager_secret.codebuild_dhcp_env_db.id
secret_string = jsonencode(
merge(
{
"username" : "dhcpuser",
"password" : random_password.codebuild_dhcp_env_db.result
},
module.dhcp.dhcp_db_details
)
)
}

resource "random_password" "codebuild_dhcp_env_db" {
length = 24
special = true
override_special = "_!%^"

lifecycle {
ignore_changes = [
length,
override_special
]
}
}

resource "aws_secretsmanager_secret" "staff_device_dhcp_sentry_dsn" {
name = "/staff-device/dhcp/sentry_dsn"
provider = "aws.env"
}

resource "aws_secretsmanager_secret_version" "staff_device_dhcp_sentry_dsn" {
provider = "aws.env"
secret_id = aws_secretsmanager_secret.staff_device_dhcp_sentry_dsn.id
secret_string = "REPLACE_ME"
}

resource "aws_secretsmanager_secret" "staff_device_dns_sentry_dsn_1" {
name = "/staff-device/dns/sentry_dsn"
provider = "aws.env"
}

resource "aws_secretsmanager_secret_version" "staff_device_dns_sentry_dsn" {
provider = "aws.env"
secret_id = aws_secretsmanager_secret.staff_device_dns_sentry_dsn_1.id
secret_string = "REPLACE_ME"
}

resource "aws_secretsmanager_secret" "staff_device_admin_sentry_dsn_1" {
name = "/staff-device/admin/sentry_dsn"
provider = "aws.env"
}

resource "aws_secretsmanager_secret_version" "staff_device_admin_sentry_dsn" {
provider = "aws.env"
secret_id = aws_secretsmanager_secret.staff_device_admin_sentry_dsn_1.id
secret_string = "REPLACE_ME"
}

resource "aws_secretsmanager_secret" "codebuild_dhcp_env_admin_api" {
name = "/codebuild/dhcp/${terraform.workspace}/admin/api"
provider = "aws.env"
}

resource "aws_secretsmanager_secret_version" "codebuild_dhcp_env_admin_api" {
provider = "aws.env"
secret_id = aws_secretsmanager_secret.codebuild_dhcp_env_admin_api.id
secret_string = jsonencode(
merge(
{
"endpoint" : "REPLACE_ME",
"basic_auth_username" : "REPLACE_ME",
"basic_auth_password" : "REPLACE_ME",
}
)
)
}

0 comments on commit da04a14

Please sign in to comment.