Merge pull request #249 from silinternational/develop

Release 12.6.0 - AppConfig

terraform/000-core/outputs.tf

@@ -49,12 +49,12 @@ output "ecsServiceRole_arn" {
 /*
  * AppConfig outputs
  */
-output "app_id" {
+output "appconfig_app_id" {
   description = "AppConfig application ID"
   value       = one(aws_appconfig_application.this[*].id)
 }
 
-output "env_id" {
+output "appconfig_env_id" {
   description = "AppConfig environment ID"
   value       = one(aws_appconfig_environment.this[*].environment_id)
 }

terraform/031-email-service/main.tf

@@ -1,6 +1,8 @@
 locals {
-  aws_account = data.aws_caller_identity.this.account_id
-  aws_region  = data.aws_region.current.name
+  aws_account         = data.aws_caller_identity.this.account_id
+  aws_region          = data.aws_region.current.name
+  config_id_or_null   = one(aws_appconfig_configuration_profile.this[*].configuration_profile_id)
+  appconfig_config_id = local.config_id_or_null == null ? "" : local.config_id_or_null
 }
 
 /*
@@ -55,59 +57,65 @@ resource "random_id" "access_token_idsync" {
   byte_length = 16
 }
 
+
 /*
- * Create role for access to SES
+ * Create ECS role
  */
-resource "aws_iam_role" "ses" {
-  name = "ses-${var.idp_name}-${var.app_name}-${var.app_env}-${local.aws_region}"
+module "ecs_role" {
+  source = "../ecs-role"
+
+  name = "ecs-${var.idp_name}-${var.app_name}-${var.app_env}-${local.aws_region}"
+}
 
-  assume_role_policy = jsonencode({
+resource "aws_iam_role_policy" "ses" {
+  name = "ses"
+  role = module.ecs_role.role_name
+  policy = jsonencode({
     Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "ECSAssumeRoleSES"
-        Effect = "Allow"
-        Principal = {
-          Service = [
-            "ses.amazonaws.com",
-            "ecs-tasks.amazonaws.com",
-          ]
+    Statement = [{
+      Sid      = "SendEmail"
+      Effect   = "Allow"
+      Action   = "ses:SendEmail"
+      Resource = "*"
+      Condition = {
+        StringEquals = {
+          "ses:FromAddress" = var.from_email
         }
-        Action = "sts:AssumeRole"
       }
-    ]
+    }]
   })
 }
 
-resource "aws_iam_role_policy" "ses" {
-  name = "ses"
-  role = aws_iam_role.ses.id
-  policy = jsonencode(
-    {
-      Version = "2012-10-17"
-      Statement = [
-        {
-          Sid      = "SendEmail"
-          Effect   = "Allow"
-          Action   = "ses:SendEmail"
-          Resource = "*"
-          Condition = {
-            StringEquals = {
-              "ses:FromAddress" = var.from_email
-            }
-          }
-        }
+resource "aws_iam_role_policy" "appconfig" {
+  count = var.appconfig_app_id == "" ? 0 : 1
+
+  name = "appconfig"
+  role = module.ecs_role.role_name
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [{
+      Sid    = "AppConfig"
+      Effect = "Allow"
+      Action = [
+        "appconfig:GetLatestConfiguration",
+        "appconfig:StartConfigurationSession",
       ]
+      Resource = "arn:aws:appconfig:${local.aws_region}:${local.aws_account}:application/${var.appconfig_app_id}/environment/${var.appconfig_env_id}/configuration/${local.appconfig_config_id}"
+    }]
   })
 }
 
+
 /*
  * Create ECS services
  */
 locals {
   subdomain_with_region = "${var.subdomain}-${local.aws_region}"
 
   task_def_api = templatefile("${path.module}/task-definition-api.json", {
+    appconfig_app_id          = var.appconfig_app_id
+    appconfig_env_id          = var.appconfig_env_id
+    appconfig_config_id       = local.appconfig_config_id
     api_access_keys           = "${random_id.access_token_pwmanager.hex},${random_id.access_token_idbroker.hex},${random_id.access_token_idsync.hex}"
     app_env                   = var.app_env
     app_name                  = var.app_name
@@ -143,13 +151,16 @@ module "ecsservice_api" {
   container_def_json = local.task_def_api
   desired_count      = var.desired_count_api
   tg_arn             = aws_alb_target_group.email.arn
-  task_role_arn      = aws_iam_role.ses.arn
+  task_role_arn      = module.ecs_role.role_arn
   lb_container_name  = "api"
   lb_container_port  = "80"
 }
 
 locals {
   task_def_cron = templatefile("${path.module}/task-definition-cron.json", {
+    appconfig_app_id          = var.appconfig_app_id
+    appconfig_env_id          = var.appconfig_env_id
+    appconfig_config_id       = local.appconfig_config_id
     api_access_keys           = "${random_id.access_token_pwmanager.hex},${random_id.access_token_idbroker.hex},${random_id.access_token_idsync.hex}"
     app_env                   = var.app_env
     app_name                  = var.app_name
@@ -182,7 +193,7 @@ module "ecsservice_cron" {
   service_name       = "${var.idp_name}-${var.app_name}-cron"
   service_env        = var.app_env
   container_def_json = local.task_def_cron
-  task_role_arn      = aws_iam_role.ses.arn
+  task_role_arn      = module.ecs_role.role_arn
   desired_count      = var.enable_cron ? 1 : 0
 }
 
@@ -201,6 +212,19 @@ data "cloudflare_zone" "domain" {
   name = var.cloudflare_domain
 }
 
+
+/*
+ * Create AppConfig configuration profile
+ */
+resource "aws_appconfig_configuration_profile" "this" {
+  count = var.appconfig_app_id == "" ? 0 : 1
+
+  application_id = var.appconfig_app_id
+  name           = "${var.app_name}-${var.app_env}"
+  location_uri   = "hosted"
+}
+
+
 /*
  * AWS data
  */

terraform/031-email-service/task-definition-api.json

@@ -21,6 +21,22 @@
     "ulimits": null,
     "dockerSecurityOptions": null,
     "environment": [
+      {
+        "name": "APP_ID",
+        "value": "${appconfig_app_id}"
+      },
+      {
+        "name": "AWS_REGION",
+        "value": "${aws_region}"
+      },
+      {
+        "name": "ENV_ID",
+        "value": "${appconfig_env_id}"
+      },
+      {
+        "name": "CONFIG_ID",
+        "value": "${appconfig_config_id}"
+      },
       {
         "name": "API_ACCESS_KEYS",
         "value": "${api_access_keys}"

terraform/031-email-service/task-definition-cron.json

@@ -15,6 +15,22 @@
     "ulimits": null,
     "dockerSecurityOptions": null,
     "environment": [
+      {
+        "name": "APP_ID",
+        "value": "${appconfig_app_id}"
+      },
+      {
+        "name": "AWS_REGION",
+        "value": "${aws_region}"
+      },
+      {
+        "name": "ENV_ID",
+        "value": "${appconfig_env_id}"
+      },
+      {
+        "name": "CONFIG_ID",
+        "value": "${appconfig_config_id}"
+      },
       {
         "name": "API_ACCESS_KEYS",
         "value": "${api_access_keys}"

terraform/031-email-service/vars.tf

@@ -160,3 +160,15 @@ variable "wildcard_cert_arn" {
 variable "enable_cron" {
   default = true
 }
+
+variable "appconfig_app_id" {
+  description = "AppConfig application ID"
+  type        = string
+  default     = ""
+}
+
+variable "appconfig_env_id" {
+  description = "AppConfig environment ID"
+  type        = string
+  default     = ""
+}

terraform/040-id-broker/README.md

@@ -51,13 +51,13 @@ This module is used to create an ECS service running id-broker.
  - `abandoned_user_abandoned_period` - Time a user record can remain abandoned before HR is notified. Default: `+6 months`
  - `abandoned_user_best_practice_url` - URL for best practices, referenced in notification email. Default: (none)
  - `abandoned_user_deactivate_instructions_url` - URL for instruction on how to deactivate user accounts, referenced in notification email. Default: (none)
- - `app_id` - AppConfig application ID created by AWS. This cannot be the application name. Use with `env_id`.
+ - `appconfig_app_id` - AppConfig application ID created by AWS. This cannot be the application name. Use with `appconfig_env_id`.
  - `contingent_user_duration` - How long before a new user without a primary email address expires. Default: `+4 weeks`
  - `cpu_cron` - How much CPU to allocate to cron service. Default: `128`
  - `email_repeat_delay_days` - Don't resend the same type of email to the same user for X days. Default: `31`
  - `email_service_assertValidIp` - Whether or not to assert IP address for Email Service API is trusted
  - `email_signature` - Signature for use in emails. Default is empty string
- - `env_id` - AppConfig environment ID created by AWS. This cannot be the environment name. Use with `app_id`.
+ - `appconfig_env_id` - AppConfig environment ID created by AWS. This cannot be the environment name. Use with `appconfig_app_id`.
  - `event_schedule` - Task run schedule. Default: `cron(0 0 * * ? *)`
  - `ga_api_secret` - The Google Analytics API secret for the data stream (e.g. aB-abcdef7890123456789)
  - `ga_client_id` - Used by Google Analytics to distinguish the user (e.g. IDP-<the idp name>-ID-BROKER)

terraform/040-id-broker/main.tf

@@ -1,8 +1,10 @@
 locals {
-  aws_account = data.aws_caller_identity.this.account_id
-  aws_region  = data.aws_region.current.name
-  cfg_id      = one(aws_appconfig_configuration_profile.this[*].configuration_profile_id)
-  config_id   = local.cfg_id == null ? "" : local.cfg_id
+  aws_account         = data.aws_caller_identity.this.account_id
+  aws_region          = data.aws_region.current.name
+  config_id_or_null   = one(aws_appconfig_configuration_profile.this[*].configuration_profile_id)
+  appconfig_config_id = local.config_id_or_null == null ? "" : local.config_id_or_null
+  appconfig_app_id    = var.appconfig_app_id == "" ? var.app_id : var.appconfig_app_id
+  appconfig_env_id    = var.appconfig_env_id == "" ? var.env_id : var.appconfig_env_id
 }
 
 /*
@@ -81,9 +83,9 @@ locals {
   subdomain_with_region = "${var.subdomain}-${local.aws_region}"
 
   task_def = templatefile("${path.module}/task-definition.json", {
-    app_id                                     = var.app_id
-    env_id                                     = var.env_id
-    config_id                                  = local.config_id
+    appconfig_app_id                           = local.appconfig_app_id
+    appconfig_env_id                           = local.appconfig_env_id
+    appconfig_config_id                        = local.appconfig_config_id
     api_access_keys                            = local.api_access_keys
     abandoned_user_abandoned_period            = var.abandoned_user_abandoned_period
     abandoned_user_best_practice_url           = var.abandoned_user_best_practice_url
@@ -207,17 +209,17 @@ module "ecsservice" {
   tg_arn             = aws_alb_target_group.broker.arn
   lb_container_name  = "web"
   lb_container_port  = "80"
-  task_role_arn      = one(aws_iam_role.app_config[*].arn)
+  task_role_arn      = one(module.ecs_role[*].role_arn)
 }
 
 /*
  * Create ECS service
  */
 locals {
   task_def_cron = templatefile("${path.module}/task-definition.json", {
-    app_id                                     = var.app_id
-    env_id                                     = var.env_id
-    config_id                                  = local.config_id
+    appconfig_app_id                           = local.appconfig_app_id
+    appconfig_env_id                           = local.appconfig_env_id
+    appconfig_config_id                        = local.appconfig_config_id
     api_access_keys                            = local.api_access_keys
     abandoned_user_abandoned_period            = var.abandoned_user_abandoned_period
     abandoned_user_best_practice_url           = var.abandoned_user_best_practice_url
@@ -431,43 +433,20 @@ data "cloudflare_zone" "domain" {
 
 
 /*
- * Create role for access to AppConfig
+ * Create ECS role
  */
-resource "aws_iam_role" "app_config" {
-  count = var.app_id == "" ? 0 : 1
-
-  name = "appconfig-${var.idp_name}-${var.app_name}-${var.app_env}-${local.aws_region}"
-
-  assume_role_policy = jsonencode({
-    Version = "2012-10-17"
-    Statement = [
-      {
-        Sid    = "ECSAssumeRoleAppConfig"
-        Effect = "Allow"
-        Principal = {
-          Service = [
-            "ecs-tasks.amazonaws.com",
-          ]
-        }
-        Action = "sts:AssumeRole"
-        Condition = {
-          ArnLike = {
-            "aws:SourceArn" = "arn:aws:ecs:${local.aws_region}:${local.aws_account}:*"
-          }
-          StringEquals = {
-            "aws:SourceAccount" = local.aws_account
-          }
-        }
-      }
-    ]
-  })
+module "ecs_role" {
+  count  = local.appconfig_app_id == "" ? 0 : 1
+  source = "../ecs-role"
+
+  name = "ecs-${var.idp_name}-${var.app_name}-${var.app_env}-${local.aws_region}"
 }
 
-resource "aws_iam_role_policy" "app_config" {
-  count = var.app_id == "" ? 0 : 1
+resource "aws_iam_role_policy" "this" {
+  count = local.appconfig_app_id == "" ? 0 : 1
 
-  name = "app_config"
-  role = one(aws_iam_role.app_config[*].id)
+  name = "appconfig"
+  role = one(module.ecs_role[*].role_name)
   policy = jsonencode(
     {
       Version = "2012-10-17"
@@ -479,7 +458,7 @@ resource "aws_iam_role_policy" "app_config" {
             "appconfig:GetLatestConfiguration",
             "appconfig:StartConfigurationSession",
           ]
-          Resource = "arn:aws:appconfig:${local.aws_region}:${local.aws_account}:application/${var.app_id}/environment/${var.env_id}/configuration/${local.config_id}"
+          Resource = "arn:aws:appconfig:${local.aws_region}:${local.aws_account}:application/${local.appconfig_app_id}/environment/${local.appconfig_env_id}/configuration/${local.appconfig_config_id}"
         }
       ]
   })
@@ -490,9 +469,9 @@ resource "aws_iam_role_policy" "app_config" {
  * Create AppConfig configuration profile
  */
 resource "aws_appconfig_configuration_profile" "this" {
-  count = var.app_id == "" ? 0 : 1
+  count = local.appconfig_app_id == "" ? 0 : 1
 
-  application_id = var.app_id
+  application_id = local.appconfig_app_id
   name           = "${var.app_name}-${var.app_env}"
   location_uri   = "hosted"
 }

terraform/040-id-broker/task-definition.json

@@ -23,19 +23,19 @@
     "environment": [
       {
         "name": "APP_ID",
-        "value": "${app_id}"
+        "value": "${appconfig_app_id}"
       },
       {
         "name": "AWS_REGION",
         "value": "${aws_region}"
       },
       {
         "name": "ENV_ID",
-        "value": "${env_id}"
+        "value": "${appconfig_env_id}"
       },
       {
         "name": "CONFIG_ID",
-        "value": "${config_id}"
+        "value": "${appconfig_config_id}"
       },
       {
         "name": "ABANDONED_USER_abandonedPeriod",