BFD-3724: MGMT CI issues blocking MGMT environment apply (#2476)

CMSgov · Nov 4, 2024 · 13c0042 · 13c0042
1 parent 7c4f864
commit 13c0042
Show file tree

Hide file tree

Showing 6 changed files with 40 additions and 20 deletions.
diff --git a/ops/terraform/env/mgmt/alarms.tf b/ops/terraform/env/mgmt/alarms.tf
@@ -1,8 +1,8 @@
 locals {
-  victor_ops_url                                = local.sensitive_common_config["victor_ops_url"]
-  ec2_failing_instances_runbook_url             = local.sensitive_common_config["alarm_ec2_failing_instances_runbook_url"]
-  ec2_instance_script_failing_start_runbook_url = local.sensitive_common_config["alarm_ec2_instance_script_failing_start_runbook_url"]
-  lambda_error_stats_runbook_url                = local.sensitive_common_config["alarm_lambda_error_stats_runbook_url"]
+  victor_ops_url                                = local.ssm_config["/bfd/common/victor_ops_url"]
+  ec2_failing_instances_runbook_url             = local.ssm_config["/bfd/common/alarm_ec2_failing_instances_runbook_url"]
+  ec2_instance_script_failing_start_runbook_url = local.ssm_config["/bfd/common/alarm_ec2_instance_script_failing_start_runbook_url"]
+  lambda_error_stats_runbook_url                = local.ssm_config["/bfd/common/alarm_lambda_error_stats_runbook_url"]
 
   cloudwatch_sns_topic_policy_spec = <<-EOF
 {

diff --git a/ops/terraform/env/mgmt/backups/ami-pruner.tf b/ops/terraform/env/mgmt/backups/ami-pruner.tf
@@ -7,7 +7,7 @@ locals {
     log_retention_days        = 30
     log_group                 = "/aws/lambda/bfd-${local.env}-backups-ami-pruner"
     log_level                 = 20 # 10 = DEBUG, 20 = INFO, 30 = WARNING, 40 = ERROR, 50 = CRITICAL
-    retention_policy_ssm_path = "/bfd/${local.env}/common/sensitive/backups/ami"
+    retention_policy_ssm_path = "/bfd/${local.env}/common/nonsensitive/backups/ami"
   }
 }
 

diff --git a/ops/terraform/env/mgmt/data-sources.tf b/ops/terraform/env/mgmt/data-sources.tf
@@ -54,8 +54,12 @@ data "aws_ssm_parameter" "cpm_aws_account_arn" {
   with_decryption = true
 }
 
-data "aws_ssm_parameters_by_path" "common_sensitive" {
-  path = "/bfd/${local.env}/common/sensitive"
+data "aws_ssm_parameters_by_path" "params" {
+  for_each = toset(local.ssm_hierarchies)
+
+  recursive       = true
+  path            = each.value
+  with_decryption = true
 }
 
 data "aws_ec2_managed_prefix_list" "vpn" {

diff --git a/ops/terraform/env/mgmt/github-actions-iam.tf b/ops/terraform/env/mgmt/github-actions-iam.tf
@@ -362,9 +362,15 @@ resource "aws_iam_policy" "github_actions_ci_ops" {
           Sid    = "AllowSsmAccess"
           Effect = "Allow"
           Action = [
-            "ssm:Describe*",
-            "ssm:GetParam*",
-            "ssm:List*"
+            "ssm:ListTagsForResource",
+            "ssm:DescribeParameters",
+            "ssm:PutParameter",
+            "ssm:DeleteParameter",
+            "ssm:GetParameterHistory",
+            "ssm:GetParametersByPath",
+            "ssm:GetParameters",
+            "ssm:GetParameter",
+            "ssm:DeleteParameters"
           ]
           Resource = "*"
         },
@@ -450,7 +456,8 @@ resource "aws_iam_policy" "github_actions_ci_ops" {
           Action = [
             "quicksight:Get*",
             "quicksight:Describe*",
-            "quicksight:List*"
+            "quicksight:List*",
+            "quicksight:Create*"
           ]
           Resource = "*"
         },

diff --git a/ops/terraform/env/mgmt/main.tf b/ops/terraform/env/mgmt/main.tf
@@ -41,11 +41,20 @@ locals {
     ]
   )
 
-  sensitive_common_config = zipmap(
+  ssm_hierarchies = ["/bfd/${local.env}/common"]
+  ssm_flattened_data = {
+    names = flatten(
+      [for k, v in data.aws_ssm_parameters_by_path.params : v.names]
+    )
+    values = flatten(
+      [for k, v in data.aws_ssm_parameters_by_path.params : nonsensitive(v.values)]
+    )
+  }
+  ssm_config = zipmap(
     [
-      for name in data.aws_ssm_parameters_by_path.common_sensitive.names :
-      element(split("/", name), length(split("/", name)) - 1)
+      for name in local.ssm_flattened_data.names :
+      replace(name, "/((non)*sensitive|${local.env})//", "")
     ],
-    nonsensitive(data.aws_ssm_parameters_by_path.common_sensitive.values)
+    local.ssm_flattened_data.values
   )
 }
diff --git a/ops/terraform/env/mgmt/r53.tf b/ops/terraform/env/mgmt/r53.tf
@@ -1,14 +1,14 @@
 locals {
   hosted_zones = {
-    for zone in jsondecode(local.sensitive_common_config["r53_hosted_zones_json"]) :
+    for zone in jsondecode(local.ssm_config["/bfd/common/r53_hosted_zones_json"]) :
     zone => {
-      domain  = local.sensitive_common_config["r53_hosted_zone_${zone}_domain"]
-      comment = local.sensitive_common_config["r53_hosted_zone_${zone}_comment"]
+      domain  = local.ssm_config["/bfd/common/r53_hosted_zone_${zone}_domain"]
+      comment = local.ssm_config["/bfd/common/r53_hosted_zone_${zone}_comment"]
       # If a hosted zone does not specify any VPC associations, it is considered a Public zone. If
       # any VPCs are specified, it is considered Private. We handle the case where VPCs are not
       # specified in configuration by returning an empty list.
-      internal_vpc_ids = jsondecode(lookup(local.sensitive_common_config, "r53_hosted_zone_${zone}_internal_vpcs_json", "[]"))
-      external_vpc_ids = jsondecode(lookup(local.sensitive_common_config, "r53_hosted_zone_${zone}_external_vpcs_json", "[]"))
+      internal_vpc_ids = jsondecode(lookup(local.ssm_config, "/bfd/common/r53_hosted_zone_${zone}_internal_vpcs_json", "[]"))
+      external_vpc_ids = jsondecode(lookup(local.ssm_config, "/bfd/common/r53_hosted_zone_${zone}_external_vpcs_json", "[]"))
     }
   }
   all_internal_r53_vpcs = flatten([for hz_label, hz_config in local.hosted_zones : hz_config.internal_vpc_ids])