Rdev build

.github/workflows/push-rdev.yml

@@ -15,7 +15,7 @@ env:
 # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services
 permissions:
   id-token: write
-  contents: read
+  contents: write
 
 jobs:
   build-push-images:
@@ -45,17 +45,16 @@ jobs:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
         with:
-          role-session-name: BuildAndPushRdevImage
           aws-region: us-west-2
-          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
-          role-duration-seconds: 900
+          aws-access-key-id: ${{ secrets.THEIAGEN_AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.THEIAGEN_AWS_SECRET_ACCESS_KEY }}
       - name: Build And Push
         uses: chanzuckerberg/github-actions/.github/actions/[email protected]
         with:
           dockerfile: ${{ matrix.image.dockerfile }}
           context: ${{ matrix.image.context }}
           name: ${{ matrix.image.name }}
-          registry: ${{ secrets.ECR_REPO }}
+          registry: 654654542669.dkr.ecr.us-west-2.amazonaws.com
 
   create-update-rdev:
     runs-on: ubuntu-20.04

.happy/config.json

@@ -65,15 +65,15 @@
     },
     "environments": {
         "rdev": {
-            "aws_profile": "genepi-dev",
+            "aws_profile": "theia",
             "secret_arn": "happy/env-dev-config",
             "terraform_directory": ".happy/terraform/envs/dev",
             "log_group_prefix": "/genepi/dev",
             "task_launch_type": "fargate",
             "auto_run_migrations": true
         },
         "staging": {
-            "aws_profile": "genepi-dev",
+            "aws_profile": "theia",
             "secret_arn": "happy/env-gestaging-config",
             "terraform_directory": ".happy/terraform/envs/staging",
             "delete_protected": true,
@@ -82,7 +82,7 @@
             "task_launch_type": "fargate"
         },
         "prod": {
-            "aws_profile": "genepi-prod",
+            "aws_profile": "theia",
             "secret_arn": "happy/env-geprod-config",
             "terraform_directory": ".happy/terraform/envs/prod",
             "delete_protected": true,
@@ -99,4 +99,4 @@
             "delete_db_task_definition_arn"
         ]
     }
-}
+}

.happy/terraform/envs/dev/locals.tf.json

@@ -0,0 +1,5 @@
+{
+  "locals": {
+    "image_tag": "sha-7b63b07"
+  }
+}

.happy/terraform/envs/dev/main.tf

@@ -1,16 +1,16 @@
-module stack {
+module "stack" {
   source              = "./modules/ecs-stack"
   aws_account_id      = var.aws_account_id
   aws_role            = var.aws_role
   happymeta_          = var.happymeta_
   happy_config_secret = var.happy_config_secret
-  image_tag           = var.image_tag
-  image_tags          = jsondecode(var.image_tags)
+  image_tag           = local.image_tag
+  image_tags          = {}
   priority            = var.priority
   stack_name          = var.stack_name
   deployment_stage    = "dev"
   delete_protected    = false
-  require_okta        = true
+  require_okta        = false
   stack_prefix        = "/${var.stack_name}"
   sql_import_file     = "db_snapshots/dev_backup.sql"
 

.happy/terraform/envs/dev/providers.tf

@@ -1,8 +1,5 @@
-provider aws {
-  version = "~> 3.63.0"
-  region  = "us-west-2"
-  assume_role {
-    role_arn = "arn:aws:iam::${var.aws_account_id}:role/${var.aws_role}"
-  }
+provider "aws" {
+  region              = "us-west-2"
   allowed_account_ids = [var.aws_account_id]
-}
+
+}

.happy/terraform/envs/dev/variables.tf

@@ -1,45 +1,40 @@
-variable aws_account_id {
+variable "aws_account_id" {
   type        = string
   description = "AWS account ID to apply changes to"
+  default     = "654654542669"
 }
 
-variable aws_role {
+variable "aws_role" {
   type        = string
   description = "Name of the AWS role to assume to apply changes"
+  default     = ""
 }
 
-variable image_tag {
-  type        = string
-  description = "Please provide an image tag"
-}
-
-variable image_tags {
-  type        = string
-  description = "Override the default image tags (json-encoded map)"
-  default     = "{}"
-}
-
-variable priority {
+variable "priority" {
   type        = number
   description = "Listener rule priority number within the given listener"
+  default     = 1234
 }
 
-variable happymeta_ {
+variable "happymeta_" {
   type        = string
   description = "Happy Path metadata. Ignored by actual terraform."
+  default     = "{}"
 }
 
-variable stack_name {
+variable "stack_name" {
   type        = string
   description = "Happy Path stack name"
+  default     = "gedevstack-jheath"
 }
 
-variable happy_config_secret {
+variable "happy_config_secret" {
   type        = string
   description = "Happy Path configuration secret name"
+  default     = "happy/env-dev-config"
 }
 
-variable wait_for_steady_state {
+variable "wait_for_steady_state" {
   type        = bool
   description = "Should terraform block until ECS reaches a steady state?"
   default     = true

.happy/terraform/envs/dev/versions.tf

@@ -0,0 +1,20 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 4.45"
+    }
+  }
+
+  backend "s3" {
+    region  = "us-west-2"
+    bucket  = "genepi-prod-s3-tf-state-prod-prod-genepi-theia-stacks-state"
+    key     = "czgenepi-dev.tfstate"
+    profile = "theia"
+    encrypt = "true"
+
+    dynamodb_table = "genepi-prod-s3-tf-state-prod-prod-genepi-theia-stacks-state-lock"
+  }
+}

.happy/terraform/envs/prod/locals.tf.json

@@ -0,0 +1,6 @@
+{
+  "locals": {
+    "image_tag": "sha-7ec47ca8",
+    "image_tags": "{}"
+  }
+}

.happy/terraform/envs/prod/main.tf

@@ -1,11 +1,11 @@
-module stack {
+module "stack" {
   source              = "./modules/ecs-stack"
   aws_account_id      = var.aws_account_id
   aws_role            = var.aws_role
   happymeta_          = var.happymeta_
   happy_config_secret = var.happy_config_secret
-  image_tag           = var.image_tag
-  image_tags          = jsondecode(var.image_tags)
+  image_tag           = local.image_tag
+  image_tags          = jsondecode(local.image_tags)
   priority            = var.priority
   stack_name          = var.stack_name
   deployment_stage    = "geprod"

.happy/terraform/envs/prod/providers.tf

@@ -1,6 +1,5 @@
-provider aws {
-  version = "~> 3.63.0"
-  region  = "us-west-2"
+provider "aws" {
+  region = "us-west-2"
   assume_role {
     role_arn = "arn:aws:iam::${var.aws_account_id}:role/${var.aws_role}"
   }

.happy/terraform/envs/prod/variables.tf

@@ -1,45 +1,40 @@
-variable aws_account_id {
+variable "aws_account_id" {
   type        = string
   description = "AWS account ID to apply changes to"
+  default     = "829407189049"
 }
 
-variable aws_role {
+variable "aws_role" {
   type        = string
   description = "Name of the AWS role to assume to apply changes"
+  default     = "tfe-si"
 }
 
-variable image_tag {
-  type        = string
-  description = "Please provide an image tag"
-}
-
-variable image_tags {
-  type        = string
-  description = "Override the default image tags (json-encoded map)"
-  default     = "{}"
-}
-
-variable priority {
+variable "priority" {
   type        = number
   description = "Listener rule priority number within the given listener"
+  default     = 1251
 }
 
-variable happymeta_ {
+variable "happymeta_" {
   type        = string
   description = "Happy Path metadata. Ignored by actual terraform."
+  default     = "{}"
 }
 
-variable stack_name {
+variable "stack_name" {
   type        = string
   description = "Happy Path stack name"
+  default     = "geprodstack"
 }
 
-variable happy_config_secret {
+variable "happy_config_secret" {
   type        = string
   description = "Happy Path configuration secret name"
+  default     = "happy/env-geprod-config"
 }
 
-variable wait_for_steady_state {
+variable "wait_for_steady_state" {
   type        = bool
   description = "Should terraform block until ECS reaches a steady state?"
   default     = true

.happy/terraform/envs/prod/versions.tf

@@ -0,0 +1,20 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 4.45"
+    }
+  }
+
+  backend "s3" {
+    region   = "us-west-2"
+    bucket   = "genepi-prod-s3-tf-state-prod-prod-genepi-stacks-state"
+    key      = "terraform.tfstate"
+    role_arn = "arn:aws:iam::829407189049:role/tfe-si"
+    encrypt  = "true"
+
+    dynamodb_table = "genepi-prod-s3-tf-state-prod-prod-genepi-stacks-state-lock"
+  }
+}

.happy/terraform/envs/staging/locals.tf.json

@@ -0,0 +1,5 @@
+{
+  "locals": {
+    "image_tag": "sha-7b63b07"
+  }
+}

.happy/terraform/envs/staging/main.tf

@@ -1,19 +1,19 @@
-module stack {
+module "stack" {
   source              = "./modules/ecs-stack"
   aws_account_id      = var.aws_account_id
   aws_role            = var.aws_role
   happymeta_          = var.happymeta_
   happy_config_secret = var.happy_config_secret
-  image_tag           = var.image_tag
-  image_tags          = jsondecode(var.image_tags)
+  image_tag           = local.image_tag
+  image_tags          = {}
   priority            = var.priority
   stack_name          = var.stack_name
   deployment_stage    = "gestaging"
   delete_protected    = false
   require_okta        = false
   sql_import_file     = "db_snapshots/dev_backup.sql"
-  frontend_url        = "https://staging.czgenepi.org"
-  backend_url         = "https://api.staging.czgenepi.org"
+  frontend_url        = "https://staging.testing-theiagenepi.org"
+  backend_url         = "https://api.staging.testing-theiagenepi.org"
   stack_prefix        = ""
 
   wait_for_steady_state = var.wait_for_steady_state

.happy/terraform/envs/staging/providers.tf

@@ -1,8 +1,4 @@
-provider aws {
-  version = "~> 3.63.0"
-  region  = "us-west-2"
-  assume_role {
-    role_arn = "arn:aws:iam::${var.aws_account_id}:role/${var.aws_role}"
-  }
+provider "aws" {
+  region              = "us-west-2"
   allowed_account_ids = [var.aws_account_id]
 }