Skip to content

Commit bf721e2

Browse files
TOEL2TOEL2
authored
Merge pull request #321 from NHSDigital/feature/rgjb-eli-604-rotate_proxygen_key_in_ptl_and_prod
Feature/rgjb eli 604 rotate proxygen key in ptl and prod
2 parents 591ffe7 + fcc3759 commit bf721e2

12 files changed

Lines changed: 78 additions & 27 deletions

‎.github/workflows/dev_sandbox_publish_deploy.yaml‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@ jobs:
2727
name: "Publish spec & deploy to dev"
2828
needs: metadata
2929
runs-on: ubuntu-latest
30+
if: false # Temporarily skip this job
3031
steps:
3132
- name: Checkout repository
3233
uses: actions/checkout@v6
@@ -54,11 +55,11 @@ jobs:
5455
5556
- name: Set up Proxygen credentials
5657
env:
57-
PROXYGEN_PRIVATE_KEY: ${{ secrets.PROXYGEN_PRIVATE_KEY }}
58+
PROXYGEN_PRIVATE_KEY: ${{ secrets.PROXYGEN_PRIVATE_KEY_PTL }}
5859
run: |
5960
mkdir -p ~/.proxygen
6061
echo "$PROXYGEN_PRIVATE_KEY" > ~/.proxygen/eligibility-signposting-api.pem
61-
make setup-proxygen-credentials
62+
make setup-proxygen-credentials ENV=ptl
6263
- name: Generate specification
6364
run: |
6465
make construct-spec APIM_ENV=internal-dev
@@ -98,11 +99,11 @@ jobs:
9899
99100
- name: Set up Proxygen credentials
100101
env:
101-
PROXYGEN_PRIVATE_KEY: ${{ secrets.PROXYGEN_PRIVATE_KEY }}
102+
PROXYGEN_PRIVATE_KEY: ${{ secrets.PROXYGEN_PRIVATE_KEY_PROD }}
102103
run: |
103104
mkdir -p ~/.proxygen
104105
echo "$PROXYGEN_PRIVATE_KEY" > ~/.proxygen/eligibility-signposting-api.pem
105-
make setup-proxygen-credentials
106+
make setup-proxygen-credentials ENV=prod
106107
- name: Generate specification
107108
run: |
108109
make construct-spec APIM_ENV=sandbox

‎.github/workflows/preprod_publish_deploy.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,11 +46,11 @@ jobs:
4646
pip install proxygen-cli
4747
- name: Set up Proxygen credentials
4848
env:
49-
PROXYGEN_PRIVATE_KEY: ${{ secrets.PROXYGEN_PRIVATE_KEY }}
49+
PROXYGEN_PRIVATE_KEY: ${{ secrets.PROXYGEN_PRIVATE_KEY_PROD }}
5050
run: |
5151
mkdir -p ~/.proxygen
5252
echo "$PROXYGEN_PRIVATE_KEY" > ~/.proxygen/eligibility-signposting-api.pem
53-
make setup-proxygen-credentials
53+
make setup-proxygen-credentials ENV=prod
5454
- name: Generate specification
5555
run: |
5656
make construct-spec APIM_ENV=preprod

‎.github/workflows/prod_publish_deploy.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,11 +45,11 @@ jobs:
4545
pip install proxygen-cli
4646
- name: Set up Proxygen credentials
4747
env:
48-
PROXYGEN_PRIVATE_KEY: ${{ secrets.PROXYGEN_PRIVATE_KEY }}
48+
PROXYGEN_PRIVATE_KEY: ${{ secrets.PROXYGEN_PRIVATE_KEY_PROD }}
4949
run: |
5050
mkdir -p ~/.proxygen
5151
echo "$PROXYGEN_PRIVATE_KEY" > ~/.proxygen/eligibility-signposting-api.pem
52-
make setup-proxygen-credentials
52+
make setup-proxygen-credentials ENV=prod
5353
- name: Generate specification
5454
run: |
5555
make construct-spec APIM_ENV=prod

‎.github/workflows/publish-specification.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -46,11 +46,11 @@ jobs:
4646
4747
- name: Set up Proxygen credentials
4848
env:
49-
PROXYGEN_PRIVATE_KEY: ${{ secrets.PROXYGEN_PRIVATE_KEY }}
49+
PROXYGEN_PRIVATE_KEY: ${{ secrets.PROXYGEN_PRIVATE_KEY_PROD }}
5050
run: |
5151
mkdir -p ~/.proxygen
5252
echo "$PROXYGEN_PRIVATE_KEY" > ~/.proxygen/eligibility-signposting-api.pem
53-
make setup-proxygen-credentials
53+
make setup-proxygen-credentials ENV=prod
5454
5555
- name: Generate specification
5656
run: |

‎.github/workflows/publish_sandbox.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,11 +37,11 @@ jobs:
3737
3838
- name: Set up Proxygen credentials
3939
env:
40-
PROXYGEN_PRIVATE_KEY: ${{ secrets.PROXYGEN_PRIVATE_KEY }}
40+
PROXYGEN_PRIVATE_KEY: ${{ secrets.PROXYGEN_PRIVATE_KEY_PROD }}
4141
run: |
4242
mkdir -p ~/.proxygen
4343
echo "$PROXYGEN_PRIVATE_KEY" > ~/.proxygen/eligibility-signposting-api.pem
44-
make setup-proxygen-credentials
44+
make setup-proxygen-credentials ENV=prod
4545
4646
- name: Generate sandbox specification
4747
run: |

‎Makefile‎

Lines changed: 26 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -53,39 +53,51 @@ config:: # Configure development environment (main) @Configuration
5353
#### Proxygen ####
5454
##################
5555

56-
retrieve-proxygen-key: # Obtain the 'machine user' credentials from AWS SSM (Development environment)
57-
mkdir -p ~/.proxygen && \
58-
aws ssm get-parameter --name /proxygen/private_key_temp --with-decryption | jq ".Parameter.Value" --raw-output \
59-
> ~/.proxygen/eligibility-signposting-api.pem
60-
61-
setup-proxygen-credentials: # Copy Proxygen templated credentials to where it expected them
62-
cd specification && cp -r .proxygen ~
56+
# Verify current AWS account login and retrieve the proxygen key
57+
# from AWS SSM Parameter Store
58+
retrieve-proxygen-key: guard-ENV
59+
@ ./scripts/check-aws-account.sh
60+
mkdir -p ~/.proxygen
61+
aws ssm get-parameter --name /$$ENV/proxygen/private_key --with-decryption \
62+
| jq -r ".Parameter.Value" \
63+
> ~/.proxygen/eligibility-signposting-api-$(ENV).pem && \
64+
echo "Retrieved proxygen key for APIM '$(ENV)' environment"
65+
66+
# Copy proxygen credentials for the specified environment to `~/.proxygen/`
67+
# This location required location for local proxygen usage
68+
setup-proxygen-credentials: guard-ENV
69+
@ cd specification && \
70+
cp .proxygen/credentials-$(ENV).yaml ~/.proxygen/credentials.yaml && \
71+
cp .proxygen/settings-$(ENV).yaml ~/.proxygen/settings.yaml && \
72+
echo "Set up proxygen credentials for the APIM '$(ENV)' environment"
6373

6474
get-spec: # Get the most recent specification live in proxygen
65-
$(MAKE) setup-proxygen-credentials
75+
$(MAKE) setup-proxygen-credentials ENV=prod
6676
proxygen spec get
6777

6878
get-spec-uat: # Get the most recent specification live in proxygen
69-
$(MAKE) setup-proxygen-credentials
79+
$(MAKE) setup-proxygen-credentials ENV=prod
7080
proxygen spec get --uat
7181

7282
publish-spec: # Publish the specification to proxygen
73-
$(MAKE) setup-proxygen-credentials
83+
$(MAKE) setup-proxygen-credentials ENV=prod
7484
proxygen spec publish build/specification/prod/eligibility-signposting-api.yaml
7585

7686
publish-spec-uat: # Publish the specification to proxygen
77-
$(MAKE) setup-proxygen-credentials
87+
$(MAKE) setup-proxygen-credentials ENV=prod
7888
proxygen spec publish build/specification/preprod/eligibility-signposting-api.yaml --uat
7989

8090
delete-spec: # Delete the specification from proxygen
81-
$(MAKE) setup-proxygen-credentials
91+
$(MAKE) setup-proxygen-credentials ENV=prod
8292
proxygen spec delete
8393

8494
delete-spec-uat: # Delete the specification from proxygen
85-
$(MAKE) setup-proxygen-credentials
95+
$(MAKE) setup-proxygen-credentials ENV=prod
8696
proxygen spec delete --uat
8797

88-
# Specification
98+
#####################
99+
### Specification ###
100+
#####################
89101

90102
guard-%:
91103
@ if [ "${${*}}" = "" ]; then \

‎pyproject.toml‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,9 @@ requires-python = ">=3.11"
1010
repository = "https://github.com/NHSDigital/eligibility-signposting-api-specification"
1111
homepage = "https://digital.nhs.uk/developer/api-catalogue"
1212
keywords = ["healthcare", "uk", "nhs", "vaccination", "api"] #TODO add additional keywords
13-
package_mode = false
13+
14+
[tool.poetry]
15+
package-mode = false
1416

1517
[build-system]
1618
requires = ["poetry-core>=2.0.0,<3.0.0"]

‎scripts/check-aws-account.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
2+
#!/usr/bin/env bash
3+
set -e
4+
5+
# Expected AWS account details for dev environment
6+
EXPECTED_ENV_NAME="dev"
7+
EXPECTED_ACCOUNT="448049830832"
8+
9+
# Read the currently authenticated AWS account
10+
CURRENT_ACCOUNT=$(aws sts get-caller-identity --query "Account" --output text)
11+
12+
# Compare the current account with the expected account
13+
if [ "$CURRENT_ACCOUNT" != "$EXPECTED_ACCOUNT" ]; then
14+
echo "AWS account mismatch!"
15+
echo "The expected login is AWS '$EXPECTED_ENV_NAME' account $EXPECTED_ACCOUNT, but the current logged in AWS account is $CURRENT_ACCOUNT."
16+
echo "Please switch to the correct AWS account and try again."
17+
echo "Exiting script..."
18+
exit 1
19+
fi
20+
21+
echo "Active login to AWS '$EXPECTED_ENV_NAME' account $CURRENT_ACCOUNT verified."

‎specification/.proxygen/credentials-prod.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
client_id: eligibility-signposting-api-client
2+
private_key_path: eligibility-signposting-api-prod.pem
3+
key_id: 2027-01-21-Prod-eligibility-signposting-api
4+
base_url: https://identity.prod.api.platform.nhs.uk/realms/api-producers
5+

‎specification/.proxygen/credentials-ptl.yaml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
client_id: eligibility-signposting-api-client
2+
private_key_path: eligibility-signposting-api-ptl.pem
3+
key_id: 2027-01-21-PTL-eligibility-signposting-api
4+
base_url: https://identity.ptl.api.platform.nhs.uk/realms/api-producers

0 commit comments

Comments
 (0)