Merge branch 'main' into bugfix/eja-eli-579-fixing-non-standard-names

Author: eddalmond1

.github/workflows/base-deploy.yml

@@ -203,6 +203,7 @@ jobs:
           TF_VAR_SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }}
           TF_VAR_SPLUNK_HEC_ENDPOINT: ${{ secrets.SPLUNK_HEC_ENDPOINT }}
           TF_VAR_OPERATOR_EMAILS: ${{ vars.SECRET_ROTATION_OPERATOR_EMAILS }}
+          TF_VAR_PROXYGEN_PRIVATE_KEY: ${{ secrets.PROXYGEN_PRIVATE_KEY_PROD }}
 
         working-directory: ./infrastructure
         shell: bash

.github/workflows/cicd-2-publish.yaml

@@ -103,6 +103,7 @@ jobs:
           TF_VAR_SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }}
           TF_VAR_SPLUNK_HEC_ENDPOINT: ${{ secrets.SPLUNK_HEC_ENDPOINT }}
           TF_VAR_OPERATOR_EMAILS: ${{ vars.SECRET_ROTATION_OPERATOR_EMAILS }}
+          TF_VAR_PROXYGEN_PRIVATE_KEY: ${{ secrets.PROXYGEN_PRIVATE_KEY_PROD }}
 
         run: |
           mkdir -p ./build

.github/workflows/cicd-3-test-deploy.yaml

@@ -90,6 +90,7 @@ jobs:
           TF_VAR_SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }}
           TF_VAR_SPLUNK_HEC_ENDPOINT: ${{ secrets.SPLUNK_HEC_ENDPOINT }}
           TF_VAR_OPERATOR_EMAILS: ${{ vars.SECRET_ROTATION_OPERATOR_EMAILS }}
+          TF_VAR_PROXYGEN_PRIVATE_KEY: ${{ secrets.PROXYGEN_PRIVATE_KEY_PROD }}
 
         run: |
           mkdir -p ./build

.github/workflows/release-candidate.yml

@@ -237,6 +237,8 @@ jobs:
           TF_VAR_SPLUNK_HEC_TOKEN: ${{ secrets.SPLUNK_HEC_TOKEN }}
           TF_VAR_SPLUNK_HEC_ENDPOINT: ${{ secrets.SPLUNK_HEC_ENDPOINT }}
           TF_VAR_OPERATOR_EMAILS: ${{ vars.SECRET_ROTATION_OPERATOR_EMAILS }}
+          TF_VAR_PROXYGEN_PRIVATE_KEY: ${{ secrets.PROXYGEN_PRIVATE_KEY_PROD }}
+
         run: |
           mkdir -p ./build
           echo "🚀 Deploying ${{ needs.validate.outputs.dev_tag }} to TEST"
@@ -353,8 +355,9 @@ jobs:
         id: release
         env:
           DEV_TAG: ${{ needs.validate.outputs.dev_tag }}
-          RELEASE_TYPE: ${{ inputs.release_type }}
+          INPUT_RELEASE_TYPE: ${{ inputs.release_type }}
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ENVIRONMENT: preprod
         run: |
           pip install requests
           python scripts/workflow/tag_and_release.py

infrastructure/stacks/iams-developer-roles/github_actions_policies.tf

@@ -209,16 +209,16 @@ resource "aws_iam_policy" "s3_management" {
         Resource = [
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-rules",
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-rules/*",
-          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-consumer-map",
-          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-consumer-map/*",
+          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-consumer-map",
+          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-consumer-map/*",
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-audit",
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-audit/*",
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-rules-access-logs",
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-rules-access-logs/*",
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-audit-access-logs",
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-audit-access-logs/*",
-          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-consumer-map-access-logs",
-          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-consumer-map-access-logs/*",
+          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-consumer-map-access-logs",
+          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-consumer-map-access-logs/*",
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-truststore",
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-truststore/*",
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-truststore-access-logs",

infrastructure/stacks/networking/ssm.tf

@@ -1,4 +1,5 @@
 resource "aws_ssm_parameter" "proxygen_private_key" {
+  count = var.environment == "dev" ? 1 : 0
   name  = "/${var.environment}/proxygen/private_key"
   type  = "SecureString"
   key_id = aws_kms_key.networking_ssm_key.id