Skip to content

Commit 3011d7b

Browse files
anthony-nhsanthony-nhs
authored
Chore: [AEA-6593] - move to new exports (#3025)
## Summary - Routine Change ### Details - move to new exports - use latest regression tests
1 parent 2654608 commit 3011d7b

13 files changed

Lines changed: 128 additions & 105 deletions

‎.github/scripts/delete_proxygen_deployments.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,8 @@ delete_apigee_deployments() {
2323
APIGEE_API=$2
2424
PROXYGEN_PRIVATE_KEY_NAME=$3
2525
PROXYGEN_KID=$4
26-
proxygen_private_key_arn=$(aws cloudformation list-exports --query "Exports[?Name=='account-resources:${PROXYGEN_PRIVATE_KEY_NAME}'].Value" --output text)
27-
26+
proxygen_private_key_arn=$(aws cloudformation list-exports --query "Exports[?Name=='secrets-cdk:Secrets:${PROXYGEN_PRIVATE_KEY_NAME}:Arn'].Value" --output text)
27+
2828
echo
2929
echo "checking apigee deployments on ${APIGEE_ENVIRONMENT}"
3030
echo

‎.github/scripts/deploy_api.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -123,7 +123,7 @@ echo
123123
echo "Retrieving proxygen credentials"
124124

125125
# Retrieve the proxygen private key and client private key and cert from AWS Secrets Manager
126-
proxygen_private_key_arn=$(aws cloudformation list-exports --query "Exports[?Name=='account-resources:${PROXYGEN_PRIVATE_KEY_NAME}'].Value" --output text)
126+
proxygen_private_key_arn=$(aws cloudformation list-exports --query "Exports[?Name=='secrets-cdk:Secrets:${PROXYGEN_PRIVATE_KEY_NAME}:Arn'].Value" --output text)
127127

128128
if [[ "${ENABLE_MUTUAL_TLS}" == "true" ]]; then
129129
echo

‎.github/scripts/release_code.sh‎

Lines changed: 28 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -6,27 +6,43 @@ export AWS_MAX_ATTEMPTS
66
echo "$COMMIT_ID"
77

88
CF_LONDON_EXPORTS=$(aws cloudformation list-exports --region eu-west-2 --output json)
9-
artifact_bucket_arn=$(echo "$CF_LONDON_EXPORTS" | \
9+
10+
ARTIFACT_BUCKET_ARN=$(echo "$CF_LONDON_EXPORTS" | \
1011
jq \
11-
--arg EXPORT_NAME "account-resources:ArtifactsBucket" \
12+
--arg EXPORT_NAME "account-resources-cdk-uk:Bucket:ArtifactsBucket:Arn" \
1213
-r '.Exports[] | select(.Name == $EXPORT_NAME) | .Value')
13-
artifact_bucket=$(echo "$artifact_bucket_arn" | cut -d: -f6 | cut -d/ -f1)
14-
export artifact_bucket
14+
ARTIFACT_BUCKET_NAME=$(echo "${ARTIFACT_BUCKET_ARN}" | cut -d ":" -f 6)
15+
16+
if [ -z "${ARTIFACT_BUCKET_NAME}" ]; then
17+
echo "could not retrieve ARTIFACT_BUCKET_NAME from aws cloudformation list-exports"
18+
exit 1
19+
fi
1520

16-
cloud_formation_execution_role=$(echo "$CF_LONDON_EXPORTS" | \
21+
CLOUD_FORMATION_EXECUTION_ROLE=$(echo "$CF_LONDON_EXPORTS" | \
1722
jq \
18-
--arg EXPORT_NAME "ci-resources:CloudFormationExecutionRole" \
23+
--arg EXPORT_NAME "iam-cdk:IAM:CloudFormationExecutionRole:Arn" \
1924
-r '.Exports[] | select(.Name == $EXPORT_NAME) | .Value')
2025

21-
if [ -z "${cloud_formation_execution_role}" ]; then
22-
echo "could not retrieve ROLE from aws cloudformation list-exports"
26+
if [ -z "${CLOUD_FORMATION_EXECUTION_ROLE}" ]; then
27+
echo "could not retrieve CLOUD_FORMATION_EXECUTION_ROLE from aws cloudformation list-exports"
2328
exit 1
2429
fi
25-
export cloud_formation_execution_role
2630

27-
TRUSTSTORE_BUCKET_ARN=$(aws cloudformation describe-stacks --stack-name account-resources --query "Stacks[0].Outputs[?OutputKey=='TrustStoreBucket'].OutputValue" --output text)
31+
TRUSTSTORE_BUCKET_ARN=$(echo "$CF_LONDON_EXPORTS" | \
32+
jq \
33+
--arg EXPORT_NAME "account-resources-cdk-uk:Bucket:TrustStoreBucket:Arn" \
34+
-r '.Exports[] | select(.Name == $EXPORT_NAME) | .Value')
2835
TRUSTSTORE_BUCKET_NAME=$(echo "${TRUSTSTORE_BUCKET_ARN}" | cut -d ":" -f 6)
36+
37+
if [ -z "${TRUSTSTORE_BUCKET_NAME}" ]; then
38+
echo "could not retrieve TRUSTSTORE_BUCKET_NAME from aws cloudformation list-exports"
39+
exit 1
40+
fi
41+
2942
LATEST_TRUSTSTORE_VERSION=$(aws s3api list-object-versions --bucket "${TRUSTSTORE_BUCKET_NAME}" --prefix "${TRUSTSTORE_FILE}" --query 'Versions[?IsLatest].[VersionId]' --output text)
43+
44+
export ARTIFACT_BUCKET_NAME
45+
export CLOUD_FORMATION_EXECUTION_ROLE
3046
export LATEST_TRUSTSTORE_VERSION
3147

3248
cd ../../.aws-sam/build || exit
@@ -42,11 +58,11 @@ sam deploy \
4258
--stack-name "$STACK_NAME" \
4359
--capabilities CAPABILITY_NAMED_IAM CAPABILITY_AUTO_EXPAND \
4460
--region eu-west-2 \
45-
--s3-bucket "$artifact_bucket" \
61+
--s3-bucket "$ARTIFACT_BUCKET_NAME" \
4662
--s3-prefix "$ARTIFACT_BUCKET_PREFIX" \
4763
--config-file samconfig_package_and_deploy.toml \
4864
--no-fail-on-empty-changeset \
49-
--role-arn "$cloud_formation_execution_role" \
65+
--role-arn "$CLOUD_FORMATION_EXECUTION_ROLE" \
5066
--no-confirm-changeset \
5167
--force-upload \
5268
--tags "version=$VERSION_NUMBER stack=$STACK_NAME repo=$REPO cfnDriftDetectionGroup=$CFN_DRIFT_DETECTION_GROUP" \

‎.github/workflows/run_regression_tests.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -60,11 +60,11 @@ jobs:
6060
run: |
6161
if [[ "$TARGET_ENVIRONMENT" != "prod" && "$TARGET_ENVIRONMENT" != "ref" ]]; then
6262
# this should be the tag of the tests you want to run
63-
REGRESSION_TEST_REPO_TAG=v3.10.9
63+
REGRESSION_TEST_REPO_TAG=v3.12.36
6464
6565
# this should be the tag of the regression test workflow you want to run
6666
# This will normally be the same as REGRESSION_TEST_REPO_TAG
67-
REGRESSION_TEST_WORKFLOW_TAG=v3.10.9
67+
REGRESSION_TEST_WORKFLOW_TAG=v3.12.36
6868
6969
curl https://raw.githubusercontent.com/NHSDigital/electronic-prescription-service-api-regression-tests/refs/tags/${REGRESSION_TEST_WORKFLOW_TAG}/scripts/run_regression_tests.py -o run_regression_tests.py
7070
poetry install

‎.github/workflows/run_release_code_and_api.yml‎

Lines changed: 9 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -247,8 +247,15 @@ jobs:
247247
shell: bash
248248
run: |
249249
mkdir -p ~/.proxygen/tmp
250-
client_private_key_arn=$(aws cloudformation list-exports --query "Exports[?Name=='account-resources:PsuClientKeySecret'].Value" --output text)
251-
client_cert_arn=$(aws cloudformation list-exports --query "Exports[?Name=='account-resources:PsuClientCertSecret'].Value" --output text)
250+
CF_LONDON_EXPORTS=$(aws cloudformation list-exports --region eu-west-2 --output json)
251+
client_private_key_arn=$(echo "$CF_LONDON_EXPORTS" | \
252+
jq \
253+
--arg EXPORT_NAME "secrets-cdk:Secrets:PsuClientKeySecret:Arn" \
254+
-r '.Exports[] | select(.Name == $EXPORT_NAME) | .Value')
255+
client_cert_arn=$(echo "$CF_LONDON_EXPORTS" | \
256+
jq \
257+
--arg EXPORT_NAME "secrets-cdk:Secrets:PsuClientCertSecret:Arn" \
258+
-r '.Exports[] | select(.Name == $EXPORT_NAME) | .Value')
252259
aws secretsmanager get-secret-value --secret-id "${client_private_key_arn}" --query SecretString --output text > ~/.proxygen/tmp/client_private_key
253260
aws secretsmanager get-secret-value --secret-id "${client_cert_arn}" --query SecretString --output text > ~/.proxygen/tmp/client_cert
254261
env:

‎SAMtemplates/alarms/main.yaml‎

Lines changed: 27 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,11 @@ Resources:
6666
TreatMissingData: notBreaching
6767
ActionsEnabled: !Ref EnableAlerts
6868
AlarmActions:
69-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
69+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
7070
InsufficientDataActions:
71-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
71+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
7272
OKActions:
73-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
73+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
7474

7575
GetStatusUpdatesUnhandledErrorsAlarm:
7676
Type: AWS::CloudWatch::Alarm
@@ -91,11 +91,11 @@ Resources:
9191
TreatMissingData: notBreaching
9292
ActionsEnabled: !Ref EnableAlerts
9393
AlarmActions:
94-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
94+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
9595
InsufficientDataActions:
96-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
96+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
9797
OKActions:
98-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
98+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
9999

100100
PrescriptionStatusUpdateErrorsLogsMetricFilter:
101101
Type: AWS::Logs::MetricFilter
@@ -172,11 +172,11 @@ Resources:
172172
TreatMissingData: notBreaching
173173
ActionsEnabled: !Ref EnableAlerts
174174
AlarmActions:
175-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
175+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
176176
InsufficientDataActions:
177-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
177+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
178178
OKActions:
179-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
179+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
180180

181181
PrescriptionStatusUpdateUnhandledErrorsAlarm:
182182
Type: AWS::CloudWatch::Alarm
@@ -197,11 +197,11 @@ Resources:
197197
TreatMissingData: notBreaching
198198
ActionsEnabled: !Ref EnableAlerts
199199
AlarmActions:
200-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
200+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
201201
InsufficientDataActions:
202-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
202+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
203203
OKActions:
204-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
204+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
205205

206206
DynamoDBSystemErrorsAlarm:
207207
Type: AWS::CloudWatch::Alarm
@@ -222,11 +222,11 @@ Resources:
222222
TreatMissingData: notBreaching
223223
ActionsEnabled: !Ref EnableAlerts
224224
AlarmActions:
225-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
225+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
226226
InsufficientDataActions:
227-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
227+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
228228
OKActions:
229-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
229+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
230230

231231
DynamoDBWriteConsumptionAlarm:
232232
Type: AWS::CloudWatch::Alarm
@@ -235,11 +235,11 @@ Resources:
235235
AlarmName: !Sub "${AWS::StackName}_DynamoDB_ConsumedWriteCapacity"
236236
ActionsEnabled: !Ref EnableAlerts
237237
AlarmActions:
238-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
238+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
239239
InsufficientDataActions:
240-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
240+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
241241
OKActions:
242-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
242+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
243243
EvaluationPeriods: 1
244244
Threshold: !Ref DynamoDBUtilizationPercentageThreshold
245245
ComparisonOperator: GreaterThanOrEqualToThreshold
@@ -307,11 +307,11 @@ Resources:
307307
TreatMissingData: notBreaching
308308
ActionsEnabled: !Ref EnableAlerts
309309
AlarmActions:
310-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
310+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
311311
InsufficientDataActions:
312-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
312+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
313313
OKActions:
314-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
314+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
315315

316316
NotifyProcessorTimeoutsMetricFilter:
317317
Type: AWS::Logs::MetricFilter
@@ -344,11 +344,11 @@ Resources:
344344
TreatMissingData: notBreaching
345345
ActionsEnabled: !Ref EnableAlerts
346346
AlarmActions:
347-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
347+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
348348
InsufficientDataActions:
349-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
349+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
350350
OKActions:
351-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
351+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
352352

353353
NHSNotifyPrescriptionsDeadLetterQueueMessagesAlarm:
354354
Type: AWS::CloudWatch::Alarm
@@ -370,8 +370,8 @@ Resources:
370370
TreatMissingData: notBreaching
371371
ActionsEnabled: !Ref EnableAlerts
372372
AlarmActions:
373-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
373+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
374374
InsufficientDataActions:
375-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
375+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn
376376
OKActions:
377-
- !ImportValue lambda-resources:SlackAlertsSnsTopicArn
377+
- !ImportValue account-resources-cdk-uk:SNS:SlackAlertsSnsTopicArn:Arn

‎SAMtemplates/apis/api_resources.yaml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -68,22 +68,22 @@ Resources:
6868
Properties:
6969
LogGroupName: !Sub /aws/apigateway/${ApiName}
7070
RetentionInDays: !Ref LogRetentionInDays
71-
KmsKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
71+
KmsKeyId: !ImportValue account-resources-cdk-uk:KMS:CloudwatchLogsKmsKey:Arn
7272

7373
ApiGwAccessLogsSplunkSubscriptionFilter:
7474
Condition: ShouldUseSplunk
7575
Type: AWS::Logs::SubscriptionFilter
7676
Properties:
77-
RoleArn: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
77+
RoleArn: !ImportValue account-resources-cdk-uk:IAM:SplunkSubscriptionFilterRole:Arn
7878
LogGroupName: !Ref ApiGwAccessLogs
7979
FilterPattern: ""
80-
DestinationArn: !ImportValue lambda-resources:SplunkDeliveryStream
80+
DestinationArn: !ImportValue account-resources-cdk-uk:Firehose:SplunkDeliveryStream:Arn
8181

8282
ApiGwAccessLogsCsocSubscriptionFilter:
8383
Condition: ShouldForwardCsocLogs
8484
Type: AWS::Logs::SubscriptionFilter
8585
Properties:
86-
RoleArn: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
86+
RoleArn: !ImportValue account-resources-cdk-uk:IAM:SplunkSubscriptionFilterRole:Arn
8787
LogGroupName: !Ref ApiGwAccessLogs
8888
FilterPattern: ""
8989
DestinationArn: "arn:aws:logs:eu-west-2:693466633220:destination:api_gateway_log_destination"

‎SAMtemplates/apis/main.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -147,7 +147,7 @@ Resources:
147147
- 5
148148
- !Split
149149
- ":"
150-
- !ImportValue account-resources:TrustStoreBucket
150+
- !ImportValue account-resources-cdk-uk:Bucket:TrustStoreBucket:Arn
151151
- psu-truststore.pem
152152
- !Ref AWS::NoValue
153153
TruststoreVersion: !If

‎SAMtemplates/functions/lambda_resources.yaml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -80,9 +80,9 @@ Resources:
8080
- !Join
8181
- ","
8282
- - !Ref LambdaManagedPolicy
83-
- !ImportValue lambda-resources:LambdaInsightsLogGroupPolicy
84-
- !ImportValue account-resources:CloudwatchEncryptionKMSPolicyArn
85-
- !ImportValue account-resources:LambdaDecryptSecretsKMSPolicy
83+
- !ImportValue account-resources-cdk-uk:IAM:LambdaInsightsLogGroupPolicy:Arn
84+
- !ImportValue account-resources-cdk-uk:IAM:CloudwatchEncryptionKMSPolicy:Arn
85+
- !ImportValue secrets-cdk:IAM:LambdaDecryptSecretsKMSPolicy:Arn
8686
- !If
8787
- ShouldIncludeAdditionalPolicies
8888
- !Join

0 commit comments

Comments
 (0)