Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update provider to modernisation-secrets-read and add modernisation-secrets-read provider #9526

Merged
merged 1 commit into from
Mar 12, 2025

Conversation

sukeshreddyg
Copy link
Contributor

@sukeshreddyg sukeshreddyg commented Mar 12, 2025

A reference to the issue / Description of it

Recently, we created separate GitHub Actions roles for development and test accounts. In the current setup (a PR will be raised soon), an issue arose when running Member Environments workflow —secrets could not be accessed from the Modernisation Platform (MP) account due to the OIDC connection pointing to each member account. This resulted in failures to retrieve the necessary secrets. #8590

How does this PR fix the problem?

To resolve this issue, we have added a provider to assume a role in the MP account that has the necessary permissions to read the secrets. This ensures that secrets are accessed from the MP account regardless of the active OIDC connection in the Member account.

How has this been tested?

Tested Manually and also tested on Member Environment workflow

Deployment Plan / Instructions

Will this deployment impact the platform and / or services on it?

{Please write here}

Checklist (check x in [ ] of list items)

  • I have performed a self-review of my own code
  • All checks have passed
  • I have made corresponding changes to the documentation
  • Plan and discussed how it should be deployed to PROD (If needed)

Additional comments (if any)

{Please write here}

@sukeshreddyg sukeshreddyg marked this pull request as ready for review March 12, 2025 13:50
@sukeshreddyg sukeshreddyg requested a review from a team as a code owner March 12, 2025 13:50
Copy link
Contributor

Terraform Plan Summary

core-vpc-test
No changes. Your infrastructure matches the configuration.

Copy link
Contributor

Terraform Plan Summary

core-vpc-development
No changes. Your infrastructure matches the configuration.

Copy link
Contributor

Terraform Plan Summary

core-vpc-preproduction
No changes. Your infrastructure matches the configuration.

Copy link
Contributor

Terraform Plan Summary

core-vpc-production
No changes. Your infrastructure matches the configuration.

Copy link
Contributor

Terraform Plan Summary

core-logging-production
No changes. Your infrastructure matches the configuration.

Copy link
Contributor

Terraform Plan Summary

core-security-production
No changes. Your infrastructure matches the configuration.

Copy link
Contributor

Terraform Plan Summary

core-network-services-production
No changes. Your infrastructure matches the configuration.

Copy link
Contributor

Terraform Plan Summary

core-shared-services-production
Plan: 0 to add, 1 to change, 0 to destroy.

Copy link
Contributor

@mikereiddigital mikereiddigital left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've reviewed this PR. Each account has a new provider added that calls the modernisation-account-limited-read-member-access` role and this provider is used by the environment_management data call.

@sukeshreddyg sukeshreddyg added this pull request to the merge queue Mar 12, 2025
Merged via the queue into main with commit 822192b Mar 12, 2025
24 checks passed
@sukeshreddyg sukeshreddyg deleted the fix/update-secrets-providers-tf branch March 12, 2025 15:25
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants