Skip to content

Commit c713776

Browse files
jimlerzajimlerza
authored
Merge pull request #3996 from ustaxcourt/staging
Merge Staging into Prod
2 parents 3dfd16d + 2558b53 commit c713776

File tree

207 files changed

+13951
-5306
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

207 files changed

+13951
-5306
lines changed

‎.circleci/config.yml

+409-121
Large diffs are not rendered by default.

‎Dockerfile

+2-2
Original file line numberDiff line numberDiff line change
@@ -37,13 +37,13 @@ RUN apt-get install -y build-essential
3737
RUN apt-get install -y libcairo2-dev libpango1.0-dev libjpeg-dev libgif-dev librsvg2-dev
3838

3939
ENV JAVA_HOME=/usr/lib/jvm/java-11-openjdk-amd64
40-
RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64-2.13.13.zip" -o "awscliv2.zip" && \
40+
RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64-2.13.17.zip" -o "awscliv2.zip" && \
4141
unzip awscliv2.zip && \
4242
./aws/install && \
4343
rm -rf awscliv2.zip
4444

4545
RUN pip install --upgrade pip
46-
RUN wget -q -O terraform.zip https://releases.hashicorp.com/terraform/1.5.6/terraform_1.5.6_linux_amd64.zip && \
46+
RUN wget -q -O terraform.zip https://releases.hashicorp.com/terraform/1.5.7/terraform_1.5.7_linux_amd64.zip && \
4747
unzip -o terraform.zip terraform && \
4848
rm terraform.zip && \
4949
cp terraform /usr/local/bin/

‎cypress/cypress-integration/support/index.ts

-1
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,4 @@
11
import './commands';
2-
import 'cypress-real-events/support';
32

43
before(() => {
54
// Skip subsequent tests in spec when one fails.

‎docs/dependency-updates.md

+17-3
Original file line numberDiff line numberDiff line change
@@ -35,11 +35,25 @@ At the moment, the only task we rotate is updating dependencies. As an open-sour
3535

3636
> Refer to [ci-cd.md](ci-cd.md#docker) for more info on this as needed
3737
38-
5. Verify the PDF's still pass by running the commands listed on `./docs/testing.md` under the _PDF Testing_ heading
38+
5. Check if there is an update to the Terraform AWS provider and update all of the following files to use the [latest version](https://registry.terraform.io/providers/hashicorp/aws/latest) of the provider.
39+
- ./iam/terraform/account-specific/main/main.tf
40+
- ./iam/terraform/environment-specific/main/main.tf
41+
- ./shared/admin-tools/glue/glue_migrations/main.tf
42+
- ./shared/admin-tools/glue/remote_role/main.tf
43+
- ./web-api/terraform/main/main.tf
44+
- ./web-api/workflow-terraform/migration/main/main.tf
45+
- ./web-api/workflow-terraform/migration-cron/main/main.tf
46+
- ./web-api/workflow-terraform/reindex-cron/main/main.tf
47+
- ./web-api/workflow-terraform/switch-colors-cron/main/main.tf
48+
- ./web-client/terraform/main/main.tf
3949

40-
6. Check through the list of caveats to see if any of the documented issues have been resolved.
50+
> aws = "latest version"
4151

42-
7. Validate updates by deploying, with a [migration](./additional-resources/blue-green-migration.md#manual-migration-steps), to an experimental environment. This helps us verify that the package updates don't affect the migration workflow.
52+
6. Verify the PDF's still pass by running the commands listed on `./docs/testing.md` under the _PDF Testing_ heading
53+
54+
7. Check through the list of caveats to see if any of the documented issues have been resolved.
55+
56+
8. Validate updates by deploying, with a [migration](./additional-resources/blue-green-migration.md#manual-migration-steps), to an experimental environment. This helps us verify that the package updates don't affect the migration workflow.
4357

4458
## Caveats
4559

‎docs/operations/production-like-data-sets.md

-25
This file was deleted.

‎iam/terraform/account-specific/main/circle-ci.tf

+59-30
Original file line numberDiff line numberDiff line change
@@ -16,25 +16,6 @@ resource "aws_iam_policy" "circle_ci_policy" {
1616
{
1717
"Version": "2012-10-17",
1818
"Statement": [
19-
{
20-
"Sid": "Route53",
21-
"Effect": "Allow",
22-
"Action": [
23-
"route53:GetChange",
24-
"route53:GetHostedZone",
25-
"route53:ListResourceRecordSets",
26-
"route53:ListHostedZones",
27-
"route53:ChangeResourceRecordSets",
28-
"route53:ListTagsForResource",
29-
"route53:ListHostedZonesByName",
30-
"route53:CreateHealthCheck",
31-
"route53:DeleteHealthCheck",
32-
"route53:GetHealthCheck",
33-
"route53:ListHealthChecks",
34-
"route53:UpdateHealthCheck"
35-
],
36-
"Resource": "*"
37-
},
3819
{
3920
"Sid": "DynamoDb",
4021
"Effect": "Allow",
@@ -111,6 +92,7 @@ resource "aws_iam_policy" "circle_ci_policy" {
11192
"Sid": "Acm",
11293
"Effect": "Allow",
11394
"Action": [
95+
"acm:GetCertificate",
11496
"acm:RequestCertificate",
11597
"acm:ListCertificates",
11698
"acm:AddTagsToCertificate",
@@ -294,18 +276,18 @@ resource "aws_iam_policy" "circle_ci_policy" {
294276
},
295277
{
296278
"Action": [
297-
"ssm:PutParameter",
298-
"ssm:LabelParameterVersion",
299-
"ssm:DeleteParameter",
300-
"ssm:DeleteParameters",
301-
"ssm:UnlabelParameterVersion",
279+
"ssm:PutParameter",
280+
"ssm:LabelParameterVersion",
281+
"ssm:DeleteParameter",
282+
"ssm:DeleteParameters",
283+
"ssm:UnlabelParameterVersion",
302284
"ssm:ListTagsForResource",
303-
"ssm:DescribeParameters",
304-
"ssm:DescribeDocumentParameters",
305-
"ssm:GetParameterHistory",
306-
"ssm:GetParametersByPath",
307-
"ssm:GetParameters",
308-
"ssm:GetParameter"
285+
"ssm:DescribeParameters",
286+
"ssm:DescribeDocumentParameters",
287+
"ssm:GetParameterHistory",
288+
"ssm:GetParametersByPath",
289+
"ssm:GetParameters",
290+
"ssm:GetParameter"
309291
],
310292
"Resource": "*",
311293
"Effect": "Allow"
@@ -320,6 +302,53 @@ resource "aws_iam_policy" "circle_ci_policy" {
320302
"arn:aws:ecs:us-east-1:${data.aws_caller_identity.current.account_id}:service/clamav_fargate_cluster_*/clamav_service_*"
321303
],
322304
"Effect": "Allow"
305+
},
306+
{
307+
"Action": [
308+
"glue:GetJobRuns",
309+
"glue:StartJobRun"
310+
],
311+
"Resource": [
312+
"arn:aws:glue:us-east-1:${data.aws_caller_identity.current.account_id}:job/*"
313+
],
314+
"Effect": "Allow"
315+
}
316+
]
317+
}
318+
319+
EOF
320+
}
321+
322+
resource "aws_iam_user_policy_attachment" "circle_ci_route53_policy_attachment" {
323+
user = aws_iam_user.circle_ci.name
324+
policy_arn = aws_iam_policy.circle_ci_route53_policy.arn
325+
}
326+
327+
resource "aws_iam_policy" "circle_ci_route53_policy" {
328+
name = "circle_ci_route53_policy"
329+
330+
policy = <<EOF
331+
{
332+
"Version": "2012-10-17",
333+
"Statement": [
334+
{
335+
"Sid": "Route53",
336+
"Effect": "Allow",
337+
"Action": [
338+
"route53:GetChange",
339+
"route53:GetHostedZone",
340+
"route53:ListResourceRecordSets",
341+
"route53:ListHostedZones",
342+
"route53:ChangeResourceRecordSets",
343+
"route53:ListTagsForResource",
344+
"route53:ListHostedZonesByName",
345+
"route53:CreateHealthCheck",
346+
"route53:DeleteHealthCheck",
347+
"route53:GetHealthCheck",
348+
"route53:ListHealthChecks",
349+
"route53:UpdateHealthCheck"
350+
],
351+
"Resource": "*"
323352
}
324353
]
325354
}

‎iam/terraform/account-specific/main/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,6 @@ terraform {
1717
}
1818

1919
required_providers {
20-
aws = "3.76.0"
20+
aws = "5.16.1"
2121
}
2222
}

‎iam/terraform/environment-specific/main/glue-job-status.tf

+53
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
resource "aws_iam_role" "glue_job_status_role" {
2+
name = "glue_job_status_role_${var.environment}"
3+
4+
assume_role_policy = <<EOF
5+
{
6+
"Version": "2012-10-17",
7+
"Statement": [
8+
{
9+
"Action": "sts:AssumeRole",
10+
"Principal": {
11+
"Service": "lambda.amazonaws.com"
12+
},
13+
"Effect": "Allow",
14+
"Sid": ""
15+
}
16+
]
17+
}
18+
EOF
19+
}
20+
21+
resource "aws_iam_role_policy" "glue_job_status_policy" {
22+
name = "glue_job_status_policy_${var.environment}"
23+
role = aws_iam_role.glue_job_status_role.id
24+
25+
policy = <<EOF
26+
{
27+
"Version": "2012-10-17",
28+
"Statement": [
29+
{
30+
"Effect": "Allow",
31+
"Action": [
32+
"logs:CreateLogGroup",
33+
"logs:CreateLogStream",
34+
"logs:PutLogEvents",
35+
"logs:DescribeLogStreams"
36+
],
37+
"Resource": [
38+
"arn:aws:logs:*:*:*"
39+
]
40+
},
41+
{
42+
"Action": [
43+
"glue:GetJobRuns"
44+
],
45+
"Resource": [
46+
"arn:aws:glue:us-east-1:${data.aws_caller_identity.current.account_id}:job/*"
47+
],
48+
"Effect": "Allow"
49+
}
50+
]
51+
}
52+
EOF
53+
}

‎iam/terraform/environment-specific/main/main.tf

+1-1
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,6 @@ terraform {
77
}
88

99
required_providers {
10-
aws = "3.76.0"
10+
aws = "5.16.1"
1111
}
1212
}

0 commit comments

Comments
 (0)