adam/payments-dashboard
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/payments-dashboard.git synced 2026-09-30 07:43:12 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix(infra): pin secret and CMK ARNs for bootstrap-plan

Browse source 
hcptf-bootstrap-plan cannot ssm:GetParameter or DescribeSecret, so the first plan must not data-source those values.
This commit is contained in:
Adam Moussa 2026-09-16 13:58:33 -04:00
parent 6f32f3bfcd
commit 47f85213cb
No known key found for this signature in database
6 changed files with 19 additions and 25 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
terraform/data.tf
View file

@ -1,7 +1,3 @@
data "aws_ssm_parameter" "dynamodb_cmk" {
name = local.dynamodb_cmk_ssm
}
resource "aws_dynamodb_table" "dashboard" {
name = local.table_name
billing_mode = "PAY_PER_REQUEST"
@ -19,7 +15,7 @@ resource "aws_dynamodb_table" "dashboard" {
server_side_encryption {
enabled = true
kms_key_arn = data.aws_ssm_parameter.dynamodb_cmk.value
kms_key_arn = local.dynamodb_cmk_arn
}
}

4
terraform/hcp_iam.tf
View file

@ -472,7 +472,7 @@ data "aws_iam_policy_document" "hcptf_apply_services" {
"kms:ListGrants",
"kms:RetireGrant",
]
resources = [data.aws_ssm_parameter.dynamodb_cmk.value]
resources = [local.dynamodb_cmk_arn]
}
statement {
@ -820,7 +820,7 @@ data "aws_iam_policy_document" "hcptf_plan_refresh" {
"kms:GetKeyPolicy",
"kms:ListResourceTags",
]
resources = [data.aws_ssm_parameter.dynamodb_cmk.value]
resources = [local.dynamodb_cmk_arn]
}
statement {

2
terraform/lambda.tf
View file

@ -18,7 +18,7 @@ data "aws_iam_policy_document" "lambda_assume" {
locals {
table_arn = aws_dynamodb_table.dashboard.arn
cmk_arn = data.aws_ssm_parameter.dynamodb_cmk.value
cmk_arn = local.dynamodb_cmk_arn
lambda_identity = {
process_csv = [

2
terraform/lambda_boundary.tf
View file

@ -87,7 +87,7 @@ data "aws_iam_policy_document" "lambda_boundary" {
"kms:GenerateDataKey",
"kms:DescribeKey",
]
resources = [data.aws_ssm_parameter.dynamodb_cmk.value]
resources = [local.dynamodb_cmk_arn]
condition {
test = "StringEquals"

20
terraform/locals.tf
View file

@ -23,14 +23,18 @@ locals {
# Org has Actions OIDC use_immutable_subject=true.
github_oidc_sub = "repo:Sea-Haven-Industries@183236204/payments-dashboard@1206210946:environment:prod"
secret_names = [
"payments-dashboard/slack-bot-token",
"payments-dashboard/slack-signing-secret",
"payments-dashboard/boa-check-mgmt",
"payments-dashboard/boa-reporting",
"payments-dashboard/expense-slack-token",
"payments-dashboard/expense-slack-signing-secret",
]
dynamodb_cmk_arn = "arn:aws:kms:us-east-1:011934824531:key/be5fa4cb-c546-40fe-a13d-c7bec79f5d12"
# Exact ARNs (ticket rule). Hardcoded so the first plan can run as
# hcptf-bootstrap-plan, which cannot ssm:GetParameter / DescribeSecret.
secret_arns = {
"payments-dashboard/slack-bot-token" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/slack-bot-token-0pAM3S"
"payments-dashboard/slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/slack-signing-secret-u0T6h8"
"payments-dashboard/boa-check-mgmt" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/boa-check-mgmt-LEbC65"
"payments-dashboard/boa-reporting" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/boa-reporting-JoR9lq"
"payments-dashboard/expense-slack-token" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/expense-slack-token-SeMg3s"
"payments-dashboard/expense-slack-signing-secret" = "arn:aws:secretsmanager:us-east-1:011934824531:secret:payments-dashboard/expense-slack-signing-secret-lbb78J"
}
functions = {
process_csv = {

10
terraform/secrets.tf
View file

@ -1,8 +1,2 @@
data "aws_secretsmanager_secret" "this" {
for_each = toset(local.secret_names)
name = each.value
}
locals {
secret_arns = { for name, secret in data.aws_secretsmanager_secret.this : name => secret.arn }
}
# Secret values stay in Secrets Manager. ARNs are pinned in locals.tf so the
# first bootstrap-plan does not need secretsmanager:DescribeSecret.