PLT-292 Test infra for opt-out-import #51
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🎫 Ticket
https://jira.cms.gov/browse/PLT-292
🛠 Changes
Refactoring of shared terraform to support test infra for opt-out-import.
ℹ️ Context for reviewers
In adding the opt-out-import test infra I realized we could wrap resources like S3 buckets and KMS keys in modules to standardize configuration. I also updated handling of AWS account IDs to mask them in logs.
I've also dropped the reusable terraform-command workflow, which is both too powerful (allowing one-off infra changes without understanding context) and not flexible enough to enable updates like the ones mentioned in Acceptance Validation below.
Note that these changes will also require updates to roles and buckets in opt-out-import workflows in ab2d-lambdas and dpc-app, and roles in ab2d and ab2d-events.
✅ Acceptance Validation
All terraform plans should pass. I'm also temporarily updating some apply workflows to move resources in state (like tfstate buckets) to avoid deletion. These should be reviewed on merge, and I will follow up with a PR to return those apply workflows to their usual commands.
🔒 Security Implications
None.