diff --git a/ops/services/10-config/values/prod.sopsw.yaml b/ops/services/10-config/values/prod.sopsw.yaml index 43d0516de..fdddde152 100644 --- a/ops/services/10-config/values/prod.sopsw.yaml +++ b/ops/services/10-config/values/prod.sopsw.yaml @@ -115,9 +115,9 @@ /ab2d/${env}/db/okta_client_password: ENC[AES256_GCM,data:4I7AQ3TVey7NWQo+LXSd00l5mWwquz15oS3V2pBn2FBeN1/a5M0/Eg==,iv:m3nAVFJBEXsmVMawZBLneZ8aPcs0Nt2q0cpXCQ2Dy5E=,tag:avn2pZ9No8MXzxPEdbSdAA==,type:str] /ab2d/${env}/db/analyst_database_user: ENC[AES256_GCM,data:JG/JiPkKmblTAEs7,iv:dyYZPi6LB8eY0FmgQQmTAqqEBMurfnB6wniLiOIjuR8=,tag:ELGw9CEj3aVle3cmsSPEZg==,type:str] /ab2d/${env}/db/analyst_database_password: ENC[AES256_GCM,data:durX20nFleVd1llp7fJ9ErhMuigmVW0b,iv:7hFlHHi7BuWvFzYrC/kxfxq8JSaTi81Vhs84l+9r8LM=,tag:zlz7SSFXnS3XwyPR6ZMxIA==,type:str] -/ab2d/${env}/core/sensitive/idr_service_id_name: ENC[AES256_GCM,data:E0jXiiSiwbmPiXmrqQK031o=,iv:kvYbZud/WrPgYjAHXdb3YoGmspBJNB3DYk3BAGLBqws=,tag:HshYUpVOfiPKnNm4juvCIg==,type:str] -/ab2d/${env}/core/sensitive/idr_role_name: ENC[AES256_GCM,data:rIDGsEzSQE2mMraWO5ogN0Y=,iv:90CXd/kfui7Xv1hSL51XGPk5hQ3X2O6r3mLgTjRMRUU=,tag:W6oTEdQqLynt17ZtQu/iJQ==,type:str] -/ab2d/${env}/core/sensitive/idr_warehouse_name: ENC[AES256_GCM,data:EZNcZbTFU4DwG9ucwDushA==,iv:faafJesK/34WMLs77i/1Dge1J7xMihm245DmmALS3+E=,tag:9ZZOTG3G9tNfb7TsQsbyjQ==,type:str] +/ab2d/${env}/idr-db-importer/sensitive/snowflake_user: ENC[AES256_GCM,data:A/Mc1iFNCtf9y0FhlZYxANs=,iv:1C/wQmqVdHiTLbZDUrMv7VWHXUj92NwhGzqF1qqpg2Q=,tag:1qmjvKD6xl2ucBr/SLb8tQ==,type:str] +/ab2d/${env}/idr-db-importer/sensitive/snowflake_role: ENC[AES256_GCM,data:dZAzpeZdmZWtSEBVK59LE5c=,iv:IWWK2drSykxQZRlKhGrqetTzzY1QggMa7o7lPEywGmk=,tag:t7jl+l7oPAfQfPqJcgaH7A==,type:str] +/ab2d/${env}/idr-db-importer/sensitive/snowflake_warehouse: ENC[AES256_GCM,data:rmNl3vevbRslCdhnVaQmsw==,iv:pFPJ1vDM4+xpFdI3Ygrr5rvlYBIa1qWSlygMkzgZZ4E=,tag:K9Hy0RqP1pzIzvnTNzZWXg==,type:str] /ab2d/${env}/core/sensitive/idr_service_pwd: ENC[AES256_GCM,data:3VrkanXryb2Br1/wk8eO4R0=,iv:xOSkk75N4QYnNLGML/EmJkQBfLV6UTwYFE49GhwW9wI=,tag:ltowS0VEo3aEnOwR2yNfQQ==,type:str] /ab2d/${env}/web/sensitive/tls_private_key: ENC[AES256_GCM,data:eJ60YH+sGqQ6J4kD0aRfpEQDHrvCQK9PT0OsY0c4zvZWnolbJ/WusAFt7XqzeBx3cAY8dV6Gb6YbwmLn/DBADI5sNV0K/agdRrBZraKkyuhr9sHqQ967wNCVgbqSpjqMtTtauX4ldJO6cOFvPWf5uFCKyZsfTRLP7YaNIeKU3c7p5/g41QqiC5lV3eeu5TvkQiI9qxFiX3pqq1kZ3cB5/K0UAfE8PeE7ocaILkLNr0Te7ozQL39BP8wQiVoJ9kpZ5EyUw3PWNxwXT0SkLozTxrKq5cZ+cIn3jW7VMsn4UKUTamrrrBF5/IJ3MPfwhViSuwFL7jS0wfkolucCxeSajy23MloMBXm34JAJGhZUc6kswp92HbHuHy3bOBz5WQl0dTbChKlSnQz895KXzejAw/e45kPetkaG7Ofu/ZqtvWGyq/THUnbc9GoeOmA5N1lyq3YHCr8DTLnB4vpoz1FMhtqB17zR4ZQeXNzO9Mkv8XfXXwHvINjWaAbXASQGaW0JG8ytg2SnG8rMxc+MnbTzresKDvoBgOdZfIeexqAklq60p3e7HEAnR3C9GFbKNcgSIZdxfr0MAN+QEPNdUQ68qV/Rl3eg84aAyjAditvYN4qrD3MBpLVl70orsCYOQVrSe3UiqpxjDSkb/+dYiiERdYNiIXxba001n4hjICrqhK8xTUPeUaQQvY/nnX4fgf1bdUk8kRYObkBeV2yd6G+spBykMn85JVx3R+pigdGezuxEIaCUTy1HpqSxSGT/PnpWMeFq1Yp9DdzM9DL14wXXj2a7kOYPkDQagpZeKe7P1eMQQ7aq3pBdXU3+pNfkGf5TL0RsxDeBQSLWi7FOcu8to4067D6T90+2WQRdcwKioy4BRyhsItKRyp6cE+W8TlMTkdqJ9pmibfcej4Oe4DeJiYrdDB+U3DyNaSZYBaiJzxquQG9DABOc53N6/f4LZEj2veH58o8KwWkOxUtsWsK/lk9harkfLY8siZ5S5y8CDzFJZqTf3mQCq9iys+g45aHhR3arqIqe8r6ze43tEj0sjg3fqxaQuLbQ1CT0pFELlmO9v85dA9JMz/xsL3EcGRQdLNtOxCmfUBPTstLvh415UpMqnOSa52aNx0j4G4hf1kmNBuUHUMB4iSfE4RBPX3yJ4+VImixarkTa0Y7X1oF4E6YTkt8t3hGgmhM+6+L17ziHlM3uSO/0vR4k+Z5ZKIWXLTfiFfAqVq0wMslKgnrB196n7+UZE7Qi+oahXMRrnUTXmI8KQpC2CXvhQYcJ0ZYAhUIIAHPR4lGKnkJWBYzA4jxlrbmYvElGzDYMegKOmxZ3tDt3TqbBS8dAlMVqO17uAgXyAkGQYgbOiW+Nx2Fr9iAXNAJ0ACkXWCbgqX+woizyoz8z6CJr1Lv7F4GRuBtPQUKNaUWgEtDbI/O0zAYABFF71OG+6+SBzsjM8nmCKw6LPxfr0yZvEWo7Xj6D8geB0bp8/gyv5+jxfaIyrR1j06DYXnafEiRoWqHwGPXp+/QiFotn/K6V9FxnLz2FIz4KID0eq5zTZCd3qCtcslKtynQQ+WNuBYeJh0gtqEhgCgQyqqpKtB305rKqUEs61zslBQf3qUs1RuJ2HCz/BhXBDIibZfts6wX76RyHgS6QyHq84ecZ4XZR29Gk4P5S7nKQMNLL3bk/KXbEF9XPdxSqdx2o+iyzJwyINp1Fk4U0s0dw7eJdPu5jX1Lj3LxQOPMWu7r6YexFLykwBR8R4//D0m11P6u7HldQSXwyjUTYxuqQ91rnZXacErLLK2y8bZDuIS7h1IsJiGsYcN33tZMZ2F2c5pFFQFJu9ig7MiaFbPTGpM9v7Olr3IPJQ3RgdogfNc1p6KHXPe+jD7gGpn8NC1YfrwibtiBuH7m3y7bIIhAqHcb1JHcirXZCMaitwZocRWflqENhWx8S4KjSxklRBeWsVA8gjzmZPHKbBFnjtxSNnmMZHsLiQKD796pWJuRrQnXtnD7AwR0kmtELOnUqhTEySXiKH2KnA4ekKo1GVE5kD2rmhorfXsx+QfBuo2LvZAhKA4bJPzlhS89Rw1Gvi9LZGVMoU0npFD6KMYLy9HiwyzwO/gsiPRiDRPLOdq/MYUADNrdlyyOQ1CvvKf36iR0R23inCcglw7Ag4Je/tmOH4sixL/XdFbkt0qrp1L1KzVWx5jPIPYyRPLnnzrgqtfxfC5bTFjt62bhDj3tR1eG/QWqMNBuBFcYx3x+hcTPHdLxtbOt4L9w9kohTt20q8cMw2ZcQRcmX,iv:79N5/LELqXZuIU1T4wza3YAA9xS1uYTghZ4h8g1Cvzc=,tag:Fnj8xbXfyl54ycRL0F5c1w==,type:str] /ab2d/${env}/web/nonsensitive/tls_chain: | @@ -310,20 +310,20 @@ 7/qxXDgGpRtK4dw4LTzcqx+QGtVKnO7RcGzM7vRX+Bi6hG6H -----END CERTIFICATE----- /ab2d/${env}/api/sensitive/tls_private_key: ENC[AES256_GCM,data:uuAiVW36y8uA5ENFcXumfbQD1fsgbnfABhVb8JHFJrh8iI80b7LNbMpxx4y3g10PNQGyWOyccD3KGo6Ztcv2WlchNjzu+4YOoe3qg3cmGsrmJh5sds9YL+gXYM1Nb2M5et8kYjhoMFywxrj3pQcqno8cnHU6/YkrqbBu2t0qJjoGABWe/1Cgb+SeqhNoV4JRAl050RUqgQD6YT3pshKJuP5KMULfipIQkLUsIQihpa/miCVDpbb4NS+fHz3PBL81m9N5dGhlbMIyboPHEwt+v/TNi0DZesrWqESX7hH4ifx4xVFFpEC8YV95Mhr/6HU+bt29kAy9GkcJmUK6hRUAi4oZjPvFWQhSb1joHcw2HdqIAUiYCc0MmIr+cbGLe+MmxR9KXrK8wjymmgfzWlaUulkPj6fCc+8Y+DW7vr0+dFPmFj134PiRiP3i4IAP0DBDOP0g1owdISiwz/K219K5XWxM9nCMF50HYe9hOuL2Ch8b4zh3mlQr14AIzKEjNWFjHRXyEWqBONEXDKrakbtX9PrhL2hiPRXG2N85QZjK73uU1ZXH8YKpThDCyfU+7myX70YTNKhBjZuPwPp0SyJhVhCtcma9fveuHUi5hgr86B4Smtx0bI4duUyDeYl5Byr3HDQJa/PJ9FPfFiwE+vGd4AibqvaxfImvLQbDdxURcxgWpDgPf4Yr7lCAO/30+w/hliQKih7FnyEY3ZsV9PrkYbVzhgByMAiiqsfNWFj1KNrDr6aVGhgXn1hd9fbkHz9vLo0E0sN42brumIH/FTEiUF8e/PfizKNyW1eFcWeC0bi0VTR4BcSbpYy4d21pzhcbqfEsGMoK8qeMhZ3gZMbS4lbr77pLtPSBwU9KBzTcxZ1PhhUovvSA6fbFvkvbTfQixuXpaSfYANFR00LHOh21AmWkFv8gMI9ooJfqz8MBoMA5vEqP1paywnGQpB/7DY20DjijtNLdFBpLWTDXk4kyca4EGAO1DjEKJbBKA0E1RbZ6dHMODbVeLJm84qaCuDMFLKSj8GFyQ6Nlp2LIs8/J6H73qBkWTfpsaiBlTaIdoyr5w+CXnLnFOeJG2y/sGo8CClNpnJFMwD7ihkJG7GmPAWoMkY/rS2uB03CipgP4cCDnk+WbaZttYWtXEktXDs229g8DrouA/d+lDTyxKy6AtiWDqIqSbbRsvouKnBvKwjs7kgvttyfQPqBImR4Hl+FpnP01Us6KFMpCIo7AwxfsCulUbW3hv6pu+YT4TANj062brNevdhCNaUMdpsBv+NSqOFwFQFavFRHSWzup8bzZc5tZq8DxlCkZzxiQi0lOk5qfz7E/c18CffDKHbwf7ZU9sI7BiIJsjch84I16p01BPpVl0KAxOMC3ldDj3TUCj1eF5wTQ/KbOVdcAe8jTT8OWQvBjgPHe+csEVqLPHNBehmZ/awzJ7R3RgDQHD5LkFuSaw2t8iL9L2HEJ/qdSIsmLvTGBgU6bjbCqsQ3V9Qcx4hMxIW9Q+e3C4xTw3jFKiRFwRqm+NbdAqzkFjihOsfzBiZrvUPJar99odzZXi9OHIHNQCuX77gTy6ARsVDuSYHe4DhH71uHxISLsTrG0Dpq9kac9O1o5lQKzANe7pNHr0or1+BiM/qCYilD11bKOApPrsBrr9e9IaRjl48vYviY6EKDEi/jYHWeS3YpB8AyulSao9hGI7hcsiVOtt5E4bJKNhTgLGByLLX1L0gdfdzGM5NAF+ZMGkBQE13bcXXC1G4jN3Dpt6CNJFhQryu21Gi3g2n/+n1MzCclMzq5m46G1LhVatZOULben5OO2YcsjGiNrv0UoDsPccIOVqkSIV5p8gouh49mlezm6/QssHF8bt5c1zzaOL1ucvXoq9FoJbKwjHmbX0m5foWvHDlupqqKt9aeXMGCJCzVTiFsE5c8RTeJhp8ZksnVcgy5Z1U0zpe7FhwtmgMhk2LK+TQRSPrzfc9/ApSbTs3oJbfT9UTxFJnwpoqx3OtdcrAJEw9729Igsq5OYAyyjkFAYhb6Y+CPvyMx1dt0CHVBErVyslx9+sTMSB9Yx9foKvTlWmJpSOR/GcEmTu7Teo721Gh8TnY74myQ2yNoU7fZCWvBTZRYF2R9sWwhaAFREoWvmCkjxWdP1eqLaVRofZ9mLUivUrxOhbA1vJPhkB5Q7V9L7cLr+Jwj1zPThloqWtW6RTbYx1hybBUZ/YCwcM+X7CnvHK9zzSBc5fEhjg3Qhot0rbEXG4ONNjCnf2W72ZcX21FshbaK1GX2eABt3,iv:sS6Nf2BpWxNVLIrU2pU08xfzmTwC1r9oX6FYB4brKDc=,tag:hRHEvuOS4kugC3h2H6f+Jw==,type:str] -/ab2d/${env}/core/sensitive/idr_private_key: ENC[AES256_GCM,data:L0BIYSGX+pU225brUAfa0nLPZZzpiWiQWiAuXCnyFhJ/0ai/YvHJu4NXrDX27WR83KckaUoIVUzXVGlatIsAqdv7YWnNzOpRbeWW699FGZHROAXJcFz/wB8ToKATh64nGFKvhO9eaLvQ0BMbotU430pRVHXUGOSsn3xIaF2pYa9QFNs7bvqggSYwHcWAPgLdkVQcTraHhOkd++ZNfrnX8F7P1ldOAq/3L9TSLp0xNCZKT4BRcI/gVSDwlD0qeVJXCsue7yFgfdnWCto7ObHGU5gXX9/tEKjE826wuu6SLBA+CSuFOnKhH+w2SnSIdmSX/2+w/LvIAC8ASr0jUY4DoN+IvE4ZWOzTvTs72lOEMuDg8mTgezwXzfplpY6mA/hE9z7n70hh27/pR2cQV3oYCi8fMCUfkqSYKj9I61TjrN4i4j91886geMIK2qC9W7NZHBRGW48wMIg+mCKXcYZN7dbDO7zrprUuZAMbEWzi02FWZWM9q9+NdJTlce/w9YqRx1NDPZRWHUhMsybTm36W73eK3R11894Yas2muArP5XTmlFkqC8DRh5PCDSGTRhkBUhimwepvKkC0MnglNc8RdhF4DLyNXEQefht2fmO9as70lo9YfNYH94vz8+BUcd0gI0U9Um7uRzbuYAms9fbUcE9CzmXSih3I7MabwpU2SrpveXEDON6KSkviHSMHKaUU04fp1oeehuUrKw76xwVtK5R5CPLjTdFw3zAJ4iEJBLRLTMwcqFNbu+wxf0YiFJV5uLb+POTfOQRuMuVw9N/TMeWYViAt3Hc+sIY8l+hBBOjH2CALgCGSMvST0MHnbXa4yah8PqEIC0CxTg1B5zhILLxcz7cCQqxMzo16Mm8JWlr04+DnwSjB9yeoZpgTdHaAhJn9PV1TRrauqXGHVcXWj8rMh+g8h1YaiB5DARSQQUfBtJjUKvYFpQ3mBbF6AuaTiVTl43uSJTj5258Y52mfBvz3eL0W7yg93y+ItgHMdVIYoRNcmEj8qP4PksCAP1hzIKX1j+HGzZRpmHzRG8BGLKgprFKTwiJH3kI3AjDZ+vCYdsaYZYO5z4N4MS7yufmJgjC9Nv2VTji1qsw4h3ZRHGDZ1QCbkFwr1eXaB3E0y5FC6AbVIC+PjalURFyZgCkuWC65iWIyaoi/blpIgtZPBfEsBp1118XjGoGkrjiOf7ClzKia+uJWO0+IYxWkmNm2zWHqXcvCwg/FstqwSUkw8tIbiugus99ZuL1BzsVB+OYUVmMxRZ9o68ddQ3gQ2YHR1cRoPYZiBhh8tPIPmE8f/dR8kmXcu0l6dxHAyHPNenVlFt/1lesLYDdNbgXk0ZPh1iqfBllVlf7iRdU/vpC4inIO5qTi25nM59DevPFLCWv75I/DAmH41m6vy+d7rMhC0BGxn6Y1w70SYnoV6EwG8RqeCehr27mrBVg84ULBBMlGfCEuoS4dZdtf9rp+dCuG/AB7JoG2TY0ar22jy+1cfGQJfDaD6m1N8w8GRDfFwaAOxN+V7ZB7mG6aKagzgjcm82YJgyqgQ8guQBXLPeLsVTqkOTFBm4msVqrw5y+IRUwTENInvmRNtQ/Sna767C8V+OXXI929zeaizE/FaURKXrDboWJw3I+M7bX4eajW7T0aCRyKIQtvis0lQtw6/p6JuCmKPCzopftYLakLy66OYHWr/yehKoYO7qCAyy95JKQDD0AmRUjOLgCB83Dd0UzkJBflBGhvcVjId7F6o8zkhjP9W7XeL3QXcoUW2zZhu5dY4PwxyFkdxCHeRJjKNdHYf/g8s/h2t4kCklPNRB0kWpu8T1Q/VVfvWff8NRLoJxZoqpegXalwWZdDw/N2bZBp4Pk1lHtLaQRLgw1dAnIZSpCTzIz8Povgg1QSUW/hz9iQf06pZ+/xXbobIG2iUIqbx/vojGODWzWBnBta8lij1+xGdByEtsg1eSo48qrUSV3uR1p9+mMZD4x4D+UGMDh61X2i5u0lPwDYsZg72ZJLlTq1QIYPz8Kn4GoBlPvd8WX2GKQx5wfm3P11Q7hx8LwgQpI6ZZ66T7PinuJn1TXkap+S74Ll++9vzOVmwNSw1y8RXjJHiOgAg+yqanbzv+P21Q/U3FD6XlFinaNg7cENlmqv/hnjGxr1GDFEVMyHd34oZEmMSCZ8uGH/yZ8Wk3G13SlfCoQSDvtWzJ6JszP/f0sqZsmYGXrvSHphWipnYLNoNReZLySHMdUY9ZGalB1ljRDW7weGgYE7Su+QYHsrqFHta1TZ3yHz,iv:qJOJYXImiphnIPjTFdRGMpVR57q4yxp/LropP2I+k7I=,tag:AcnJ2EQ0V7yHuGHxzN95VQ==,type:str] +/ab2d/${env}/idr-db-importer/sensitive/snowflake_private_key: ENC[AES256_GCM,data:QsevuanujWAd8nq/2wtvyPqPnImT8VY/f72U/IeLCslq8x6RQR9g7khwK7vhnOqY5ZV+MOtV/J5ey9oEdrixalP1gp9Y3YuyMw77p/FVYRp7TOOTizUsnw1aexvVO4nbFLz2MaEWf5JIjJsNZhHKPGYsUrhQZS3WdRgqE61M6MJvMokTkyNWBX86whqWG4PBdqU4Kqg1WyUQsTo19HMc6BIgOSzlk8UEUFH1wQjXFB66UNmuuFJPO652C+7MShxVFqE/FdCgLpJjawIz9yKURlOpKKOO9MTzdPngqY5W2j93nFwbdF3YIo99qw4+ezM0CknW/cw/KddavOX7UrhDOULMlBWu6y2fYpuRr9UHctlF6iZ+17WhataNdRSjLgPvyCt+K8it0dtP7uzaRXGs74ItX5RyWxnsYCZD5/do0ICvLlSmXSRPaEAE/uLKyySPu4tmklT9zerrYbPNZ7hqEsHfdkJko/qBU+42s5LnXezTSkqhydqxwWL0PIjKgRcrurv1ibKYhL3xcZwxO03xrwh24LoadhqSDL3lOnhdQzl1v2CtzGtCcLyP4/+na0RqH8hlISSXgjwJuc5x7UQfO2XNXkRwjaA3sapr+vIFk7myXGNq0/NRILvVBQpsXom7uLaYGhDQrvHmYQNR2R+9UN9ke3O0pIxxHac/2pnJJC+ehRelDQCp9rbIIVOU2Ff/RvtfsqzivQTOyfqWKpWL2N7qkflHA5HBdjlXpvh4KWxMHadmrHJfoxcxKyLsjmS8DJYqwekoFkm4g9R3tUbcRuEaQRSw68moz6TXcf0/+26UAQrd4tpG/S9acSEVVus4q+Oi4la+yu1bLMFrhRqYlPhSSOsmdvsMuiJr8x8LIQTBWc+PEonO+iZWV1jBGuYZEqm+lts4CAJRMsGa4a+lwgO+zjUw8oF5+1eons7BeV0nmDvakNFZcMVnZmjDBVaMthxCVMiMdHlQ/y1uQoQWVHzaDXFSVEOX+Z3HLsNLVmYCwxEbQT0rJsG6/qFVW7bcuTDnb9reQDaWrNJSCmN5cvYhjXxWcj59RVdu03hNV7HtL+bliIrbYchbZ7m68Xg66tJ7KEGXcOvDBEjsLwyyHrUxeOjLfBtY8sqeFDhWdb9Av7K+zhtJih5wanh5ZhMmBtIzKLYM+nlL2rQtT4uQQZo6SR3J4mfbGJ4r2RJn/ptujylcuDbOQT1n2GkKEoMn0vQrsBMoQWtkFf3liHChba4tm+V3qZ0MmTUhs1GbMV3zwLIb48kEc8rALh0D3d/QP0/9eCCCd1ApLzauI7u79ykKqpoJTonh/gCCj1mGRE5agQ3ygRnrmVu+RlkChl57nCVHozYfk+7itG7/jJK46J48fU5jB7svvjxurw8zit2H+SV6jD4qSWmtpMQxoX6EORFSI6AMRR2mu3rfGnVDhQj3IgM1BIgtoyC8ZKxr1NR0lvqFIPtU8KB6tS0x1kSeHZzM1TwvkK/NVEfmDO0RkPs6alEMgQaYzre2ob1Iujhc0BBcE0IRj6t6BtcyF3NdfDJ035RLpDFvv1FVl2kNwf6slvrpH25ZXBqp8Z6jM2OTBmQR2pJ0CvKqysqDDHbG/1+T8EP92bWX39gb9tNXKrsbzjp2+iGiQUBWv78oayRx9VTb0+aIGwvMJz/PaoYj4QKVIUQ5lqHUKiVcFK0KxPS2tC/+WtwUWbvLZAglgI+S5pg+MtFQeq3Uyg7ZoCWYp9Z30sbsc1elo+REQd7adAeFJPmfxP1NWUHYyyP/nspGdRpVGKv9r4NYGiRmZfx8/hb5B1i3hN39N0VmqGkP0Ij1TdXLYxwWOnzTaxX5+M6JTagfW62myMr0AtFoF4XmiKrH0GUUmkFDuANfx+lCcsQYMJcdatIP/v+Q0HL/7OOAOXNGj+2jcmJ3f8K9ZWyJYqFyLra4IUGNmHxWPbTlF8u0UuAMnV+6rK5hQ99Aq1jMmcLKAnl34bBgCbU+HWBAJGQ2SKZykFoVQfP4klUlXSPVfqqeIVAFkv+h4md0Eri3KQ7YLFBEcTNQdr5h6kgQAM7C/FyUp22yQMlPnhbCqtCL5gdYQr3py6eQwzeEo/L55+m1I+mkjlu6GXRyzHRNzK5UGcB/WsP4cuX8A95u3myNt/xamfZ7B8fh/QNoY47xlrmRdOTtcLuhescaz/7M2eGPZD2/XXZ8Gkq4M4Zymucu0+IR3iDNaipDTITMNwzHTzjjaT6FSKR/W/bGQ2ykPpLP/PU0ATwVXdos5WQmMrAlbETZXP/B,iv:e1nLd1OhAvHfxm6kCFjfDbyxWkuK4vc4QQ77AQjHMHY=,tag:wXJF05qM8bEP10IuAsZN7w==,type:str] /ab2d/${env}/insights/sensitive/administrators_yaml: ENC[AES256_GCM,data:zLBYs8x/Az1Sr89LnvCzb5+hSQDyBh19gtufdq2hpcPsFsg5TUAePlo5ZsuXM4G0J9+rPg16EfVPqWOl/cJUKENkDPfjga9sOeCUiZ1MeKOfRstiSRkK35L9syE6cVjjx4B2/ypicaMPXqODGhr02lVYNAv7wmbyl1zp3CgmfwQsPyWrg19iQga2AR/qwZisQWOrvwUmjv6cE2SvZ6QhB9EFY320f5tL4ltu7oojnKJxC1qnB4g4gYzGaG4hiBm6YtN4oiRLS0O4IxWPtlAAzQ3EGmxtuIFJrTW2M/ttHVZ5pWS0j+9Bs96AydrtcZ8i2BKqH84kmhfacqYGaKdDqkgSWogwiiv8hwgPDdFXJfDIsXP5cnOsyTBYiAsVgGfmmjL0EBoyQ1vQFuUx,iv:FmVN0KOvUUCsyN6ocafULC9SHl17E4vqoLcTocoHDHA=,tag:v+duTZkI6CpEnsMvnzuynA==,type:str] /ab2d/${env}/bene-prefs/sensitive/bfd-sns-topic-arn: ENC[AES256_GCM,data:4Lo05HDtSlYvXuz1dxiH5MPc1rAQgPGiCddjGxqUNOL4NiS6rJhXYCWuuJtnsDC1BSTWKWjnOGSNJyvwdIG46JSb4jHi3RM=,iv:ZmlsOUmrveKz1lqwBGTw1q4BlhjSp/9wJ+FrUWEWwRI=,tag:h0Z8R6VUSWLqUUEzn4kM8Q==,type:str] /ab2d/${env}/bene-prefs/sensitive/bfd-bucket-role-arn: ENC[AES256_GCM,data:QZCjtEr5wNqOFsjDrq1xLe45XQ4iK7vmOIbRCUex2pGGpoddtmuOquiLfQ+hm8HzuQnNwU1RwQC2LKRNYUC/uzZKVt7lerj4OAPRJfQc8LCgQ8ZDRj5gtCyIX9bOrPPwO4lM,iv:vOvQrcVJh/5urrgxRpn/wjm5gU5Xlst9ACCGreO70G4=,tag:mmUVKUzk2Ef4SC2j/hC8pg==,type:str] sops: kms: - arn: arn:aws:kms:us-east-1:${ACCOUNT_ID}:alias/ab2d-prod - aws_profile: "" created_at: "2025-06-10T18:29:53Z" enc: AQICAHiiBcH1zXWffn77hoG6y6pEPZ+4jjugLfsVfebBM+L/LgFRiUHz9BFerz/OTGQMltW4AAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMMpJ8aa5bO5Tfke2oAgEQgDsL7xbz+8lCZG0cnuZBAfpih+vMoB082VnofgnC5AdYpv6ggcGLXckWRPXCWbCwKTATHh4h3jUl2lT1EQ== - - arn: arn:aws:kms:us-west-2:${ACCOUNT_ID}:alias/ab2d-prod aws_profile: "" + - arn: arn:aws:kms:us-west-2:${ACCOUNT_ID}:alias/ab2d-prod created_at: "2025-06-10T18:29:53Z" enc: AQICAHhQOCwYYioO/Y8DTCCF3UDslbqq7E89gMxakADNsQ0frwG3hCM3g09qFSEm7fV/DDESAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMCWATLsuplVdQvnQeAgEQgDvqARVB2qXPQg+uqgE8wP15bMkoFSm3WzgefyzBM/VvOWHUDQA8wiyY+MDL3BoMFEtk2GCFoPsYvVfMPw== - mac_only_encrypted: true + aws_profile: "" unencrypted_regex: /nonsensitive/ + mac_only_encrypted: true version: 3.13.1 diff --git a/ops/services/10-core/iam.tf b/ops/services/10-core/iam.tf index c4a167062..677eee9f1 100644 --- a/ops/services/10-core/iam.tf +++ b/ops/services/10-core/iam.tf @@ -244,68 +244,6 @@ resource "aws_iam_role_policy_attachment" "idr_kms" { policy_arn = aws_iam_policy.kms_key_access.arn } -resource "aws_iam_role" "idr_db_importer_task" { - permissions_boundary = data.aws_iam_policy.developer_boundary_policy.arn - name = "${local.service_prefix}-idr-db-importer-task" - path = "/delegatedadmin/developer/" - - assume_role_policy = jsonencode({ - Version = "2012-10-17" - Statement = [ - { - Action = "sts:AssumeRole" - Effect = "Allow" - Sid = "" - Principal = { - Service = [ - "ecs-tasks.amazonaws.com" - ] - } - } - ] - }) -} - -resource "aws_iam_policy" "idr_db_importer_task" { - name = "${module.platform.app}-${module.platform.env}-idr-db-importer-task" - description = "IDR DB Importer ECS task access to S3 bucket and KMS key." - - policy = jsonencode({ - Version = "2012-10-17" - Statement = [ - { - Sid = "S3Access" - Effect = "Allow" - Action = [ - "s3:AbortMultipartUpload", - "s3:GetObject", - "s3:PutObject", - "s3:DeleteObject", - "s3:ListBucket" - ] - Resource = [ - module.idr_db_importer_bucket.arn, - "${module.idr_db_importer_bucket.arn}/*" - ] - }, - { - Sid = "KmsAccessForS3" - Effect = "Allow" - Action = [ - "kms:Decrypt", - "kms:GenerateDataKey" - ] - Resource = module.platform.kms_alias_primary.target_key_arn - } - ] - }) -} - -resource "aws_iam_role_policy_attachment" "idr_db_importer_task" { - role = aws_iam_role.idr_db_importer_task.name - policy_arn = aws_iam_policy.idr_db_importer_task.arn -} - resource "aws_iam_role" "idr_db_importer" { name = "${module.platform.app}-${module.platform.env}-idr-db-importer" path = "/delegatedadmin/developer/" @@ -347,8 +285,8 @@ resource "aws_iam_policy" "idr_db_importer" { "s3:ListBucket" ] Resource = [ - "${module.idr_db_importer_bucket.arn}", - "${module.idr_db_importer_bucket.arn}/*" + "arn:aws:s3:::${module.platform.app}-${module.platform.env}-idr-db-importer-*", + "arn:aws:s3:::${module.platform.app}-${module.platform.env}-idr-db-importer-*/*" ] }, { @@ -375,36 +313,6 @@ resource "aws_rds_cluster_role_association" "idr_db_importer" { role_arn = aws_iam_role.idr_db_importer.arn } -data "aws_iam_policy_document" "idr_db_importer_additional_bucket_policy" { - statement { - sid = "DenyReadAccess" - effect = "Deny" - - actions = [ - "s3:GetObject" - ] - - condition { - test = "StringNotEquals" - variable = "aws:PrincipalArn" - values = [ - aws_iam_role.idr_db_importer.arn, - aws_iam_role.idr_db_importer_task.arn - ] - } - - principals { - type = "AWS" - identifiers = ["*"] - } - - resources = [ - module.idr_db_importer_bucket.arn, - "${module.idr_db_importer_bucket.arn}/*", - ] - } -} - # Create KMS policy resource "aws_iam_policy" "kms" { name = "${local.service_prefix}-kms" diff --git a/ops/services/10-core/main.tf b/ops/services/10-core/main.tf index 39308135e..61ba1cab3 100644 --- a/ops/services/10-core/main.tf +++ b/ops/services/10-core/main.tf @@ -369,16 +369,6 @@ resource "aws_vpc_security_group_ingress_rule" "idr_endpoint_https" { ip_protocol = "tcp" } -module "idr_db_importer_bucket" { - source = "github.com/CMSgov/cdap//terraform/modules/bucket?ref=7c070cd2e8c6b1407961c35976553446df8fafd3" - - additional_bucket_policies = [data.aws_iam_policy_document.idr_db_importer_additional_bucket_policy.json] - app = module.platform.app - env = local.parent_env - name = "${module.platform.app}-${module.platform.env}-idr-db-importer" - ssm_parameter = "/ab2d/${module.platform.env}/core/nonsensitive/idr-db-importer-bucket" -} - # Shared cluster to be initially used by the idr-db-importer task with the remaining services potentially being migrated later. module "cluster" { source = "github.com/CMSgov/cdap//terraform/modules/cluster?ref=7c070cd2e8c6b1407961c35976553446df8fafd3" diff --git a/ops/services/30-idr-db-importer/data.tf b/ops/services/30-idr-db-importer/data.tf index 1271f0cd0..0fa8b8db9 100644 --- a/ops/services/30-idr-db-importer/data.tf +++ b/ops/services/30-idr-db-importer/data.tf @@ -6,14 +6,14 @@ data "aws_ecs_cluster" "shared" { cluster_name = "${local.app}-${local.env}" } -data "aws_iam_role" "idr_db_importer_task" { - name = "${local.service_prefix}-${local.service}-task" -} - data "aws_iam_role" "idr_db_importer_task_execution" { name = "${local.service_prefix}-${local.service}-task-execution" } +data "aws_iam_role" "idr_db_importer_s3_import" { + name = "${local.app}-${local.env}-idr-db-importer" +} + data "aws_security_group" "idr_db_importer" { name = "${local.service_prefix}-idr-db-importer" vpc_id = module.platform.vpc_id @@ -37,26 +37,3 @@ data "aws_ssm_parameter" "ab2d_db_user" { name = "/ab2d/${local.env}/core/sensitive/database_user" } -data "aws_ssm_parameter" "idr_db_importer_bucket" { - name = "/ab2d/${local.env}/core/nonsensitive/idr-db-importer-bucket" -} - -data "aws_ssm_parameter" "idr_snowflake_user" { - count = module.platform.parent_env == "prod" ? 1 : 0 - name = "/ab2d/${module.platform.parent_env}/core/sensitive/idr_service_id_name" -} - -data "aws_ssm_parameter" "idr_snowflake_role" { - count = module.platform.parent_env == "prod" ? 1 : 0 - name = "/ab2d/${module.platform.parent_env}/core/sensitive/idr_role_name" -} - -data "aws_ssm_parameter" "idr_snowflake_warehouse" { - count = module.platform.parent_env == "prod" ? 1 : 0 - name = "/ab2d/${module.platform.parent_env}/core/sensitive/idr_warehouse_name" -} - -data "aws_ssm_parameter" "idr_private_key" { - count = module.platform.parent_env == "prod" ? 1 : 0 - name = "/ab2d/${module.platform.parent_env}/core/sensitive/idr_private_key" -} \ No newline at end of file diff --git a/ops/services/30-idr-db-importer/main.tf b/ops/services/30-idr-db-importer/main.tf index d203e9d03..18e835725 100644 --- a/ops/services/30-idr-db-importer/main.tf +++ b/ops/services/30-idr-db-importer/main.tf @@ -8,121 +8,147 @@ terraform { } locals { - default_tags = module.platform.default_tags - env = terraform.workspace - image_repo_uri = data.aws_ecr_repository.idr_db_importer.repository_url - service = "idr-db-importer" + aws_account_number = nonsensitive(module.platform.aws_caller_identity.account_id) + default_tags = module.platform.default_tags + env = terraform.workspace + image_repo_uri = data.aws_ecr_repository.idr_db_importer.repository_url + service = "idr-db-importer" + + ssm_root_map = { + this = "/ab2d/${local.env}/idr-db-importer/" + } } module "platform" { source = "github.com/CMSgov/cdap//terraform/modules/platform?ref=8a6527c0689bb46ae0e74bd47e4087ab59cff1b0" providers = { aws = aws, aws.secondary = aws.secondary } - app = local.app - env = local.env - root_module = "https://github.com/CMSgov/ab2d/tree/main/ops/services/30-idr-db-importer" - service = local.service + app = local.app + env = local.env + root_module = "https://github.com/CMSgov/ab2d/tree/main/ops/services/30-idr-db-importer" + service = local.service + ssm_root_map = local.ssm_root_map } -resource "aws_ecs_task_definition" "idr_db_importer" { - cpu = 1024 - execution_role_arn = data.aws_iam_role.idr_db_importer_task_execution.arn - family = "${local.service_prefix}-${local.service}" - memory = 2048 - network_mode = "awsvpc" - requires_compatibilities = ["FARGATE"] - task_role_arn = data.aws_iam_role.idr_db_importer_task.arn - runtime_platform { - cpu_architecture = "ARM64" - operating_system_family = "LINUX" - } - container_definitions = nonsensitive(jsonencode([ - { - image = "${local.image_repo_uri}:${var.image_tag}" - name = local.service - readonlyRootFilesystem = true - - secrets = concat([ - { - name = "AB2D_DB_PASSWORD" - valueFrom = data.aws_ssm_parameter.ab2d_db_password.arn - } - ], - module.platform.parent_env == "prod" ? [ - { - name = "IDR_SNOWFLAKE_PRIVATE_KEY" - valueFrom = data.aws_ssm_parameter.idr_private_key[0].arn - }, - { - name = "IDR_SNOWFLAKE_WAREHOUSE" - valueFrom = data.aws_ssm_parameter.idr_snowflake_warehouse[0].arn - } - ] : [] - ) +module "service" { + source = "github.com/CMSgov/cdap//terraform/modules/service?ref=52af0763fab4e65b29ead8bf88774f0bad4bdd87" + + cluster_arn = data.aws_ecs_cluster.shared.arn + cpu = 1024 + memory = 2048 + desired_count = 0 + enable_datadog_agent = false + execution_role_arn = data.aws_iam_role.idr_db_importer_task_execution.arn + image = "${local.image_repo_uri}:${var.image_tag}" + platform = module.platform + security_groups = [data.aws_security_group.idr_db_importer.id] + subnets = keys(module.platform.private_subnets) + + additional_task_role_policies = { s3 = aws_iam_policy.idr_db_importer_task.arn } + + container_environment = concat( + [ + { name = "AB2D_DB_DATABASE", value = data.aws_ssm_parameter.ab2d_db_database.value }, + { name = "AB2D_DB_HOST", value = data.aws_ssm_parameter.ab2d_db_host.value }, + { name = "AB2D_DB_PORT", value = "5432" }, + { name = "S3_BUCKET", value = module.idr_db_importer_bucket.id }, + { name = "ENVIRONMENT", value = local.env } + ], + module.platform.parent_env == "prod" ? [ + { name = "IDR_SNOWFLAKE_URL", value = "jdbc:snowflake://cms-idr.privatelink.snowflakecomputing.com" }, + { name = "IDR_SNOWFLAKE_DB", value = "IDRC_PRD" }, + { name = "IDR_SNOWFLAKE_SCHEMA", value = "CMS_VDM_VIEW_MDCR_PRD" } + ] : [] + ) + + container_secrets = concat( + [ + { name = "AB2D_DB_PASSWORD", valueFrom = data.aws_ssm_parameter.ab2d_db_password.arn }, + { name = "AB2D_DB_USER", valueFrom = data.aws_ssm_parameter.ab2d_db_user.arn } + ], + module.platform.parent_env == "prod" ? [ + { name = "IDR_SNOWFLAKE_PRIVATE_KEY", valueFrom = module.platform.ssm.this.snowflake_private_key.arn }, + { name = "IDR_SNOWFLAKE_WAREHOUSE", valueFrom = module.platform.ssm.this.snowflake_warehouse.arn }, + { name = "IDR_SNOWFLAKE_USER", valueFrom = module.platform.ssm.this.snowflake_user.arn }, + { name = "IDR_SNOWFLAKE_ROLE", valueFrom = module.platform.ssm.this.snowflake_role.arn } + ] : [] + ) +} - environment = concat( - [ - { - name = "AB2D_DB_DATABASE" - value = data.aws_ssm_parameter.ab2d_db_database.value - }, - { - name = "AB2D_DB_HOST" - value = data.aws_ssm_parameter.ab2d_db_host.value - }, - { - name = "AB2D_DB_PORT" - value = "5432" - }, - { - name = "AB2D_DB_USER" - value = data.aws_ssm_parameter.ab2d_db_user.value - }, - { - name = "S3_BUCKET" - value = data.aws_ssm_parameter.idr_db_importer_bucket.value - }, - { - name = "ENVIRONMENT" - value = local.env - } - ], - module.platform.parent_env == "prod" ? [ - { - name = "IDR_SNOWFLAKE_URL" - value = "jdbc:snowflake://cms-idr.privatelink.snowflakecomputing.com" - }, - { - name = "IDR_SNOWFLAKE_USER" - value = data.aws_ssm_parameter.idr_snowflake_user[0].value - }, - { - name = "IDR_SNOWFLAKE_ROLE" - value = data.aws_ssm_parameter.idr_snowflake_role[0].value - }, - { - name = "IDR_SNOWFLAKE_DB" - value = "IDRC_PRD" - }, - { - name = "IDR_SNOWFLAKE_SCHEMA" - value = "CMS_VDM_VIEW_MDCR_PRD" - } - ] : [] - ) +resource "aws_iam_policy" "idr_db_importer_task" { + name = "${local.app}-${local.env}-idr-db-importer-task" + description = "IDR DB Importer ECS task access to S3 bucket and KMS key." - logConfiguration = { - logDriver = "awslogs" - options = { - awslogs-group = "/aws/ecs/fargate/${local.app}-${local.env}/${local.service}" - awslogs-create-group = "true" - awslogs-region = var.region - awslogs-stream-prefix = "${local.app}-${local.env}" - } + policy = jsonencode({ + Version = "2012-10-17" + Statement = [ + { + Sid = "S3Access" + Effect = "Allow" + Action = [ + "s3:AbortMultipartUpload", + "s3:GetObject", + "s3:PutObject", + "s3:DeleteObject", + "s3:ListBucket" + ] + Resource = [ + module.idr_db_importer_bucket.arn, + "${module.idr_db_importer_bucket.arn}/*" + ] + }, + { + Sid = "KmsAccessForS3" + Effect = "Allow" + Action = [ + "kms:Decrypt", + "kms:GenerateDataKey" + ] + Resource = module.platform.kms_alias_primary.target_key_arn } + ] + }) +} + +module "idr_db_importer_bucket" { + source = "github.com/CMSgov/cdap//terraform/modules/bucket?ref=7c070cd2e8c6b1407961c35976553446df8fafd3" + + additional_bucket_policies = [data.aws_iam_policy_document.idr_db_importer_additional_bucket_policy.json] + app = module.platform.app + env = local.parent_env + name = "${module.platform.app}-${module.platform.env}-idr-db-importer" + ssm_parameter = "/ab2d/${module.platform.env}/core/nonsensitive/idr-db-importer-bucket" +} + +data "aws_iam_policy_document" "idr_db_importer_additional_bucket_policy" { + statement { + sid = "DenyReadAccess" + effect = "Deny" + + actions = [ + "s3:GetObject" + ] + + condition { + test = "StringNotEquals" + variable = "aws:PrincipalArn" + values = [ + data.aws_iam_role.idr_db_importer_s3_import.arn, + "arn:aws:iam::${local.aws_account_number}:role/${local.service_prefix}-idr-db-importer-task-role" + ] } - ])) + + principals { + type = "AWS" + identifiers = ["*"] + } + + resources = [ + module.idr_db_importer_bucket.arn, + "${module.idr_db_importer_bucket.arn}/*", + ] + } } resource "aws_scheduler_schedule" "idr_db_importer" { @@ -142,7 +168,7 @@ resource "aws_scheduler_schedule" "idr_db_importer" { launch_type = "FARGATE" task_definition_arn = trimsuffix( - aws_ecs_task_definition.idr_db_importer.arn, ":${aws_ecs_task_definition.idr_db_importer.revision}" + module.service.task_definition.arn, ":${module.service.task_definition.revision}" ) network_configuration { @@ -183,8 +209,8 @@ resource "aws_iam_policy" "idr_db_importer_eventbridge_scheduler" { "ecs:RunTask" ], Resource = [ - trimsuffix(aws_ecs_task_definition.idr_db_importer.arn, ":${aws_ecs_task_definition.idr_db_importer.revision}"), - "${trimsuffix(aws_ecs_task_definition.idr_db_importer.arn, ":${aws_ecs_task_definition.idr_db_importer.revision}")}:*" + trimsuffix(module.service.task_definition.arn, ":${module.service.task_definition.revision}"), + "${trimsuffix(module.service.task_definition.arn, ":${module.service.task_definition.revision}")}:*" ], Condition = { "ArnLike" = { @@ -198,7 +224,7 @@ resource "aws_iam_policy" "idr_db_importer_eventbridge_scheduler" { "iam:PassRole" ] Resource = [ - data.aws_iam_role.idr_db_importer_task.arn, + module.service.task_role_arn, data.aws_iam_role.idr_db_importer_task_execution.arn ] },