Merge pull request #3 from ONS-Innovation/logic_and_tests

KEH-541 | Initial Logic and Tests

Author: TotalDwarf03

.checkov.yml

@@ -0,0 +1,19 @@
+skip-check:
+  # IAM Resourcing using wildcards
+  - CKV_AWS_356
+  - CKV_AWS_111
+
+  # Lambda Encryption and Dead Letter Queue
+  - CKV_AWS_173
+  - CKV_AWS_116
+
+  # Cloudwatch Logs KMS Encryption and Retention
+  - CKV_AWS_158
+  - CKV_AWS_338
+
+  # These ignores are TEMPORARY. They will be resolved in the future.
+  - CKV_AWS_108
+  - CKV_TF_1
+  - CKV_TF_2
+  - CKV_AWS_115
+  - CKV_AWS_272

.coveragerc

@@ -0,0 +1,2 @@
+[run]
+omit = tests/*

.gitignore

@@ -124,9 +124,7 @@ celerybeat.pid
 # Environments
 .env
 .venv
-env/
 venv/
-ENV/
 env.bak/
 venv.bak/
 
@@ -167,4 +165,48 @@ cython_debug/
 megalinter-reports/
 
 # DS_Store files
-.DS_Store
+.DS_Store
+
+
+# Terraform
+
+# Local .terraform directories
+**/.terraform/*
+
+# .tfstate files
+*.tfstate
+*.tfstate.*
+
+# Crash log files
+crash.log
+crash.*.log
+
+# Exclude all .tfvars files, which are likely to contain sensitive data, such as
+# password, private keys, and other secrets. These should not be part of version 
+# control as they are data points which are potentially sensitive and subject 
+# to change depending on the environment.
+*.tfvars
+*.tfvars.json
+
+# Ignore override files as they are usually used to override resources locally and so
+# are not checked in
+override.tf
+override.tf.json
+*_override.tf
+*_override.tf.json
+
+# Include override files you do wish to add to version control using negated pattern
+# !example_override.tf
+
+# Include tfplan files to ignore the plan output of command: terraform plan -out=tfplan
+# example: *tfplan*
+
+# Ignore CLI configuration files
+.terraformrc
+terraform.rc
+
+# Ignore the terraform/service priority calc
+terraform/service/highest_priority.txt
+
+# Ignore terraform.lock.hcl file
+.terraform.lock.hcl

.mega-linter.yml

@@ -28,6 +28,13 @@ DISABLE_LINTERS:
   - REPOSITORY_TRUFFLEHOG
   - REPOSITORY_GIT_DIFF
 
+  # Disabled due to false positives
+  - MARKDOWN_MARKDOWN_LINK_CHECK
+
+  # Disabled due to unneeded linting. Checkov, Kics and Trivy are sufficient.
+  - TERRAFORM_TFLINT
+  - TERRAFORM_TERRASCAN
+
 SHOW_ELAPSED_TIME: true
 
 FILEIO_REPORTER: false

.trivyignore

@@ -0,0 +1,5 @@
+# Ignore Dockerfile user due to Lambda
+AVD-DS-0002
+
+# Ignore KMS Encryption
+AVD-AWS-0017

Dockerfile

@@ -0,0 +1,37 @@
+# Note: 
+# Within docker, this container runs as root as no user is specified.
+# Due to the nature of the lambda function, this is acceptable as Lambda defines the default user
+# to have the least-privilege permissions rather than the root user.
+
+# Therefore we can ignore the linting error for this Dockerfile
+# as it is not a security risk for this specific use case.
+
+# Ignored in .trivyignore also.
+#kics-scan disable=fd54f200-402c-4333-a5a4-36ef6709af2f
+#checkov:skip=CKV_DOCKER_3:Lambda makes default user lowest privilege
+
+FROM public.ecr.aws/lambda/python:3.12
+
+# Install git using dnf (https://docs.aws.amazon.com/lambda/latest/dg/python-image.html#python-image-base)
+# For python 3.12, dnf replaces yum for package management
+RUN dnf install -y git-2.40.1 && dnf clean all
+
+# Copy the poetry.lock and pyproject.toml files
+COPY pyproject.toml poetry.lock ${LAMBDA_TASK_ROOT}/
+
+# Install the dependencies
+WORKDIR ${LAMBDA_TASK_ROOT}
+RUN pip install --no-cache-dir poetry==1.5.0 &&\
+    poetry config virtualenvs.create false &&\ 
+    poetry install --only main
+
+# Copy config folder
+COPY config ${LAMBDA_TASK_ROOT}/config
+
+# Copy function code
+COPY src/main.py src/logger.py ${LAMBDA_TASK_ROOT}/src/
+
+HEALTHCHECK NONE
+
+# Set the CMD to your handler (could also be done as a parameter override outside of the Dockerfile)
+CMD [ "src.main.handler" ]

Makefile

@@ -28,7 +28,7 @@ lint:  ## Run all linters (black/ruff/pylint/mypy).
 
 .PHONY: test
 test:  ## Run the tests and check coverage.
-	poetry run pytest -n auto --cov=src --cov-report term-missing --cov-fail-under=80
+	poetry run pytest -n auto --cov=src --cov-report term-missing --cov-fail-under=95
 
 .PHONY: mypy
 mypy:  ## Run mypy.