Skip to content

Commit 900ae7d

Browse files
ajmu1ajmu1
authored
DS-2633 Separating CW queries from blue-green-link stack (#1149)
# Task Branch Pull Request **<https://nhsd-jira.digital.nhs.uk/browse/DS-2633>** ## Description of Changes Creating separate actions and identifier for CW queries in pipelines and CB jobs ## Type of change Delete not appropriate - Refactoring (Creating separate actions and identifier for CW queries in pipelines and CB jobs) ## Development Checklist - [x] I have performed a self-review of my own code - [x] Tests have added that prove my fix is effective or that my feature works (Integration tests) - [x] I have updated Dependabot to include my changes (if applicable) ## Code Reviewer Checklist - [x] I can confirm the changes have been tested or approved by a tester
1 parent 9c49632 commit 900ae7d

19 files changed

Lines changed: 538 additions & 62 deletions

‎Makefile‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,11 @@ build-and-push: # Build lambda docker images and pushes them to ECR
3434
deploy: # Deploys whole project - mandatory: PROFILE
3535
eval "$$(make -s populate-tagging-variables)"
3636
make terraform-apply-auto-approve STACKS=api-key,shared-resources,application,blue-green-link
37+
make terraform-apply-auto-approve STACKS=cloudwatch-queries TF_CLI_ARGS="-parallelism=3"
3738

3839
undeploy: # Undeploys whole project - mandatory: PROFILE
3940
eval "$$(make -s populate-tagging-variables)"
41+
make terraform-destroy-auto-approve STACKS=cloudwatch-queries
4042
make terraform-destroy-auto-approve STACKS=blue-green-link,application,shared-resources VERSION=any
4143
if [ "$(PROFILE)" != "live" ]; then
4244
make terraform-destroy-auto-approve STACKS=api-key
@@ -464,6 +466,10 @@ link-blue-green-environment: # Links blue green environment - mandatory: PROFILE
464466
eval "$$(make -s populate-tagging-variables)"
465467
make terraform-apply-auto-approve STACKS=blue-green-link
466468

469+
deploy-cloudwatch-queries: # Deploys CloudWatch query definitions with reduced parallelism - mandatory: PROFILE, ENVIRONMENT, SHARED_ENVIRONMENT, BLUE_GREEN_ENVIRONMENT
470+
eval "$$(make -s populate-tagging-variables)"
471+
make terraform-apply-auto-approve STACKS=cloudwatch-queries TF_CLI_ARGS="-parallelism=3"
472+
467473
undeploy-shared-resources: # Undeploys shared resources (Only intended to run in pipeline) - mandatory: PROFILE, ENVIRONMENT, SHARED_ENVIRONMENT, BLUE_GREEN_ENVIRONMENT
468474
eval "$$(make -s populate-tagging-variables)"
469475
make terraform-destroy-auto-approve STACKS=shared-resources
@@ -475,6 +481,10 @@ undeploy-blue-green-environment: # Undeploys blue/green resources (Only intended
475481
eval "$$(make -s populate-tagging-variables)"
476482
make terraform-destroy-auto-approve STACKS=application
477483

484+
undeploy-cloudwatch-queries: # Undeploys CloudWatch query definitions - mandatory: PROFILE, ENVIRONMENT, SHARED_ENVIRONMENT, BLUE_GREEN_ENVIRONMENT
485+
eval "$$(make -s populate-tagging-variables)"
486+
make terraform-destroy-auto-approve STACKS=cloudwatch-queries
487+
478488
unlink-blue-green-environment: # Un-Links blue green environment - mandatory: PROFILE, ENVIRONMENT, SHARED_ENVIRONMENT, BLUE_GREEN_ENVIRONMENT
479489
eval "$$(make -s populate-tagging-variables)"
480490
make terraform-destroy-auto-approve STACKS=blue-green-link

‎infrastructure/stacks/cloudwatch-queries/.terraform.lock.hcl‎

Lines changed: 25 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

infrastructure/stacks/blue-green-link/cloudwatch-queries.tf renamed to infrastructure/stacks/cloudwatch-queries/cloudwatch-queries.tf

Lines changed: 0 additions & 53 deletions
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,6 @@ fields @timestamp, correlation_id, ods_code, function_name, message
1616
| filter level == 'ERROR'
1717
| sort @timestamp
1818
EOF
19-
20-
provisioner "local-exec" {
21-
command = "sleep 30"
22-
}
2319
}
2420

2521
resource "aws_cloudwatch_query_definition" "search_by_correlation_id" {
@@ -40,10 +36,6 @@ fields @timestamp, message
4036
| filter correlation_id == 'REPLACE'
4137
| sort @timestamp
4238
EOF
43-
44-
provisioner "local-exec" {
45-
command = "sleep 30"
46-
}
4739
}
4840

4941
resource "aws_cloudwatch_query_definition" "search_by_correlation_id_expanded" {
@@ -64,10 +56,6 @@ fields @timestamp,correlation_id,ods_code,level,message_received,function_name,
6456
| filter correlation_id == 'REPLACE'
6557
| sort @timestamp
6658
EOF
67-
68-
provisioner "local-exec" {
69-
command = "sleep 30"
70-
}
7159
}
7260

7361
resource "aws_cloudwatch_query_definition" "search_by_odscode" {
@@ -88,10 +76,6 @@ fields @timestamp, message
8876
| filter ods_code == 'REPLACE'
8977
| sort @timestamp
9078
EOF
91-
92-
provisioner "local-exec" {
93-
command = "sleep 30"
94-
}
9579
}
9680

9781
resource "aws_cloudwatch_query_definition" "search_by_odscode_expanded" {
@@ -112,10 +96,6 @@ fields @timestamp,correlation_id,ods_code,level,message_received,function_name,
11296
| filter ods_code == 'REPLACE'
11397
| sort @timestamp
11498
EOF
115-
116-
provisioner "local-exec" {
117-
command = "sleep 30"
118-
}
11999
}
120100

121101
resource "aws_cloudwatch_query_definition" "search_for_invalid_postcode" {
@@ -130,10 +110,6 @@ fields @timestamp,correlation_id,ods_code,level,message_received,function_name,
130110
| filter report_key == 'INVALID_POSTCODE'
131111
| sort @timestamp
132112
EOF
133-
134-
provisioner "local-exec" {
135-
command = "sleep 30"
136-
}
137113
}
138114

139115
resource "aws_cloudwatch_query_definition" "search_for_invalid_opening_times" {
@@ -148,10 +124,6 @@ fields @timestamp,correlation_id,ods_code,level,message_received,function_name,
148124
| filter report_key == 'INVALID_OPEN_TIMES'
149125
| sort @timestamp
150126
EOF
151-
152-
provisioner "local-exec" {
153-
command = "sleep 30"
154-
}
155127
}
156128

157129
resource "aws_cloudwatch_query_definition" "search_by_email_correlation_id" {
@@ -167,10 +139,6 @@ fields correlation_id
167139
| filter message =="Email Correlation Id"
168140
| filter email_correlation_id == "ADD_EMAIL_CORRELATION_ID"
169141
EOF
170-
171-
provisioner "local-exec" {
172-
command = "sleep 30"
173-
}
174142
}
175143

176144
resource "aws_cloudwatch_query_definition" "search_by_update_request_success" {
@@ -185,10 +153,6 @@ fields @timestamp, correlation_id
185153
| filter ServiceUpdateSuccess == 1
186154
| sort @timestamp desc
187155
EOF
188-
189-
provisioner "local-exec" {
190-
command = "sleep 30"
191-
}
192156
}
193157

194158
resource "aws_cloudwatch_query_definition" "search_by_update_request_failed" {
@@ -203,10 +167,6 @@ fields @timestamp, correlation_id, report_key
203167
| filter report_key == DOS_DB_UPDATE_DLQ_HANDLER_RECEIVED_EVENT
204168
| sort @timestamp desc
205169
EOF
206-
207-
provisioner "local-exec" {
208-
command = "sleep 30"
209-
}
210170
}
211171

212172
resource "aws_cloudwatch_query_definition" "search_by_dos_data_item_updates" {
@@ -223,10 +183,6 @@ fields @timestamp, correlation_id
223183
| filter field == 'REPLACE'
224184
| sort @timestamp desc
225185
EOF
226-
227-
provisioner "local-exec" {
228-
command = "sleep 30"
229-
}
230186
}
231187

232188
resource "aws_cloudwatch_query_definition" "search_for_report_warnings" {
@@ -248,13 +204,8 @@ fields @timestamp, correlation_id, message
248204
| filter level == 'WARNING'
249205
| sort @timestamp desc
250206
EOF
251-
252-
provisioner "local-exec" {
253-
command = "sleep 30"
254-
}
255207
}
256208

257-
258209
resource "aws_cloudwatch_query_definition" "search_for_quality_checker_logs_with_odscode" {
259210
name = "${var.project_id}/${var.blue_green_environment}/search-for-quality-checker-logs-with-odscode"
260211

@@ -267,8 +218,4 @@ fields @timestamp, level, message
267218
| filter odscode = 'TO_ADD'
268219
| sort @timestamp asc
269220
EOF
270-
271-
provisioner "local-exec" {
272-
command = "sleep 30"
273-
}
274221
}

‎infrastructure/stacks/cloudwatch-queries/terraform.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
terraform {
2+
backend "s3" {
3+
encrypt = true
4+
}
5+
required_providers {
6+
aws = {
7+
source = "hashicorp/aws"
8+
version = "~> 6.14.1"
9+
}
10+
}
11+
}

‎infrastructure/stacks/cloudwatch-queries/variables.tf‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
# ##############
2+
# # LAMBDAS
3+
# ##############
4+
5+
variable "change_event_dlq_handler_lambda" {
6+
type = string
7+
description = "Name of fifo dlq handler lambda"
8+
}
9+
10+
variable "dos_db_update_dlq_handler_lambda" {
11+
type = string
12+
description = "Name of cr_fifo dlq handler lambda"
13+
}
14+
15+
variable "event_replay_lambda" {
16+
type = string
17+
description = "Name of event replay lambda"
18+
}
19+
20+
variable "ingest_change_event_lambda" {
21+
type = string
22+
description = "Name of ingest change event lambda"
23+
}
24+
25+
variable "send_email_lambda" {
26+
type = string
27+
description = "Name of send email lambda"
28+
}
29+
30+
variable "service_matcher_lambda" {
31+
type = string
32+
description = "Name of event processor lambda"
33+
}
34+
35+
variable "service_sync_lambda" {
36+
type = string
37+
description = "Name of event sender lambda"
38+
}
39+
40+
variable "quality_checker_lambda" {
41+
type = string
42+
description = "Name of quality checker lambda"
43+
}

‎infrastructure/stacks/development-and-deployment-tools/batch-buildspecs/build-deploy-test-release-batch-jobs/deploy-cloudwatch-queries.yml‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# For documentation see here - https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html
2+
version: 0.2
3+
4+
phases:
5+
pre_build:
6+
commands:
7+
- chown -R 999:999 $CODEBUILD_SRC_DIR
8+
- temp_role=$(aws sts assume-role --role-arn "arn:aws:iam::$AWS_ACCOUNT_ID_NONPROD:role/$PIPELINE_BUILD_ROLE" --role-session-name "CodeBuildSessionNonProd")
9+
- export AWS_ACCESS_KEY_ID=$(echo $temp_role | jq -r .Credentials.AccessKeyId)
10+
- export AWS_SECRET_ACCESS_KEY=$(echo $temp_role | jq -r .Credentials.SecretAccessKey)
11+
- export AWS_SESSION_TOKEN=$(echo $temp_role | jq -r .Credentials.SessionToken)
12+
- make docker-hub-signin
13+
- unset AWS_ACCESS_KEY_ID
14+
- unset AWS_SECRET_ACCESS_KEY
15+
- unset AWS_SESSION_TOKEN
16+
- |
17+
if [[ "$AWS_ACCOUNT" == "PROD" ]]; then
18+
temp_role=$(aws sts assume-role --role-arn "arn:aws:iam::$AWS_ACCOUNT_ID_PROD:role/$PIPELINE_BUILD_ROLE" --role-session-name "CodeBuildSession")
19+
else
20+
temp_role=$(aws sts assume-role --role-arn "arn:aws:iam::$AWS_ACCOUNT_ID_NONPROD:role/$PIPELINE_BUILD_ROLE" --role-session-name "CodeBuildSession")
21+
fi
22+
- export AWS_ACCESS_KEY_ID=$(echo $temp_role | jq -r .Credentials.AccessKeyId)
23+
- export AWS_SECRET_ACCESS_KEY=$(echo $temp_role | jq -r .Credentials.SecretAccessKey)
24+
- export AWS_SESSION_TOKEN=$(echo $temp_role | jq -r .Credentials.SessionToken)
25+
- aws sts get-caller-identity
26+
- make -s clean
27+
build:
28+
on-failure: CONTINUE
29+
commands:
30+
- echo "[Deploying CloudWatch Queries]"
31+
- echo AWS_ACCOUNT=$AWS_ACCOUNT
32+
- echo ENVIRONMENT=$ENVIRONMENT
33+
- echo PROFILE=$PROFILE
34+
- eval "$$(make -s populate-tagging-variables)"
35+
- make deploy-cloudwatch-queries VERSION=$CODEBUILD_RESOLVED_SOURCE_VERSION PROFILE=$PROFILE ENVIRONMENT=$ENVIRONMENT

‎infrastructure/stacks/development-and-deployment-tools/batch-buildspecs/build-deploy-test-release-batch-jobs/deploy-set-environment.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,4 @@ phases:
3030
- echo AWS_ACCOUNT=$AWS_ACCOUNT
3131
- echo ENVIRONMENT=$ENVIRONMENT
3232
- echo PROFILE=$PROFILE
33-
- make deploy VERSION=$CODEBUILD_RESOLVED_SOURCE_VERSION PROFILE=$PROFILE ENVIRONMENT=$ENVIRONMENT TF_CLI_ARGS="-parallelism=30"
33+
- make terraform-apply-auto-approve STACKS=api-key,shared-resources,application,blue-green-link VERSION=$CODEBUILD_RESOLVED_SOURCE_VERSION PROFILE=$PROFILE ENVIRONMENT=$ENVIRONMENT TF_CLI_ARGS="-parallelism=30"

‎infrastructure/stacks/development-and-deployment-tools/batch-buildspecs/build-deploy-test-release-buildspec.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -125,6 +125,19 @@ batch:
125125
- build_slack_messenger
126126
- build_quality_checker
127127

128+
- identifier: deploy_cloudwatch_queries
129+
env:
130+
compute-type: BUILD_GENERAL1_SMALL
131+
image: aws/codebuild/amazonlinux2-x86_64-standard:5.0
132+
type: LINUX_CONTAINER
133+
privileged-mode: true
134+
variables:
135+
PROFILE: dev
136+
ENVIRONMENT: release
137+
buildspec: infrastructure/stacks/development-and-deployment-tools/batch-buildspecs/build-deploy-test-release-batch-jobs/deploy-cloudwatch-queries.yml
138+
depend-on:
139+
- deploy
140+
128141
- identifier: integration_test
129142
env:
130143
compute-type: BUILD_GENERAL1_LARGE

‎infrastructure/stacks/development-and-deployment-tools/batch-buildspecs/task-env-deploy-and-test-batch-jobs/deploy-cloudwatch-queries.yml‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
# For documentation see here - https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html
2+
version: 0.2
3+
4+
phases:
5+
pre_build:
6+
commands:
7+
- temp_role=$(aws sts assume-role --role-arn "arn:aws:iam::$AWS_ACCOUNT_ID_NONPROD:role/$PIPELINE_BUILD_ROLE" --role-session-name "CodeBuildSession")
8+
- export AWS_ACCESS_KEY_ID=$(echo $temp_role | jq -r .Credentials.AccessKeyId)
9+
- export AWS_SECRET_ACCESS_KEY=$(echo $temp_role | jq -r .Credentials.SecretAccessKey)
10+
- export AWS_SESSION_TOKEN=$(echo $temp_role | jq -r .Credentials.SessionToken)
11+
- make docker-hub-signin
12+
- unset AWS_ACCESS_KEY_ID
13+
- unset AWS_SECRET_ACCESS_KEY
14+
- unset AWS_SESSION_TOKEN
15+
16+
- temp_role=$(aws sts assume-role --role-arn "arn:aws:iam::$AWS_ACCOUNT_ID_NONPROD:role/$PIPELINE_BUILD_ROLE" --role-session-name "CodeBuildSession")
17+
- export AWS_ACCESS_KEY_ID=$(echo $temp_role | jq -r .Credentials.AccessKeyId)
18+
- export AWS_SECRET_ACCESS_KEY=$(echo $temp_role | jq -r .Credentials.SecretAccessKey)
19+
- export AWS_SESSION_TOKEN=$(echo $temp_role | jq -r .Credentials.SessionToken)
20+
- echo PROFILE = $PROFILE
21+
build:
22+
on-failure: CONTINUE
23+
commands:
24+
- export BUILD_BRANCH=$(echo $CODEBUILD_WEBHOOK_TRIGGER | sed -e "s|^refs/heads/||")
25+
- echo Branch = $BUILD_BRANCH
26+
- |
27+
if [ -z "$BUILD_BRANCH" ]; then
28+
echo "Not triggered by branch will stop deploying CloudWatch queries"
29+
exit
30+
fi
31+
- echo "[Deploying CloudWatch Queries]"
32+
- make deploy-cloudwatch-queries VERSION=$(make commit-date-hash-tag) BUILD_BRANCH=$BUILD_BRANCH PROFILE=$PROFILE

‎infrastructure/stacks/development-and-deployment-tools/batch-buildspecs/task-env-deploy-and-test-buildspec.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,18 @@ batch:
136136
- build_quality_checker
137137
- deploy_prerequisites
138138

139+
- identifier: deploy_cloudwatch_queries
140+
env:
141+
compute-type: BUILD_GENERAL1_SMALL
142+
image: aws/codebuild/amazonlinux2-x86_64-standard:5.0
143+
type: LINUX_CONTAINER
144+
privileged-mode: true
145+
variables:
146+
PROFILE: dev
147+
buildspec: infrastructure/stacks/development-and-deployment-tools/batch-buildspecs/task-env-deploy-and-test-batch-jobs/deploy-cloudwatch-queries.yml
148+
depend-on:
149+
- deploy
150+
139151
- identifier: integration_test_reporting
140152
env:
141153
compute-type: BUILD_GENERAL1_LARGE

0 commit comments

Comments
 (0)