[NDR-353] Allow GitHub IAM role and permissions to be controlled by IaC (PROD env) (#624)

Co-authored-by: jameslinnell <jimlinnell@gmail.com>

Author: tim-knight-nhs

.github/workflows/deploy-prod.yml

@@ -16,54 +16,48 @@ permissions:
   contents: read # This is required for actions/checkout
 
 jobs:
-  terraform_plan_apply:
-    name: Terraform Plan/Apply (prod)
+  terraform_plan_apply_base_iam:
+    name: Terraform Plan/Apply base-iam (prod)
     runs-on: ubuntu-latest
     environment: prod
     steps:
-      - name: Checkout Tag
+      - name: Checkout
         uses: actions/checkout@v6
         with:
           ref: refs/tags/${{ github.event.inputs.git_tag}}
           fetch-depth: "0"
 
-      - name: Configure AWS Credentials
-        uses: aws-actions/configure-aws-credentials@v6
+      - name: Apply base_iam
+        uses: ./.github/actions/tf-plan-apply
         with:
-          role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
-          role-skip-session-tagging: true
-          aws-region: ${{ vars.AWS_REGION }}
-          mask-aws-account-id: true
+          aws_assume_role: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/prod-github-bootstrap
+          bucket_prefix: "prod"
+          aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
+          aws_region: ${{ vars.AWS_REGION }}
+          working_directory: "./base_iam"  # Use separate base_iam directory
+          workspace: ${{ secrets.AWS_WORKSPACE }}
+          tf_vars_file: ${{ vars.TF_VARS_FILE }}
+          tf_extra_args: "-var aws_account_id=${{ secrets.AWS_ACCOUNT_ID }}"
 
-      - name: Setup Terraform
-        uses: hashicorp/setup-terraform@v4
+  terraform_plan_apply:
+    name: Terraform Plan/Apply (prod)
+    needs: ["terraform_plan_apply_base_iam"]
+    runs-on: ubuntu-latest
+    environment: prod
+    steps:
+      - name: Checkout Tag
+        uses: actions/checkout@v6
         with:
-          terraform_version: 1.14.6
-          terraform_wrapper: false
-
-      - name: Initialise Terraform
-        id: init
-        run: terraform init -backend-config=backend-prod.conf
-        working-directory: ./infrastructure
-        shell: bash
-
-      - name: Select Terraform Workspace
-        id: workspace
-        run: terraform workspace select ${{ secrets.AWS_WORKSPACE }}
-        working-directory: ./infrastructure
-        shell: bash
-
-      - name: Check Terraform Formatting
-        run: terraform fmt -check
-        working-directory: ./infrastructure
-
-      - name: Run Terraform Plan
-        id: plan
-        run: |
-          terraform plan -input=false -no-color -var-file="${{vars.TF_VARS_FILE}}" -out tf.plan
-        working-directory: ./infrastructure
-        shell: bash
+          ref: refs/tags/${{ github.event.inputs.git_tag}}
+          fetch-depth: "0"
 
-      - name: Run Terraform Apply
-        run: terraform apply -auto-approve -input=false tf.plan
-        working-directory: ./infrastructure
+      - name: Apply Main
+        uses: ./.github/actions/tf-plan-apply
+        with:
+          # use newly updated role
+          aws_assume_role: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/prod-github-actions-role
+          bucket_prefix: "prod"
+          aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
+          aws_region: ${{ vars.AWS_REGION }}
+          workspace: ${{ secrets.AWS_WORKSPACE }}
+          tf_vars_file: ${{ vars.TF_VARS_FILE }}