dbt-platform-helper 10.10.0__tar.gz → 10.11.1__tar.gz

{dbt_platform_helper-10.10.0 → dbt_platform_helper-10.11.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dbt-platform-helper
-Version: 10.10.0
+Version: 10.11.1
 Summary: Set of tools to help transfer applications/services from GOV.UK PaaS to DBT PaaS augmenting AWS Copilot.
 License: MIT
 Author: Department for Business and Trade Platform Team

{dbt_platform_helper-10.10.0 → dbt_platform_helper-10.11.1}/dbt_platform_helper/commands/environment.py

@@ -250,7 +250,7 @@ def get_cert_arn(session, application, env_name):
     return arn
 
 
-def get_env_ips(vpc: str, application_environment: Environment):
+def get_env_ips(vpc: str, application_environment: Environment) -> List[str]:
     account_name = f"{application_environment.session.profile_name}-vpc"
     vpc_name = vpc if vpc else account_name
     ssm_client = application_environment.session.client("ssm")
@@ -275,8 +275,6 @@ def generate(name, vpc_name):
         )
         raise click.Abort
 
-    session = get_aws_session_or_abort()
-
     try:
         conf = load_and_validate_platform_config()
     except SchemaError as ex:
@@ -284,6 +282,9 @@ def generate(name, vpc_name):
         raise click.Abort
 
     env_config = apply_environment_defaults(conf)["environments"][name]
+    profile_for_environment = env_config.get("accounts", {}).get("deploy", {}).get("name")
+    click.secho(f"Using {profile_for_environment} for this AWS session")
+    session = get_aws_session_or_abort(profile_for_environment)
 
     _generate_copilot_environment_manifests(name, conf["application"], env_config, session)
 
@@ -482,11 +483,8 @@ def delete_listener_rule(tag_descriptions: list, tag_name: str, lb_client: boto3
         tags = {t["Key"]: t["Value"] for t in description["Tags"]}
         if tags.get("name") == tag_name:
             current_rule_arn = description["ResourceArn"]
-
-    if not current_rule_arn:
-        return current_rule_arn
-
-    lb_client.delete_rule(RuleArn=current_rule_arn)
+            if current_rule_arn:
+                lb_client.delete_rule(RuleArn=current_rule_arn)
 
     return current_rule_arn
 
@@ -500,7 +498,7 @@ def remove_maintenance_page(session: boto3.Session, listener_arn: str):
         "TagDescriptions"
     ]
 
-    for name in ["MaintenancePage", "AllowedIps", "BypassIpFilter"]:
+    for name in ["MaintenancePage", "AllowedIps", "BypassIpFilter", "AllowedSourceIps"]:
         deleted = delete_listener_rule(tag_descriptions, name, lb_client)
 
         if name == "MaintenancePage" and not deleted:
@@ -520,15 +518,7 @@ def get_rules_tag_descriptions(rules: list, lb_client):
     return tag_descriptions
 
 
-def create_header_rule(
-    lb_client: boto3.client,
-    listener_arn: str,
-    target_group_arn: str,
-    header_name: str,
-    values: list,
-    rule_name: str,
-    priority: int,
-):
+def get_host_conditions(lb_client: boto3.client, listener_arn: str, target_group_arn: str):
     rules = lb_client.describe_rules(ListenerArn=listener_arn)["Rules"]
 
     # Get current set of forwarding conditions for the target group
@@ -549,6 +539,20 @@ def create_header_rule(
         v for v in conditions[0]["HostHeaderConfig"]["Values"]
     ]
 
+    return conditions
+
+
+def create_header_rule(
+    lb_client: boto3.client,
+    listener_arn: str,
+    target_group_arn: str,
+    header_name: str,
+    values: list,
+    rule_name: str,
+    priority: int,
+):
+    conditions = get_host_conditions(lb_client, listener_arn, target_group_arn)
+
     # add new condition to existing conditions
     combined_conditions = [
         {
@@ -573,6 +577,40 @@ def create_header_rule(
     )
 
 
+def create_source_ip_rule(
+    lb_client: boto3.client,
+    listener_arn: str,
+    target_group_arn: str,
+    values: list,
+    rule_name: str,
+    priority: int,
+):
+    conditions = get_host_conditions(lb_client, listener_arn, target_group_arn)
+
+    # add new condition to existing conditions
+    combined_conditions = [
+        {
+            "Field": "source-ip",
+            "SourceIpConfig": {"Values": [value + "/32" for value in values]},
+        }
+    ] + conditions
+
+    lb_client.create_rule(
+        ListenerArn=listener_arn,
+        Priority=priority,
+        Conditions=combined_conditions,
+        Actions=[{"Type": "forward", "TargetGroupArn": target_group_arn}],
+        Tags=[
+            {"Key": "name", "Value": rule_name},
+        ],
+    )
+
+    click.secho(
+        f"Creating listener rule {rule_name} for HTTPS Listener with arn {listener_arn}.\n\nIf request source ip matches one of the values {values}, the request will be forwarded to target group with arn {target_group_arn}.",
+        fg="green",
+    )
+
+
 def add_maintenance_page(
     session: boto3.Session,
     listener_arn: str,
@@ -608,6 +646,14 @@ def add_maintenance_page(
                 "AllowedIps",
                 forwarded_rule_priority,
             )
+            create_source_ip_rule(
+                lb_client,
+                listener_arn,
+                target_group_arn,
+                [ip],
+                "AllowedSourceIps",
+                forwarded_rule_priority + 1,
+            )
 
         bypass_rule_priority = service_number
         create_header_rule(

{dbt_platform_helper-10.10.0 → dbt_platform_helper-10.11.1}/dbt_platform_helper/templates/addons/env/redis-cluster.yml

@@ -35,20 +35,6 @@ Mappings:
       CacheParameterGroupFamily: 'redis7.x'
     '6.2':
       CacheParameterGroupFamily: 'redis6.x'
-    '6.0':
-      CacheParameterGroupFamily: 'redis6.x'
-    '5.0.6':
-      CacheParameterGroupFamily: 'redis5.0'
-    '5.0.4':
-      CacheParameterGroupFamily: 'redis5.0'
-    '5.0.3':
-      CacheParameterGroupFamily: 'redis5.0'
-    '5.0.0':
-      CacheParameterGroupFamily: 'redis5.0'
-    '4.0.10':
-      CacheParameterGroupFamily: 'redis4.0'
-    '3.2.6':
-      CacheParameterGroupFamily: 'redis3.2'
 
 Conditions:
   {{ addon_config.prefix }}HasAutomaticFailoverEnabled: !Not [!Equals [!FindInMap [{{ addon_config.prefix }}EnvironmentConfigMap, !Ref Env, NumReplicas], 0]]

{dbt_platform_helper-10.10.0 → dbt_platform_helper-10.11.1}/dbt_platform_helper/templates/pipelines/codebase/overrides/stack.ts

@@ -84,7 +84,7 @@ export class TransformedStack extends cdk.Stack {
             envVars.push({name: 'ADDITIONAL_ECR_REPOSITORY', value: this.additionalEcrRepository()});
         }
 
-        new cdk.aws_codebuild.CfnProject(this, 'ImageBuildProject', {
+        const imageBuildProject: cdk.aws_codebuild.CfnProject = new cdk.aws_codebuild.CfnProject(this, 'ImageBuildProject', {
             name: `codebuild-${this.appName}-${this.pipelineManifest.name}`,
             description: `Publish images on push to ${this.codebaseConfiguration.repository}`,
             badgeEnabled: true,
@@ -122,6 +122,9 @@ export class TransformedStack extends cdk.Stack {
                 )),
             },
         });
+
+        imageBuildProject.node.addDependency(this.template.getResource("BuildProjectRole") as cdk.aws_iam.CfnRole);
+        imageBuildProject.node.addDependency(this.template.getResource("BuildProjectPolicy") as cdk.aws_iam.CfnPolicy);
     }
 
     private createECRRepository() {
@@ -403,7 +406,10 @@ export class TransformedStack extends cdk.Stack {
         const buildProjectPolicy = this.template.getResource("BuildProjectPolicy") as cdk.aws_iam.CfnPolicy;
         (buildProjectPolicy.policyDocument.Statement as Array<any>).push({
             Effect: 'Allow',
-            Action: ['codestar-connections:UseConnection'],
+            Action: [
+                'codestar-connections:GetConnectionToken',
+                'codestar-connections:UseConnection',
+            ],
             Resource: [this.codestarConnection.arn],
         });
     }

{dbt_platform_helper-10.10.0 → dbt_platform_helper-10.11.1}/dbt_platform_helper/utils/validation.py

@@ -180,7 +180,7 @@ REDIS_PLANS = Or(
     "x-large-ha",
 )
 
-REDIS_ENGINE_VERSIONS = Or("4.0.10", "5.0.6", "6.0", "6.2", "7.0", "7.1")
+REDIS_ENGINE_VERSIONS = Or("6.2", "7.0", "7.1")
 
 REDIS_DEFINITION = {
     "type": "redis",

{dbt_platform_helper-10.10.0 → dbt_platform_helper-10.11.1}/pyproject.toml

@@ -3,7 +3,7 @@ line-length = 100
 
 [tool.poetry]
 name = "dbt-platform-helper"
-version = "10.10.0"
+version = "10.11.1"
 description = "Set of tools to help transfer applications/services from GOV.UK PaaS to DBT PaaS augmenting AWS Copilot."
 authors = ["Department for Business and Trade Platform Team <sre-team@digital.trade.gov.uk>"]
 license = "MIT"