feat: set up happy to be deployed to theia

.github/workflows/push-rdev.yml

@@ -15,7 +15,7 @@ env:
 # https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-amazon-web-services
 permissions:
   id-token: write
-  contents: read
+  contents: write
 
 jobs:
   build-push-images:
@@ -45,10 +45,9 @@ jobs:
       - name: Configure AWS Credentials
         uses: aws-actions/configure-aws-credentials@v2
         with:
-          role-session-name: BuildAndPushRdevImage
           aws-region: us-west-2
-          role-to-assume: ${{ secrets.AWS_ROLE_TO_ASSUME }}
-          role-duration-seconds: 900
+          aws-access-key-id: ${{ secrets.THEIAGEN_AWS_ACCESS_KEY_ID }}
+          aws-secret-access-key: ${{ secrets.THEIAGEN_AWS_SECRET_ACCESS_KEY }}
       - name: Build And Push
         uses: chanzuckerberg/github-actions/.github/actions/[email protected]
         with:

.happy/config.json

@@ -65,15 +65,15 @@
     },
     "environments": {
         "rdev": {
-            "aws_profile": "genepi-dev",
+            "aws_profile": "theia",
             "secret_arn": "happy/env-dev-config",
             "terraform_directory": ".happy/terraform/envs/dev",
             "log_group_prefix": "/genepi/dev",
             "task_launch_type": "fargate",
             "auto_run_migrations": true
         },
         "staging": {
-            "aws_profile": "genepi-dev",
+            "aws_profile": "theia",
             "secret_arn": "happy/env-gestaging-config",
             "terraform_directory": ".happy/terraform/envs/staging",
             "delete_protected": true,
@@ -82,7 +82,7 @@
             "task_launch_type": "fargate"
         },
         "prod": {
-            "aws_profile": "genepi-prod",
+            "aws_profile": "theia",
             "secret_arn": "happy/env-geprod-config",
             "terraform_directory": ".happy/terraform/envs/prod",
             "delete_protected": true,
@@ -99,4 +99,4 @@
             "delete_db_task_definition_arn"
         ]
     }
-}
+}

.happy/terraform/envs/dev/locals.tf.json

@@ -0,0 +1,5 @@
+{
+  "locals": {
+    "image_tag": "sha-7b63b07"
+  }
+}

.happy/terraform/envs/dev/main.tf

@@ -1,16 +1,16 @@
-module stack {
+module "stack" {
   source              = "./modules/ecs-stack"
   aws_account_id      = var.aws_account_id
   aws_role            = var.aws_role
   happymeta_          = var.happymeta_
   happy_config_secret = var.happy_config_secret
-  image_tag           = var.image_tag
-  image_tags          = jsondecode(var.image_tags)
+  image_tag           = local.image_tag
+  image_tags          = {}
   priority            = var.priority
   stack_name          = var.stack_name
   deployment_stage    = "dev"
   delete_protected    = false
-  require_okta        = true
+  require_okta        = false
   stack_prefix        = "/${var.stack_name}"
   sql_import_file     = "db_snapshots/dev_backup.sql"
 

.happy/terraform/envs/dev/providers.tf

@@ -1,8 +1,5 @@
-provider aws {
-  version = "~> 3.63.0"
-  region  = "us-west-2"
-  assume_role {
-    role_arn = "arn:aws:iam::${var.aws_account_id}:role/${var.aws_role}"
-  }
+provider "aws" {
+  region              = "us-west-2"
   allowed_account_ids = [var.aws_account_id]
-}
+  profile             = "theia"
+}

.happy/terraform/envs/dev/variables.tf

@@ -1,45 +1,40 @@
-variable aws_account_id {
+variable "aws_account_id" {
   type        = string
   description = "AWS account ID to apply changes to"
+  default     = "654654542669"
 }
 
-variable aws_role {
+variable "aws_role" {
   type        = string
   description = "Name of the AWS role to assume to apply changes"
+  default     = ""
 }
 
-variable image_tag {
-  type        = string
-  description = "Please provide an image tag"
-}
-
-variable image_tags {
-  type        = string
-  description = "Override the default image tags (json-encoded map)"
-  default     = "{}"
-}
-
-variable priority {
+variable "priority" {
   type        = number
   description = "Listener rule priority number within the given listener"
+  default     = 1234
 }
 
-variable happymeta_ {
+variable "happymeta_" {
   type        = string
   description = "Happy Path metadata. Ignored by actual terraform."
+  default     = "{}"
 }
 
-variable stack_name {
+variable "stack_name" {
   type        = string
   description = "Happy Path stack name"
+  default     = "gedevstack-jheath"
 }
 
-variable happy_config_secret {
+variable "happy_config_secret" {
   type        = string
   description = "Happy Path configuration secret name"
+  default     = "happy/env-dev-config"
 }
 
-variable wait_for_steady_state {
+variable "wait_for_steady_state" {
   type        = bool
   description = "Should terraform block until ECS reaches a steady state?"
   default     = true

.happy/terraform/envs/dev/versions.tf

@@ -0,0 +1,19 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 4.45"
+    }
+  }
+
+  backend "s3" {
+    bucket         = "genepi-theia-dev-s3-tf-state-dev-dev-genepi-theia-stacks-state"
+    dynamodb_table = "genepi-theia-dev-s3-tf-state-dev-dev-genepi-theia-stacks-state-lock"
+    key            = "czgenepi-dev.tfstate"
+    encrypt        = true
+    region         = "us-west-2"
+    profile        = "theia"
+  }
+}

.happy/terraform/envs/prod/locals.tf.json

@@ -0,0 +1,5 @@
+{
+  "locals": {
+    "image_tag": "sha-7b63b07"
+  }
+}

.happy/terraform/envs/prod/main.tf

@@ -1,19 +1,19 @@
-module stack {
+module "stack" {
   source              = "./modules/ecs-stack"
   aws_account_id      = var.aws_account_id
   aws_role            = var.aws_role
   happymeta_          = var.happymeta_
   happy_config_secret = var.happy_config_secret
-  image_tag           = var.image_tag
-  image_tags          = jsondecode(var.image_tags)
+  image_tag           = local.image_tag
+  image_tags          = {}
   priority            = var.priority
   stack_name          = var.stack_name
   deployment_stage    = "geprod"
   delete_protected    = false
   require_okta        = false
   sql_import_file     = "db_snapshots/dev_backup.sql"
-  frontend_url        = "https://czgenepi.org"
-  backend_url         = "https://api.czgenepi.org"
+  frontend_url        = "https://theiagenepi.org"
+  backend_url         = "https://api.theiagenepi.org"
   stack_prefix        = ""
 
   wait_for_steady_state = var.wait_for_steady_state

.happy/terraform/envs/prod/providers.tf

@@ -1,8 +1,5 @@
-provider aws {
-  version = "~> 3.63.0"
-  region  = "us-west-2"
-  assume_role {
-    role_arn = "arn:aws:iam::${var.aws_account_id}:role/${var.aws_role}"
-  }
+provider "aws" {
+  region              = "us-west-2"
   allowed_account_ids = [var.aws_account_id]
+  profile             = "theia-prod"
 }

.happy/terraform/envs/prod/variables.tf

@@ -1,45 +1,40 @@
-variable aws_account_id {
+variable "aws_account_id" {
   type        = string
   description = "AWS account ID to apply changes to"
+  default     = "010928203514"
 }
 
-variable aws_role {
+variable "aws_role" {
   type        = string
   description = "Name of the AWS role to assume to apply changes"
+  default     = ""
 }
 
-variable image_tag {
-  type        = string
-  description = "Please provide an image tag"
-}
-
-variable image_tags {
-  type        = string
-  description = "Override the default image tags (json-encoded map)"
-  default     = "{}"
-}
-
-variable priority {
+variable "priority" {
   type        = number
   description = "Listener rule priority number within the given listener"
+  default     = 1251
 }
 
-variable happymeta_ {
+variable "happymeta_" {
   type        = string
   description = "Happy Path metadata. Ignored by actual terraform."
+  default     = "{}"
 }
 
-variable stack_name {
+variable "stack_name" {
   type        = string
   description = "Happy Path stack name"
+  default     = "geprodstack"
 }
 
-variable happy_config_secret {
+variable "happy_config_secret" {
   type        = string
   description = "Happy Path configuration secret name"
+  default     = "happy/env-geprod-config"
 }
 
-variable wait_for_steady_state {
+variable "wait_for_steady_state" {
   type        = bool
   description = "Should terraform block until ECS reaches a steady state?"
   default     = true

.happy/terraform/envs/prod/versions.tf

@@ -0,0 +1,19 @@
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    aws = {
+      source  = "hashicorp/aws"
+      version = ">= 4.45"
+    }
+  }
+
+  backend "s3" {
+    bucket         = "genepi-prod-s3-tf-state-prod-prod-genepi-theia-stacks-new-state"
+    dynamodb_table = "genepi-prod-s3-tf-state-prod-prod-genepi-theia-stacks-new-state-lock"
+    key            = "czgenepi-prod.tfstate"
+    encrypt        = true
+    region         = "us-west-2"
+    profile        = "theia-prod"
+  }
+}

.happy/terraform/envs/staging/locals.tf.json

@@ -0,0 +1,5 @@
+{
+  "locals": {
+    "image_tag": "sha-2898e96"
+  }
+}