Automate IAM User Role Policies

.github/workflows/run-ci-cd.yaml

@@ -441,15 +441,15 @@ jobs:
     env:
       RELEASE_VERSION: ${{ needs.set-release-version.outputs.release_version }}
     environment: staging
-    if: |
-      github.repository == 'OWASP/Nest' &&
-      github.ref == 'refs/heads/main'
+    #if: |
+      #github.repository == 'OWASP/Nest' &&
+      #github.ref == 'refs/heads/main'
     needs:
-      - run-backend-tests
-      - run-frontend-a11y-tests
-      - run-frontend-e2e-tests
-      - run-frontend-unit-tests
-      - run-infrastructure-tests
+      #- run-backend-tests
+      #- run-frontend-a11y-tests
+      #- run-frontend-e2e-tests
+      #- run-frontend-unit-tests
+      #- run-infrastructure-tests
       - set-release-version
     permissions:
       contents: read
@@ -476,6 +476,11 @@ jobs:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-region: ${{ vars.AWS_REGION }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-duration-seconds: 3600
+          role-external-id: ${{ secrets.AWS_ROLE_EXTERNAL_ID }}
+          role-session-name: GitHubActions-BuildStagingImages
+          role-skip-session-tagging: true
+          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/nest-staging-terraform
 
       - name: Login to Amazon ECR
         uses: aws-actions/amazon-ecr-login@062b18b96a7aff071d4dc91bc00c4c1a7945b076
@@ -486,18 +491,18 @@ jobs:
           build-args: |
             OWASP_GID=1001
             OWASP_UID=1001
-          cache-from: |
-            type=gha
-            type=registry,ref=owasp/nest:backend-staging-cache
-          cache-to: |
-            type=registry,ref=owasp/nest:backend-staging-cache
+          #cache-from: |
+            #type=gha
+            #type=registry,ref=owasp/nest:backend-staging-cache
+          #cache-to: |
+            #type=registry,ref=owasp/nest:backend-staging-cache
           context: backend
           file: docker/backend/Dockerfile
           load: true
           platforms: linux/amd64
           push: true
+          #owasp/nest:backend-staging
           tags: |
-            owasp/nest:backend-staging
             ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION }}.amazonaws.com/nest-staging-backend:latest
 
       - name: Prepare frontend public environment
@@ -529,22 +534,22 @@ jobs:
           NEXT_PUBLIC_SENTRY_DSN=$NEXT_PUBLIC_SENTRY_DSN
           EOF
 
-      - name: Get backend image size
-        id: backend-size
-        run: |
-          IMAGE_NAME="owasp/nest:backend-staging"
-          RAW_SIZE=$(docker image inspect "$IMAGE_NAME" --format='{{.Size}}')
-          DISPLAY_SIZE=$(numfmt --to=iec --suffix=B "$RAW_SIZE")
-          echo "human_readable=$DISPLAY_SIZE" >> $GITHUB_OUTPUT
+      #- name: Get backend image size
+        #id: backend-size
+        #run: |
+          #IMAGE_NAME="owasp/nest:backend-staging"
+          #RAW_SIZE=$(docker image inspect "$IMAGE_NAME" --format='{{.Size}}')
+          #DISPLAY_SIZE=$(numfmt --to=iec --suffix=B "$RAW_SIZE")
+          #echo "human_readable=$DISPLAY_SIZE" >> $GITHUB_OUTPUT
 
       - name: Build frontend image
         uses: docker/build-push-action@601a80b39c9405e50806ae38af30926f9d957c47
         with:
-          cache-from: |
-            type=gha
-            type=registry,ref=owasp/nest:frontend-staging-cache
-          cache-to: |
-            type=registry,ref=owasp/nest:frontend-staging-cache
+          #cache-from: |
+            #type=gha
+            #type=registry,ref=owasp/nest:frontend-staging-cache
+          #cache-to: |
+            #type=registry,ref=owasp/nest:frontend-staging-cache
           context: frontend
           file: docker/frontend/Dockerfile
           load: true
@@ -553,26 +558,26 @@ jobs:
           secrets: |
             RELEASE_VERSION=${{ needs.set-release-version.outputs.release_version }}
             SENTRY_AUTH_TOKEN=${{ secrets.SENTRY_AUTH_TOKEN }}
+          # owasp/nest:frontend-staging
           tags: |
-            owasp/nest:frontend-staging
             ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ vars.AWS_REGION }}.amazonaws.com/nest-staging-frontend:latest
 
-      - name: Get frontend image size
-        id: frontend-size
-        run: |
-          IMAGE_NAME="owasp/nest:frontend-staging"
-          RAW_SIZE=$(docker image inspect "$IMAGE_NAME" --format='{{.Size}}')
-          DISPLAY_SIZE=$(numfmt --to=iec --suffix=B "$RAW_SIZE")
-          echo "human_readable=$DISPLAY_SIZE" >> $GITHUB_OUTPUT
-
-      - name: Create Docker image size report
-        run: |
-          {
-            echo "## Docker Image Size Report"
-            echo ""
-            echo "**Backend:** ${{ steps.backend-size.outputs.human_readable }}"
-            echo "**Frontend:** ${{ steps.frontend-size.outputs.human_readable }}"
-          } >> $GITHUB_STEP_SUMMARY
+      #- name: Get frontend image size
+        #id: frontend-size
+        #run: |
+          #IMAGE_NAME="owasp/nest:frontend-staging"
+          #RAW_SIZE=$(docker image inspect "$IMAGE_NAME" --format='{{.Size}}')
+          #DISPLAY_SIZE=$(numfmt --to=iec --suffix=B "$RAW_SIZE")
+          #echo "human_readable=$DISPLAY_SIZE" >> $GITHUB_OUTPUT
+
+      #- name: Create Docker image size report
+        #run: |
+          #{
+            #echo "## Docker Image Size Report"
+            #echo ""
+            #echo "**Backend:** ${{ steps.backend-size.outputs.human_readable }}"
+            #echo "**Frontend:** ${{ steps.frontend-size.outputs.human_readable }}"
+          #} >> $GITHUB_STEP_SUMMARY
     timeout-minutes: 10
 
   scan-staging-images:
@@ -618,17 +623,99 @@ jobs:
             frontend-sbom-${{ env.RELEASE_VERSION }}.cdx.json
     timeout-minutes: 5
 
+  bootstrap-staging-nest:
+    name: Bootstrap Nest Staging
+    env:
+      TF_INPUT: false
+      TF_IN_AUTOMATION: true
+    environment: staging
+    #if: |
+      #github.repository == 'OWASP/Nest' &&
+      #github.ref == 'refs/heads/main'
+    #needs:
+      #- scan-staging-images
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@61815dcd50bd041e203e49132bacad1fd04d2708
+        with:
+          aws-access-key-id: ${{ secrets.BOOTSTRAP_AWS_ACCESS_KEY_ID }}
+          aws-region: ${{ vars.AWS_REGION }}
+          aws-secret-access-key: ${{ secrets.BOOTSTRAP_AWS_SECRET_ACCESS_KEY }}
+
+      - name: Install Terraform
+        uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
+        with:
+          terraform_version: 1.14.0
+
+      - name: Prepare terraform backend
+        env:
+          AWS_REGION: ${{ vars.AWS_REGION }}
+          TF_STATE_BUCKET_NAME: ${{ secrets.BOOTSTRAP_TF_STATE_BUCKET_NAME }}
+          TF_STATE_DYNAMODB_TABLE_NAME: ${{ secrets.BOOTSTRAP_TF_STATE_DYNAMODB_TABLE_NAME }}
+        run: |
+          umask 377
+          cat > infrastructure/bootstrap/terraform.tfbackend <<-EOF
+          bucket="$TF_STATE_BUCKET_NAME"
+          dynamodb_table="$TF_STATE_DYNAMODB_TABLE_NAME"
+          region="$AWS_REGION"
+          EOF
+
+      - name: Prepare terraform variables
+        env:
+          AWS_REGION: ${{ vars.AWS_REGION }}
+          PROJECT_NAME: 'nest'
+          AWS_ROLE_EXTERNAL_ID: ${{ secrets.AWS_ROLE_EXTERNAL_ID }}
+        run: |
+          umask 377
+          cat > infrastructure/bootstrap/terraform.tfvars <<-EOF
+          aws_region="$AWS_REGION"
+          project_name="$PROJECT_NAME"
+          aws_role_external_id="$AWS_ROLE_EXTERNAL_ID"
+          EOF
+
+      - name: Terraform Init
+        working-directory: infrastructure/bootstrap
+        run: terraform init -backend-config=terraform.tfbackend
+
+      - name: Terraform Validate
+        working-directory: infrastructure/bootstrap
+        run: terraform validate
+
+      - name: Terraform Plan
+        working-directory: infrastructure/bootstrap
+        run: terraform plan -out=tfplan
+
+      - name: Show plan in summary
+        working-directory: infrastructure/bootstrap
+        run: |
+          echo "## Bootstrap Terraform Plan Output" >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+          terraform show -no-color tfplan >> $GITHUB_STEP_SUMMARY
+          echo '```' >> $GITHUB_STEP_SUMMARY
+
+      - name: Terraform Apply
+        working-directory: infrastructure/bootstrap
+        run: terraform apply -auto-approve tfplan
+    timeout-minutes: 10
+
   plan-staging-nest:
     name: Plan Nest Staging
     env:
       TF_INPUT: false
       TF_IN_AUTOMATION: true
     environment: staging
-    if: |
-      github.repository == 'OWASP/Nest' &&
-      github.ref == 'refs/heads/main'
+    #if: |
+      #github.repository == 'OWASP/Nest' &&
+      #github.ref == 'refs/heads/main'
     needs:
-      - scan-staging-images
+      - bootstrap-staging-nest
+      #- scan-staging-images
       - set-release-version
     permissions:
       contents: read
@@ -643,6 +730,11 @@ jobs:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-region: ${{ vars.AWS_REGION }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-duration-seconds: 3600
+          role-external-id: ${{ secrets.AWS_ROLE_EXTERNAL_ID }}
+          role-session-name: GitHubActions-StagingPlan
+          role-skip-session-tagging: true
+          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/nest-staging-terraform
 
       - name: Install Terraform
         uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
@@ -671,7 +763,7 @@ jobs:
           ECS_USE_FARGATE_SPOT: true
           ENVIRONMENT: 'staging'
           FRONTEND_USE_FARGATE_SPOT: true
-          LAMBDA_FUNCTION_NAME: ${{ secrets.ZAPPA_LAMBDA_FUNCTION_NAME }}
+          LAMBDA_FUNCTION_NAME: 'nest-staging'
           PROJECT_NAME: 'nest'
         run: |
           umask 377
@@ -685,6 +777,12 @@ jobs:
           frontend_use_fargate_spot=$FRONTEND_USE_FARGATE_SPOT
           lambda_function_name="$LAMBDA_FUNCTION_NAME"
           project_name="$PROJECT_NAME"
+
+          secret_recovery_window_in_days = 0
+          db_backup_retention_period     = 0
+          db_deletion_protection         = false
+          db_skip_final_snapshot         = true
+
           EOF
 
       - name: Terraform Init
@@ -722,9 +820,9 @@ jobs:
       TF_INPUT: false
       TF_IN_AUTOMATION: true
     environment: staging
-    if: |
-      github.repository == 'OWASP/Nest' &&
-      github.ref == 'refs/heads/main'
+    #if: |
+      #github.repository == 'OWASP/Nest' &&
+      #github.ref == 'refs/heads/main'
     needs:
       - plan-staging-nest
     permissions:
@@ -740,6 +838,11 @@ jobs:
           aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
           aws-region: ${{ vars.AWS_REGION }}
           aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          role-duration-seconds: 3600
+          role-external-id: ${{ secrets.AWS_ROLE_EXTERNAL_ID }}
+          role-session-name: GitHubActions-StagingDeploy
+          role-skip-session-tagging: true
+          role-to-assume: arn:aws:iam::${{ secrets.AWS_ACCOUNT_ID }}:role/nest-staging-terraform
 
       - name: Install Terraform
         uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd
@@ -800,7 +903,7 @@ jobs:
 
       - name: Install backend dependencies
         working-directory: backend
-        run: poetry sync --no-root --without dev --without test --without video
+        run: poetry sync --no-root --without test --without video
 
       - name: Prepare Zappa settings
         env:

.gitignore

@@ -38,10 +38,10 @@ backend/fuzzing_results/
 !*.tfvars.example
 **/.terraform/
 backend-sbom-local.cdx.json
-backend/*nest-backend-dev*.tar.gz
-backend/*nest-backend-dev*.zip
-backend/*nest-backend-staging*.tar.gz
-backend/*nest-backend-staging*.zip
+backend/*nest-dev*.tar.gz
+backend/*nest-dev*.zip
+backend/*nest-staging*.tar.gz
+backend/*nest-staging*.zip
 backend/data/backup*
 backend/generated_videos/
 backend/staticfiles

backend/zappa_settings.template.json

@@ -25,7 +25,7 @@
     ],
     "manage_roles": true,
     "memory_size": 3008,
-    "project_name": "nest-backend",
+    "project_name": "nest",
     "regex_excludes": [
       "/boto3/",
       "/boto3-",

cspell/custom-dict.txt

@@ -169,6 +169,7 @@ pyyaml
 quasis
 rediss
 relativedelta
+replicationgroup
 repositorycontributor
 requirepass
 rqworker
@@ -184,6 +185,7 @@ skillstruck
 slackbot
 slideshare
 speakerdeck
+subgrp
 superfences
 tfbackend
 tgz