Skip to content
This repository has been archived by the owner on Jul 2, 2024. It is now read-only.

DEVPROD-4976: Use temporary AWS credentials from ec2.assume_role command #493

Merged
merged 2 commits into from
Feb 21, 2024
Merged

DEVPROD-4976: Use temporary AWS credentials from ec2.assume_role command #493

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f4c6eb2
DEVPROD-4976: Use ec2.assume_role command
minnakt Feb 21, 2024
7d5f932
Update .evergreen.yml
minnakt Feb 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
118 changes: 70 additions & 48 deletions .evergreen.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,12 +19,18 @@ modules:
# Parsley Functions #
#######################################
functions:
assume-ec2-role:
command: ec2.assume_role
params:
role_arn: ${ASSUME_ROLE_ARN}

attach-codegen-diff:
command: s3.put
type: system
params:
aws_key: ${aws_key}
aws_secret: ${aws_secret}
aws_key: ${AWS_ACCESS_KEY_ID}
aws_secret: ${AWS_SECRET_ACCESS_KEY}
aws_session_token: ${AWS_SESSION_TOKEN}
local_files_include_filter:
- "parsley/bin/codegen.diff"
remote_file: parsley/${task_id}/codegen/
Expand All @@ -40,8 +46,9 @@ functions:
- command: s3.put
type: system
params:
aws_key: ${aws_key}
aws_secret: ${aws_secret}
aws_key: ${AWS_ACCESS_KEY_ID}
aws_secret: ${AWS_SECRET_ACCESS_KEY}
aws_session_token: ${AWS_SESSION_TOKEN}
local_files_include_filter:
["parsley/cypress/screenshots/*"]
remote_file: parsley/${task_id}/
Expand All @@ -52,8 +59,9 @@ functions:
- command: s3.put
type: system
params:
aws_key: ${aws_key}
aws_secret: ${aws_secret}
aws_key: ${AWS_ACCESS_KEY_ID}
aws_secret: ${AWS_SECRET_ACCESS_KEY}
aws_session_token: ${AWS_SESSION_TOKEN}
local_files_include_filter:
["parsley/cypress/videos/*"]
remote_file: parsley/${task_id}/
Expand All @@ -72,8 +80,9 @@ functions:
- command: s3.put
type: system
params:
aws_key: ${aws_key}
aws_secret: ${aws_secret}
aws_key: ${AWS_ACCESS_KEY_ID}
aws_secret: ${AWS_SECRET_ACCESS_KEY}
aws_session_token: ${AWS_SESSION_TOKEN}
local_files_include_filter:
["parsley/storybook-static/*.html"]
remote_file: parsley/${task_id}/storybook/
Expand All @@ -84,8 +93,9 @@ functions:
- command: s3.put
type: system
params:
aws_key: ${aws_key}
aws_secret: ${aws_secret}
aws_key: ${AWS_ACCESS_KEY_ID}
aws_secret: ${AWS_SECRET_ACCESS_KEY}
aws_session_token: ${AWS_SESSION_TOKEN}
local_files_include_filter:
["parsley/storybook-static/**/*.js", "parsley/storybook-static/**/*.mjs"]
remote_file: parsley/${task_id}/storybook/
Expand All @@ -96,8 +106,9 @@ functions:
- command: s3.put
type: system
params:
aws_key: ${aws_key}
aws_secret: ${aws_secret}
aws_key: ${AWS_ACCESS_KEY_ID}
aws_secret: ${AWS_SECRET_ACCESS_KEY}
aws_session_token: ${AWS_SESSION_TOKEN}
local_files_include_filter:
["parsley/storybook-static/**/*.js.map"]
remote_file: parsley/${task_id}/storybook/
Expand All @@ -108,8 +119,9 @@ functions:
- command: s3.put
type: system
params:
aws_key: ${aws_key}
aws_secret: ${aws_secret}
aws_key: ${AWS_ACCESS_KEY_ID}
aws_secret: ${AWS_SECRET_ACCESS_KEY}
aws_session_token: ${AWS_SESSION_TOKEN}
local_files_include_filter:
["parsley/storybook-static/**/*.svg"]
remote_file: parsley/${task_id}/storybook/
Expand All @@ -120,8 +132,9 @@ functions:
- command: s3.put
type: system
params:
aws_key: ${aws_key}
aws_secret: ${aws_secret}
aws_key: ${AWS_ACCESS_KEY_ID}
aws_secret: ${AWS_SECRET_ACCESS_KEY}
aws_session_token: ${AWS_SESSION_TOKEN}
local_files_include_filter:
["parsley/storybook-static/**/*.json"]
remote_file: parsley/${task_id}/storybook/
Expand All @@ -144,8 +157,9 @@ functions:
command: s3.put
type: system
params:
aws_key: ${aws_key}
aws_secret: ${aws_secret}
aws_key: ${AWS_ACCESS_KEY_ID}
aws_secret: ${AWS_SECRET_ACCESS_KEY}
aws_session_token: ${AWS_SESSION_TOKEN}
local_file: "parsley/build/source_map.html"
remote_file: parsley/${task_id}/source_map.html
bucket: mciuploads
Expand All @@ -164,39 +178,39 @@ functions:
params:
working_dir: parsley
shell: bash
env:
AUTHOR_EMAIL: ${author_email}
DEPLOYS_EMAIL: ${DEPLOYS_EMAIL}
EXECUTION: ${execution}
script: |
export AUTHOR_EMAIL=${author_email}
export DEPLOYS_EMAIL=${DEPLOYS_EMAIL}
export EXECUTION=${execution}
bash scripts/email.sh

setup-credentials:
command: shell.exec
params:
working_dir: parsley
shell: bash
env:
REACT_APP_SENTRY_AUTH_TOKEN: ${REACT_APP_SENTRY_AUTH_TOKEN}
REACT_APP_SENTRY_DSN: ${REACT_APP_SENTRY_DSN}
NEW_RELIC_ACCOUNT_ID: ${NEW_RELIC_ACCOUNT_ID}
NEW_RELIC_AGENT_ID: ${NEW_RELIC_AGENT_ID}
NEW_RELIC_APPLICATION_ID: ${NEW_RELIC_APPLICATION_ID}
NEW_RELIC_LICENSE_KEY: ${NEW_RELIC_LICENSE_KEY}
NEW_RELIC_TRUST_KEY: ${NEW_RELIC_TRUST_KEY}
DEPLOYS_EMAIL: ${DEPLOYS_EMAIL}
BUCKET: ${bucket}
EVERGREEN_API_SERVER_HOST: ${evergreen_api_server_host}
EVERGREEN_UI_SERVER_HOST: ${evergreen_api_server_host}
EVERGREEN_API_KEY: ${evergreen_api_key}
EVERGREEN_USER: ${evergreen_user}
script: |
echo "Generating .env-cmdrc.json"
REACT_APP_SENTRY_AUTH_TOKEN=${REACT_APP_SENTRY_AUTH_TOKEN} \
REACT_APP_SENTRY_DSN=${REACT_APP_SENTRY_DSN} \
NEW_RELIC_ACCOUNT_ID=${NEW_RELIC_ACCOUNT_ID} \
NEW_RELIC_AGENT_ID=${NEW_RELIC_AGENT_ID} \
NEW_RELIC_APPLICATION_ID=${NEW_RELIC_APPLICATION_ID} \
NEW_RELIC_LICENSE_KEY=${NEW_RELIC_LICENSE_KEY} \
NEW_RELIC_TRUST_KEY=${NEW_RELIC_TRUST_KEY} \
DEPLOYS_EMAIL=${DEPLOYS_EMAIL} \
BUCKET=${bucket} \
node scripts/setup-credentials.js

echo "populating evergreen.yml"
cat <<EOF > .evergreen.yml
api_server_host: ${evergreen_api_server_host}
ui_server_host: ${evergreen_ui_server_host}
api_key: ${evergreen_api_key}
user: ${evergreen_user}
EOF

echo "Done populating"
./scripts/create-evergreen-yml.sh
echo "Done populating evergreen.yml"

setup-node:
- command: subprocess.exec
Expand Down Expand Up @@ -341,14 +355,16 @@ functions:
params:
working_dir: parsley
shell: bash
env:
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Non-blocking suggestion: would it be better to use subprocess.exec instead of shell.exec throughout this config?

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

for sure! I fixed one of the easy ones, but the other ones make me a bit nervous so I'll open a ticket to audit this usage!

BUCKET: ${bucket}
AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID}
AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY}
AWS_SESSION_TOKEN: ${AWS_SESSION_TOKEN}
EXECUTION: ${execution}
DEPLOYS_EMAIL: ${DEPLOYS_EMAIL}
AUTHOR_EMAIL: ${author_email}
script: |
${PREPARE_SHELL}
BUCKET=${bucket} \
AWS_ACCESS_KEY_ID=${aws_key} \
AWS_SECRET_ACCESS_KEY=${aws_secret} \
EXECUTION=${execution} \
DEPLOYS_EMAIL=${DEPLOYS_EMAIL} \
AUTHOR_EMAIL=${author_email} \
yarn deploy:prod

#######################################
Expand Down Expand Up @@ -425,8 +441,9 @@ functions:
command: s3.put
type: system
params:
aws_key: ${aws_key}
aws_secret: ${aws_secret}
aws_key: ${AWS_ACCESS_KEY_ID}
aws_secret: ${AWS_SECRET_ACCESS_KEY}
aws_session_token: ${AWS_SESSION_TOKEN}
local_file: parsley/logkeeper/logkeeperapp.log
remote_file: parsley/${task_id}/${execution}/logkeeperapp.log
bucket: mciuploads
Expand All @@ -437,8 +454,9 @@ functions:
command: s3.get
type: setup
params:
aws_key: ${aws_key}
aws_secret: ${aws_secret}
aws_key: ${AWS_ACCESS_KEY_ID}
aws_secret: ${AWS_SECRET_ACCESS_KEY}
aws_session_token: ${AWS_SESSION_TOKEN}
extract_to: parsley/logkeeper
remote_file: _bucketdata.tar.gz
bucket: parsley-test
Expand All @@ -450,6 +468,7 @@ functions:
tasks:
- name: compile
commands:
- func: assume-ec2-role
- func: yarn-build
- func: attach-source-map

Expand All @@ -468,6 +487,7 @@ tasks:

- name: e2e_test
commands:
- func: assume-ec2-role
- func: setup-mongodb
- func: run-make-background
vars:
Expand All @@ -483,6 +503,7 @@ tasks:

- name: storybook
commands:
- func: assume-ec2-role
- func: yarn-storybook
- func: attach-storybook
- func: link-to-storybook
Expand All @@ -498,6 +519,7 @@ tasks:

- name: deploy-prod
commands:
- func: assume-ec2-role
- func: setup-credentials
- func: sym-link
- func: prod-deploy
Expand Down
6 changes: 6 additions & 0 deletions scripts/create-evergreen-yml.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
cat <<EOF > .evergreen.yml
api_server_host: $EVERGREEN_API_SERVER_HOST
ui_server_host: $EVERGREEN_UI_SERVER_HOST
api_key: $EVERGREEN_API_KEY
user: $EVERGREEN_USER
EOF
Loading