-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
[ALS-6225] PICSURE will use RDS 7 day rotating password (#137)
## [ALS-6225] Integration of AWS Secrets Manager and MySQL Connector Updates for Wildfly Deployment ### Summary: - Implemented AWS Secrets Manager JDBC for managing database credentials, enhancing security by utilizing secrets for loading usernames and passwords. - Updated the Wildfly MySQL module and standalone configuration to include the new MySQL Java Connector, ensuring proper SQL connectivity and aligning secret names with updated standards. - Modified `wildfly-user_data.sh` to correctly reference the updated MySQL connector path and removed outdated MySQL module configurations to streamline deployment. - Refactored IAM roles and policy attachments for Wildfly deployment, improving monitoring and management capabilities by attaching CloudWatchAgentServerPolicy and AmazonSSMManagedInstanceCore policy. - Streamlined the Terraform configuration by updating IAM instance profiles and segregating IAM resources into `wildfly-iam.tf`, removing duplication. - Enhanced the standalone.xml configuration by adding MySQL and H2 drivers, updating JDBC connection details, and reintroducing the ExampleDS datasource for improved database connectivity. - Documented the configuration and deployment process in a new README.md file, providing clarity on dynamic generation of module.xml during Docker image build. - Performed cleanup by removing obsolete configurations and variables related to AWS region and IAM roles for secret management, ensuring a leaner configuration.
- Loading branch information
Showing
9 changed files
with
171 additions
and
146 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,5 @@ | ||
| ## Additional Information about WildFly Configuration | ||
| There is no module.xml in this repository. It has been moved to the [pic-sure-wildfly-docker repository](https://github.com/hms-dbmi/pic-sure-wildfly-docker). | ||
| The `module.xml` is created dynamically by the `generate-module-xml.sh` script in the pic-sure-wildfly-docker repository. This script is run when the | ||
| `pic-sure-with-aggregate-resource.Dockerfile` is built. The module.xml is created based on the jars copied into the | ||
| `opt/jboss/wildfly/modules/system/layers/base/com/sql/mysql/main/` directory in the docker image. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file was deleted.
Oops, something went wrong.
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,139 @@ | ||
| data "aws_region" "current" {} | ||
|
|
||
| resource "aws_iam_instance_profile" "wildfly-deployment-profile" { | ||
| name = "wildfly-deployment-profile-${var.target_stack}-${local.uniq_name}" | ||
| role = aws_iam_role.wildfly-deployment-role.name | ||
| } | ||
|
|
||
| resource "aws_iam_role" "wildfly-deployment-role" { | ||
| name = "${local.project_no_space}-wildfly-deployment-role-${var.target_stack}-${local.uniq_name}" | ||
| assume_role_policy = <<EOF | ||
| { | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Action": "sts:AssumeRole", | ||
| "Principal": { | ||
| "Service": "ec2.amazonaws.com" | ||
| }, | ||
| "Effect": "Allow", | ||
| "Sid": "" | ||
| } | ||
| ] | ||
| } | ||
| EOF | ||
| } | ||
|
|
||
| resource "aws_iam_role_policy" "wildfly-deployment-sm-policy" { | ||
| name = "wildfly-deployment-sm-policy-${var.target_stack}-${local.uniq_name}" | ||
| role = aws_iam_role.wildfly-deployment-role.id | ||
| policy = <<EOF | ||
| { | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Action": [ | ||
| "secretsmanager:GetSecretValue", | ||
| "secretsmanager:DescribeSecret" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Resource": "arn:aws:secretsmanager:${data.aws_region.current.name}:${var.app_acct_id}:secret:${var.app_user_secret_name}-*" | ||
| } | ||
| ] | ||
| } | ||
| EOF | ||
| } | ||
|
|
||
| resource "aws_iam_role_policy_attachment" "attach-cloudwatch-server-policy-to-sm-role" { | ||
| role = aws_iam_role.wildfly-deployment-role.name | ||
| policy_arn = "arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy" | ||
| } | ||
|
|
||
| resource "aws_iam_role_policy_attachment" "attach-cloudwatch-ssm-policy-to-sm-role" { | ||
| role = aws_iam_role.wildfly-deployment-role.name | ||
| policy_arn = "arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore" | ||
| } | ||
|
|
||
| resource "aws_iam_role_policy" "wildfly-deployment-s3-policy" { | ||
| name = "wildfly-deployment-s3-policy-${var.target_stack}-${local.uniq_name}" | ||
| role = aws_iam_role.wildfly-deployment-role.id | ||
| policy = <<EOF | ||
| { | ||
| "Version": "2012-10-17", | ||
| "Statement": [ | ||
| { | ||
| "Action": [ | ||
| "s3:GetObject" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Resource": "arn:aws:s3:::${var.stack_s3_bucket}/releases/jenkins_pipeline_build_${var.stack_githash_long}/pic-sure-wildfly.tar.gz" | ||
| },{ | ||
| "Action": [ | ||
| "s3:GetObject" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Resource": "arn:aws:s3:::${var.stack_s3_bucket}/configs/jenkins_pipeline_build_${var.stack_githash_long}/visualization-resource.properties" | ||
| },{ | ||
| "Action": [ | ||
| "s3:GetObject" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Resource": "arn:aws:s3:::${var.stack_s3_bucket}/data/${var.dataset_s3_object_key}/fence_mapping.json" | ||
| },{ | ||
| "Action": [ | ||
| "s3:GetObject" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Resource": "arn:aws:s3:::${var.stack_s3_bucket}/configs/jenkins_pipeline_build_${var.stack_githash_long}/standalone.xml" | ||
| },{ | ||
| "Action": [ | ||
| "s3:GetObject" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Resource": "arn:aws:s3:::${var.stack_s3_bucket}/configs/jenkins_pipeline_build_${var.stack_githash_long}/*" | ||
| },{ | ||
| "Action": [ | ||
| "s3:GetObject" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Resource": "arn:aws:s3:::${var.stack_s3_bucket}/configs/jenkins_pipeline_build_${var.stack_githash_long}/aggregate-resource.properties" | ||
| },{ | ||
| "Action": [ | ||
| "s3:GetObject" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Resource": "arn:aws:s3:::${var.stack_s3_bucket}/configs/jenkins_pipeline_build_${var.stack_githash_long}/aggregate-resource.properties" | ||
| },{ | ||
| "Action": [ | ||
| "s3:GetObject" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Resource": "arn:aws:s3:::${var.stack_s3_bucket}/modules/*" | ||
| },{ | ||
| "Action": [ | ||
| "s3:ListBucket" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Resource": "arn:aws:s3:::${var.stack_s3_bucket}", | ||
| "Condition": { | ||
| "StringLike": { | ||
| "s3:prefix": [ | ||
| "releases/jenkins_pipeline_build_${var.stack_githash_long}/*", | ||
| "configs/jenkins_pipeline_build_${var.stack_githash_long}*", | ||
| "modules/*", | ||
| "data/${var.dataset_s3_object_key}/*" | ||
| ] | ||
| } | ||
| } | ||
| },{ | ||
| "Action": [ | ||
| "ec2:CreateTags" | ||
| ], | ||
| "Effect": "Allow", | ||
| "Resource": "arn:aws:ec2:*:*:instance/*" | ||
| } | ||
| ] | ||
| } | ||
| EOF | ||
| } | ||
|
|
Oops, something went wrong.