alphagov/re-request-an-aws-account

:partly_sunny: An interface for requesting AWS accounts

Engineering Enablement: Request an AWS Account

User interface to manage AWS Accounts (e.g. for new services or environments) and users within the base AWS account.

Running locally

This is a rails app, with dependencies managed by bundler. To run the app locally clone this repo, then:

bundle install
npm install
bundle exec rails server

If you want to test the apps interaction with third party services (e.g. GitHub and GOV.UK Notify) you'll need to set up some secrets in environment variables. The easiest way to do this in development is using a .env file (see .env.example):

cp .env.example .env
$EDITOR .env

Run the tests with:

bundle exec rails test

To sign in as a development user, visit http://localhost:3000/dev-login (to try different email addresses, you can provide a email parameter). If you want to test with real Google SSO, you can create an application in the Google Cloud Console.

Building Docker Image

Note - when building the docker image on a mac arm but wanting to run the image on x86 architecture then run the docker build with this flag: --platform="linux/amd64"

Ruby App Master Key

If running in production a master key is required to decrypt credentials.yml.enc. This has been created and is passed into the container/environment at runtime.

ENV vars

• RAILS_ALLOWED_DOMAINS: the domain of the app runtime env (eg loalhost:3000 or sub.domain.tld)
• RAILS_SERVE_STATIC_FILES true|false(default)
• RAILS_LOG_TO_STDOUT true : will log out errors etc since production defaults to logfile
• RESTRICT_LOGIN_EMAIL_ADDRESSES_TO: [email protected] [email protected] - should be a space separated list of email addresses if set it will only allow those email address to log in

ENV secrets

• GOOGLE_CLIENT_ID: an OAuth2 client ID
• GOOGLE_CLIENT_SECRET: an OAuth2 client secret
• GITHUB_PERSONAL_ACCESS_TOKEN: the PAT required to act on requied alphagov repos
• NOTIFY_API_KEY: a key to use the notify api to send emails
• RAILS_MASTER_KEY: the key that has been used to encode config/credentials.yml.enc

Updating the Cost Centre Information

We have a csv file in S3 which contains the Cabinet Office cost centre information. This is used to check the cost centre details entered by the user when requesting an AWS account. The original source for cost centre information in the intranet is updated monthly and we should replace the file in out S3 bucket periodically with the most up to date version.

You will need to be on the VPN both to access the file on the intranet, and to upload to to S3.

Download the Cost Center Hierarchy file available on this page: https://intranet.cabinetoffice.gov.uk/wagtail-user-sandbox-area/cdt-information-hub/co-reporting/cabinet-office-cost-centres/, and export to a CSV if in another format.

Run the CSV Updater script from the root of the project with:

gds aws <account-name> -- bundle exec ruby bin/csv_updater -b "<bucket-name>" -f "<path-to-file>"

For test environment:

• Account name: ee-request-aws-account-test-admin
• Bucket name: gds-ee-raat-test-csv

Production environment:

• Account name: ee-request-aws-account-prod
• Bucket name: gds-ee-raat-prod-csv

Path to file is the absolute path of the file eg: /Users/myusername/Downloads/cost_centres.csv.

The script checks that the headers in the CSV have the expected values. If the upload fails because the headers have been changed, you need to update the keys accordingly in the mapping hash in the /bin/csv_updater file, leaving the values in the hash as they are (the examples shown in comments in the mapping give an idea of the format of the data in each column - this is to help identify which columns are needed if the headers have changed.)

Important note: The csv file should not be made public, so if you save it inside the project, ensure you delete it after running the script and DO NOT push it to GitHub.

To apply the changes, you must restart the app. Login to the AWS account by running: gds aws <account-name> -l. In the AWS console, open App Runner and click the orange deploy button to refresh the instance without downtime.

re-request-an-aws-account's Issues

Dockerisation runs as `su`

At the moment, the dockerfile runs everything as su. We should change it to uncomment line 11's

RUN chown -R user:user /opt/app

so that the subsequent code can run as USER user instead.

This is better security practice.

Feature request: ability to schedule scheduled removal PR creation for temporary users

e.g. pentesters.

Could use some fun github action trickery.

Or could perhaps just piggy-back on alex monk's old pipeline which alerts us to aws users that are no longer present in the google org and prompt us to create the PR ourselves.

Whichever's easier.

[Bug] Multiple users with different valid domains invalid

I don't have the Ruby skills to look into why this happens but if you try and add multiples of different valid-domain users, you get an invalid error.

Both work independently:

[email protected]
[email protected]

[email protected]
[email protected]

However, together results in Email list should be a list of approved emails:

[email protected]
[email protected]
[email protected]
[email protected]

[Feature Request] Case insensitive input

Currently, [email protected] will result in an error.
Allow different case and then change to lower - for former, I think adding A-Z to the regular expressions will work:

re-request-an-aws-account/app/lib/email_validator.rb

Line 13 in b491e3c

/\A([a-z.\-\']+@digital\.cabinet-office\.gov\.uk,?\s*)+\z/,

Like: /\A([A-Za-z.\-\']+@digital\.cabinet-office\.gov\.uk,?\s*)+\z/,

Bot pushes second commit to branch *after* raising PR.

When adding a new user, the bot raises a PR then pushes a second commit to it. The gap in between where there's an open PR with only one of two commits pushed can sometimes be minutes.

The bot should either just put both changes in the same commit (preferred, because to commit one change without the other wouldn't make sense in this case) or at least not push or raise the PR until it's made both commits locally.

Administrator email addresses cannot contain capitals

I was trying to create a request, but because I was doing it from an iOS account, the first letter of the email address in the administrators box was being capitalised.

I kept getting an error message telling me that the administrator emails must be approved emails, and only digging through the code did I realise what the issue was.

I suspect that since in almost all modern mail implementations, the inboxes are case insensitive, that the regex should allow uppercase letters.

Trailing (and probably leading) whitespace is not stripped from form fields

For example, see alphagov/aws-billing-account#364.

Unknown email list error when requesting removal of a subset of a previous rejected PR

I requested the removal of some accounts of people who have left PaaS. This resulted in alphagov/aws-user-management-account-users#1666.

It was then pointed out that one of the people included in the PR is still working with GDS, so that PR was closed.

I then attempted to re-request the removal with the person who is still with GDS excluded, and received the following error from the form:

There is a problem
Email list unknown error when opening pull request or sending email

(email addresses redacted from the above screenshot)

I would expect that submitting this second request with a subset of users from the first request would succeed, and result in a second pull request, or at least a more descriptive error if I'm doing something wrong.

Softwire people cannot log in to use the password reset request functionality

They see this:
You can only sign in with accounts from either digital.cabinet-office.gov.uk or cabinetoffice.gov.uk Google organisations.

@tlwr @OllieJC I think maybe we can just add them to the list of domains allowed to log in? I don't think they'll be able to do anything sensitive, they'd be able to make requests which we might not choose to grant?

Update information hint to tell users about account name constraints

Ruby will throw an error if the proposed AWS account name has 6 or more parts (for example ee-request-AN-aws-account-test instead of ee-request-aws-account-test).

The hint in account_details.html.erb should be expanded to that effect

Allow email addresses with numbers in

Ignoring the general problem with email validation...

Email addresses should be able to have numbers in. We've had several users we couldn't create since the local part of their email address ended with a number.

Another test issue

Optional description

Duplicate root account email addresses can be generated

For example, in alphagov/aws-billing-account#363 and alphagov/aws-billing-account#364 co-special-advisors-portal-production and co-special-advisors-portal-preproduction both got automatically shortened to aws-root-accounts+co-sp-ad-po-pr. Terraform then fails to create the second of the two accounts because its root account email address clashes with the first.

One fix that springs to mind is to have the re-request-an-aws-account bot search the list of existing names and replace the last character with a 1, or if that's taken then a 2, etc. to ensure uniqueness.