samtowne/custodian

• 👋 Hi, I’m @SamTowne
• I use this account to learn tech and try new things.

custodian's Issues

support releases

• naming convention for auto-release bumps based upon branch prefixes
  • major branch prefix sets the major release version: 1.0.0
  • feature branch prefix sets the minor release version: 0.1.0
  • hotfix branch prefix sets the last digit: 0.0.1

Create SQS Queue - and dead letter queue configuration

Event Flow for scheduled events:

• scheduler lamdba reads dynamodb config table for items that are of type 'scheduled'
• for each item found, it submits a message to this queue
• the processor lambda function receives message from this queue, for messages it cannot process, it will submit the message to the dead letter queue

Configurator Service - Manages app runtime settings and configuration items

Test adding a service to manage DynamoDB table items

configurator python lambda

Test continuous deployment

Get the CICD working. Current state it does not seem to be triggering with push or pull requests to main.

Support multiple services, build if there's a diff in the service's path

The build pipeline step should run if there are updates to the service. It should support multiple services. It should only build/deploy a service if there are updates to that service. It is probably worthwhile to allow for a manual deploy option as well, perhaps by supporting a tag on a MR or something like that so that a developer can opt to deploy a service for other reasons than the service code being updated.

TF Apply Failure UnmodifiableEntity: Cannot perform the operation on the protected role

See pipeline https://github.com/SamTowne/custodian/actions/runs/4207989559/jobs/7303480589
╷
│ Error: updating user, role, or group list from IAM Policy Attachment AdministratorAccess:
│ – UnmodifiableEntity: Cannot perform the operation on the protected role 'AWSReservedSSO_AWSAdministratorAccess_566cd3686ffd4b4c' - this role is only modifiable by AWS
│ status code: 400, request id: 1745273b-8fd3-4c46-aa0e-7dea63ff233d
│
│ with module.github-actions-iam.aws_iam_policy_attachment.AdministratorAccess,
│ on modules/github-actions-iam/iam.tf line 30, in resource "aws_iam_policy_attachment" "AdministratorAccess":
│ 30: resource "aws_iam_policy_attachment" "AdministratorAccess" {
│
╵

service versioning

each service should be versioned w/ symantic versioning: x.x.x , using branch prefix to determine type of change: hotfix, major, feature

add a dev environment

Build lambda package in github ci

Turn on some sort of code scanner for the python + depenencies

Code should be scanned as part of CI before deployment

IAM SID Must be Alphnumeric

TF Apply error on https://github.com/SamTowne/custodian/actions/runs/4236454684/jobs/7361292004

│ Error: putting IAM role policy cloud_custodian_processor: MalformedPolicyDocument: Statement IDs (SID) must be alpha-numeric. Check that your input satisfies the regular expression [0-9A-Za-z]*
│ 	status code: 400, request id: 40e20264-1c69-420c-bc26-ce4b6de30af8
│ 
│   with module.lambda-iam.aws_iam_role_policy.processor,
│   on modules/lambda-iam/processor.tf line 6, in resource "aws_iam_role_policy" "processor":
│    6: resource "aws_iam_role_policy" "processor" {
│ 
╵

Move infrastructure into it's own directory

It seems like it may be cleaner to keep the infrastructure / TF file in their own directory