Combine LZ and DMZ develop branches

.github/workflows/frontend.yml

@@ -59,6 +59,10 @@ jobs:
  run: npm run build
  - name: Test
  run: npm run test
+ - name: Package
+ run: npx sls package
+ env:
+ SLS_DEBUG: '*'
  deploy_staging:
  needs: [lint, test]
  runs-on: ubuntu-latest

.github/workflows/infrastructure.yml

@@ -57,6 +57,7 @@ jobs:
  env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+ AWS_DEFAULT_REGION: us-east-1
 
  - name: Terraform validation
  run: terraform validate
@@ -66,13 +67,15 @@ jobs:
  env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+ AWS_DEFAULT_REGION: us-east-1
 
  - name: Terraform apply
  if: github.ref == 'refs/heads/develop'
  run: terraform apply stage.plan
  env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+ AWS_DEFAULT_REGION: us-east-1
 
  - if: ${{ always() }}
  run: rm stage.plan || true
@@ -96,25 +99,29 @@ jobs:
  env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+ AWS_DEFAULT_REGION: us-east-1
 
  - name: Terraform validation
  run: terraform validate
  env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+ AWS_DEFAULT_REGION: us-east-1
 
  - name: Terraform plan
  run: terraform plan -var-file=prod.tfvars -out prod.plan
  env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+ AWS_DEFAULT_REGION: us-east-1
 
  - name: Terraform apply
  if: github.ref == 'refs/heads/production'
  run: terraform apply prod.plan
  env:
  AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
  AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+ AWS_DEFAULT_REGION: us-east-1
 
  - if: ${{ always() }}
  run: rm prod.plan || true

backend/Dockerfile.worker

@@ -58,8 +58,6 @@ RUN pip3.10 install --upgrade pip
 
 RUN apt remove dav1d && apt autoclean && apt autoremove
 
-# Python dependencies
-
 COPY worker/requirements.txt worker/requirements.txt
 
 RUN pip install -r worker/requirements.txt

backend/env.yml

@@ -1,8 +1,26 @@
 ---
 dev:
  DUMMY:
+ RESOURCE_POLICY:
+ - Effect: Allow
+ Principal: '*'
+ Action: execute-api:Invoke
+ Resource: execute-api:/${self:provider.stage}/*/*
+ ENDPOINT_TYPE: REGIONAL
+ VPC_ENDPOINT: dummy
+ REGION: us-east-1
 
-staging:
+staging-dmz:
+ REGION: us-east-1
+ ENDPOINT_TYPE: REGIONAL
+ RESOURCE_POLICY:
+ - Effect: Allow
+ Principal: '*'
+ Action: execute-api:Invoke
+ Resource: execute-api:/staging/*/*
+ COGNITO_URL: https://cognito-idp.us-east-1.amazonaws.com
+ BACKEND_DOMAIN: https://api.staging-cd.crossfeed.cyber.dhs.gov
+ EMAIL_REGION: us-east-1
  DB_DIALECT: postgres
  DB_PORT: 5432
  DB_HOST: ${ssm:/crossfeed/staging/DATABASE_HOST}
@@ -27,6 +45,7 @@ staging:
  LOGIN_GOV_JWT_KEY: ${ssm:/crossfeed/staging/LOGIN_GOV_JWT_KEY}
  LOGIN_GOV_ISSUER: ${ssm:/crossfeed/staging/LOGIN_GOV_ISSUER}
  DOMAIN: ${ssm:/crossfeed/staging/DOMAIN}
+ CERT_DOMAIN: api.staging-cd.crossfeed.cyber.dhs.gov
  FARGATE_SG_ID: ${ssm:/crossfeed/staging/WORKER_SG_ID}
  FARGATE_SUBNET_ID: ${ssm:/crossfeed/staging/WORKER_SUBNET_ID}
  DMZ_CIDR: ${ssm:/crossfeed/staging/DMZ_CIDR}
@@ -61,7 +80,17 @@ staging:
  REACT_APP_COGNITO_USER_POOL_ID: us-east-1_iWciADuOe
  REACT_APP_COGNITO_CALLBACK_URL: https://staging-cd.crossfeed.cyber.dhs.gov/okta-callback
 
-prod:
+prod-dmz:
+ REGION: us-east-1
+ ENDPOINT_TYPE: REGIONAL
+ RESOURCE_POLICY:
+ - Effect: Allow
+ Principal: '*'
+ Action: execute-api:Invoke
+ Resource: execute-api:/prod/*/*
+ COGNITO_URL: https://cognito-idp.us-east-1.amazonaws.com
+ BACKEND_DOMAIN: https://api.crossfeed.cyber.dhs.gov
+ EMAIL_REGION: us-east-1
  DB_DIALECT: postgres
  DB_PORT: 5432
  DB_HOST: ${ssm:/crossfeed/prod/DATABASE_HOST}
@@ -79,6 +108,7 @@ prod:
  LOGIN_GOV_JWT_KEY: ${ssm:/crossfeed/prod/LOGIN_GOV_JWT_KEY}
  LOGIN_GOV_ISSUER: ${ssm:/crossfeed/prod/LOGIN_GOV_ISSUER}
  DOMAIN: ${ssm:/crossfeed/prod/DOMAIN}
+ CERT_DOMAIN: crossfeed.cyber.dhs.gov
  FARGATE_SG_ID: ${ssm:/crossfeed/prod/WORKER_SG_ID}
  FARGATE_SUBNET_ID: ${ssm:/crossfeed/prod/WORKER_SUBNET_ID}
  FARGATE_MAX_CONCURRENCY: 300
@@ -112,6 +142,123 @@ prod:
  REACT_APP_COGNITO_USER_POOL_ID: us-gov-west-1_L1ZjQdUKA
  REACT_APP_COGNITO_CALLBACK_URL: https://crossfeed.cyber.dhs.gov/okta-callback
 
+staging:
+ REGION: us-gov-east-1
+ ENDPOINT_TYPE: PRIVATE
+ API_GATEWAY_NAME: staging-crossfeed
+ LAMBDA_ROLE: crossfeed-staging-us-gov-east-1-lambdaRole
+ STACK_NAME: crossfeed-staging
+ COGNITO_URL: https://cognito-idp.us-gov-west-1.amazonaws.com
+ BACKEND_DOMAIN: https://api.staging.crossfeed.cyber.dhs.gov
+ EMAIL_REGION: us-gov-west-1
+ DB_DIALECT: postgres
+ DB_PORT: 5432
+ DB_HOST: ${ssm:/crossfeed/staging/DATABASE_HOST}
+ DB_NAME: ${ssm:/crossfeed/staging/DATABASE_NAME}
+ DB_USERNAME: ${ssm:/crossfeed/staging/DATABASE_USER}
+ DB_PASSWORD: ${ssm:/crossfeed/staging/DATABASE_PASSWORD}
+ JWT_SECRET: ${ssm:/crossfeed/staging/APP_JWT_SECRET}
+ LOGIN_GOV_REDIRECT_URI: ${ssm:/crossfeed/staging/LOGIN_GOV_REDIRECT_URI}
+ LOGIN_GOV_BASE_URL: ${ssm:/crossfeed/staging/LOGIN_GOV_BASE_URL}
+ LOGIN_GOV_JWT_KEY: ${ssm:/crossfeed/staging/LOGIN_GOV_JWT_KEY}
+ LOGIN_GOV_ISSUER: ${ssm:/crossfeed/staging/LOGIN_GOV_ISSUER}
+ DOMAIN: ${ssm:/crossfeed/staging/DOMAIN}
+ CERT_DOMAIN: staging.crossfeed.cyber.dhs.gov
+ FARGATE_SG_ID: ${ssm:/crossfeed/staging/WORKER_SG_ID}
+ FARGATE_SUBNET_ID: ${ssm:/crossfeed/staging/WORKER_SUBNET_ID}
+ FARGATE_MAX_CONCURRENCY: 100
+ SCHEDULER_ORGS_PER_SCANTASK: 10
+ FARGATE_CLUSTER_NAME: crossfeed-staging-worker
+ FARGATE_TASK_DEFINITION_NAME: crossfeed-staging-worker
+ FARGATE_LOG_GROUP_NAME: crossfeed-staging-worker
+ CROSSFEED_SUPPORT_EMAIL_SENDER: noreply@staging.crossfeed.cyber.dhs.gov
+ CROSSFEED_SUPPORT_EMAIL_REPLYTO: vulnerability@cisa.dhs.gov
+ FRONTEND_DOMAIN: https://staging.crossfeed.cyber.dhs.gov
+ SLS_LAMBDA_PREFIX: '${self:service}-${self:provider.stage}'
+ USE_COGNITO: 1
+ REACT_APP_USER_POOL_ID: ${ssm:/crossfeed/staging/USER_POOL_ID}
+ REACT_APP_USER_POOL_KEY: ${ssm(raw):/crossfeed/staging/OKTA_USER_POOL_KEY}
+ WORKER_USER_AGENT: ${ssm:/crossfeed/staging/WORKER_USER_AGENT}
+ WORKER_SIGNATURE_PUBLIC_KEY: ${ssm:/crossfeed/staging/WORKER_SIGNATURE_PUBLIC_KEY}
+ ELASTICSEARCH_ENDPOINT: ${ssm:/crossfeed/staging/ELASTICSEARCH_ENDPOINT}
+ REACT_APP_TERMS_VERSION: ${ssm:/crossfeed/staging/REACT_APP_TERMS_VERSION}
+ MATOMO_URL: http://matomo.cfs.lz.us-cert.gov
+ EXPORT_BUCKET_NAME: cisa-crossfeed-staging-exports
+ PE_API_URL: ${ssm:/crossfeed/staging/PE_API_URL}
+ REPORTS_BUCKET_NAME: cisa-crossfeed-staging-reports
+ VPC_ENDPOINT: ${ssm:/crossfeed/staging/BACKEND_VPC_ENDPOINT}
+ CLOUDWATCH_BUCKET_NAME: cisa-crossfeed-staging-cloudwatch
+ STAGE: staging
+ PE_FARGATE_CLUSTER_NAME: pe-staging-worker
+ PE_FARGATE_TASK_DEFINITION_NAME: pe-staging-worker
+ EMAIL_BUCKET_NAME: cisa-crossfeed-staging-html-email
+ REACT_APP_COGNITO_DOMAIN: crossfeed-staging-okta-idp.auth-fips.us-gov-west-1.amazoncognito.com
+ REACT_APP_COGNITO_CLIENT_ID: 3vd67chnkk7dg3jt3nkoidf94e
+ REACT_APP_COGNITO_USER_POOL_ID: us-gov-west-1_N84vh2cq2
+ REACT_APP_COGNITO_CALLBACK_URL: https://staging.crossfeed.cyber.dhs.gov/okta-callback
+ MDL_USERNAME: ${ssm:/crossfeed/staging/MDL_USERNAME}
+ MDL_PASSWORD: ${ssm:/crossfeed/staging/MDL_PASSWORD}
+ MDL_NAME: ${ssm:/crossfeed/staging/MDL_NAME}
+
+prod:
+ REGION: us-gov-east-1
+ ENDPOINT_TYPE: PRIVATE
+ COGNITO_URL: https://cognito-idp.us-gov-west-1.amazonaws.com
+ BACKEND_DOMAIN: https://api.crossfeed.cyber.dhs.gov
+ EMAIL_REGION: us-gov-west-1
+ DB_DIALECT: postgres
+ DB_PORT: 5432
+ DB_HOST: ${ssm:/crossfeed/prod/DATABASE_HOST}
+ DB_NAME: ${ssm:/crossfeed/prod/DATABASE_NAME}
+ DB_USERNAME: ${ssm:/crossfeed/prod/DATABASE_USER}
+ DB_PASSWORD: ${ssm:/crossfeed/prod/DATABASE_PASSWORD}
+ MDL_USERNAME: ${ssm:/crossfeed/prod/MDL_USERNAME}
+ MDL_PASSWORD: ${ssm:/crossfeed/prod/MDL_PASSWORD}
+ MDL_NAME: ${ssm:/crossfeed/prod/MDL_NAME}
+ JWT_SECRET: ${ssm:/crossfeed/prod/APP_JWT_SECRET}
+ LOGIN_GOV_REDIRECT_URI: ${ssm:/crossfeed/prod/LOGIN_GOV_REDIRECT_URI}
+ LOGIN_GOV_BASE_URL: ${ssm:/crossfeed/prod/LOGIN_GOV_BASE_URL}
+ LOGIN_GOV_JWT_KEY: ${ssm:/crossfeed/prod/LOGIN_GOV_JWT_KEY}
+ LOGIN_GOV_ISSUER: ${ssm:/crossfeed/prod/LOGIN_GOV_ISSUER}
+ DOMAIN: ${ssm:/crossfeed/prod/DOMAIN}
+ CERT_DOMAIN: staging.crossfeed.cyber.dhs.gov
+ FARGATE_SG_ID: ${ssm:/crossfeed/prod/WORKER_SG_ID}
+ FARGATE_SUBNET_ID: ${ssm:/crossfeed/prod/WORKER_SUBNET_ID}
+ FARGATE_MAX_CONCURRENCY: 300
+ SCHEDULER_ORGS_PER_SCANTASK: 50
+ FARGATE_CLUSTER_NAME: crossfeed-prod-worker
+ FARGATE_TASK_DEFINITION_NAME: crossfeed-prod-worker
+ FARGATE_LOG_GROUP_NAME: crossfeed-prod-worker
+ CROSSFEED_SUPPORT_EMAIL_SENDER: noreply@crossfeed.cyber.dhs.gov
+ CROSSFEED_SUPPORT_EMAIL_REPLYTO: vulnerability@cisa.dhs.gov
+ FRONTEND_DOMAIN: https://crossfeed.cyber.dhs.gov
+ SLS_LAMBDA_PREFIX: '${self:service}-${self:provider.stage}'
+ USE_COGNITO: 1
+ REACT_APP_USER_POOL_ID: ${ssm:/crossfeed/prod/USER_POOL_ID}
+ REACT_APP_USER_POOL_KEY: ${ssm(raw):/crossfeed/prod/OKTA_USER_POOL_KEY}
+ WORKER_USER_AGENT: ${ssm:/crossfeed/prod/WORKER_USER_AGENT}
+ WORKER_SIGNATURE_PUBLIC_KEY: ${ssm:/crossfeed/prod/WORKER_SIGNATURE_PUBLIC_KEY}
+ ELASTICSEARCH_ENDPOINT: ${ssm:/crossfeed/prod/ELASTICSEARCH_ENDPOINT}
+ REACT_APP_TERMS_VERSION: ${ssm:/crossfeed/prod/REACT_APP_TERMS_VERSION}
+ MATOMO_URL: http://matomo.cfs.lz.us-cert.gov
+ EXPORT_BUCKET_NAME: cisa-crossfeed-prod-exports
+ PE_API_URL: ${ssm:/crossfeed/prod/PE_API_URL}
+ REPORTS_BUCKET_NAME: cisa-crossfeed-prod-reports
+ VPC_ENDPOINT: ${ssm:/crossfeed/prod/BACKEND_VPC_ENDPOINT}
+ CLOUDWATCH_BUCKET_NAME: cisa-crossfeed-prod-cloudwatch
+ STAGE: prod
+ PE_FARGATE_CLUSTER_NAME: pe-prod-worker
+ PE_FARGATE_TASK_DEFINITION_NAME: pe-prod-worker
+ EMAIL_BUCKET_NAME: cisa-crossfeed-prod-html-email
+ REACT_APP_COGNITO_DOMAIN: crossfeed-prod-okta-idp.auth-fips.us-gov-west-1.amazoncognito.com
+ REACT_APP_COGNITO_CLIENT_ID: 1nacnjc6sejbala9uf97eeq9o1
+ REACT_APP_COGNITO_USER_POOL_ID: us-gov-west-1_L1ZjQdUKA
+ REACT_APP_COGNITO_CALLBACK_URL: https://crossfeed.cyber.dhs.gov/okta-callback
+
+
+## added dev option for vpc to remove the warning
+## from 'npx sls package' during backend 'test' github action
+## Warning: Invalid configuration encountered at 'provider.vpc': must be object
 dev-vpc:
  securityGroupIds:
  - dummy
@@ -130,6 +277,22 @@ prod-vpc:
  subnetIds:
  - ${ssm:/crossfeed/prod/SUBNET_ID}
 
+staging-lz-vpc:
+ securityGroupIds:
+ - ${ssm:/crossfeed/staging/SG_ID}
+ subnetIds:
+ - ${ssm:/crossfeed/staging/SUBNET_ID}
+
+prod-lz-vpc:
+ securityGroupIds:
+ - ${ssm:/crossfeed/prod/SG_ID}
+ subnetIds:
+ - ${ssm:/crossfeed/prod/SUBNET_ID}
+
 staging-ecs-cluster: ${ssm:/crossfeed/staging/WORKER_CLUSTER_ARN}
 
 prod-ecs-cluster: ${ssm:/crossfeed/prod/WORKER_CLUSTER_ARN}
+
+staging-lz-ecs-cluster: ${ssm:/crossfeed/staging/WORKER_CLUSTER_ARN}
+
+prod-lz-ecs-cluster: ${ssm:/crossfeed/prod/WORKER_CLUSTER_ARN}