feature/PI-315-update_trigger updated update trigger with ldap bind &…

… added ldap user creds to all environments

infrastructure/terraform/per_account/int/parameters/main.tf

@@ -38,3 +38,19 @@ resource "aws_secretsmanager_secret" "apigee-cpm-apikey" {
 resource "aws_secretsmanager_secret" "apigee-app-key" {
   name = "${terraform.workspace}-apigee-app-key"
 }
+
+resource "aws_secretsmanager_secret" "sds-hscn-endpoint" {
+  name = "${terraform.workspace}-sds-hscn-endpoint"
+}
+
+resource "aws_secretsmanager_secret" "ldap-host" {
+  name = "${terraform.workspace}-ldap-host"
+}
+
+resource "aws_secretsmanager_secret" "ldap-changelog-user" {
+  name = "${terraform.workspace}-ldap-changelog-user"
+}
+
+resource "aws_secretsmanager_secret" "ldap-changelog-password" {
+  name = "${terraform.workspace}-ldap-changelog-password"
+}

infrastructure/terraform/per_account/prod/parameters/main.tf

@@ -38,3 +38,19 @@ resource "aws_secretsmanager_secret" "apigee-cpm-apikey" {
 resource "aws_secretsmanager_secret" "apigee-app-key" {
   name = "${terraform.workspace}-apigee-app-key"
 }
+
+resource "aws_secretsmanager_secret" "sds-hscn-endpoint" {
+  name = "${terraform.workspace}-sds-hscn-endpoint"
+}
+
+resource "aws_secretsmanager_secret" "ldap-host" {
+  name = "${terraform.workspace}-ldap-host"
+}
+
+resource "aws_secretsmanager_secret" "ldap-changelog-user" {
+  name = "${terraform.workspace}-ldap-changelog-user"
+}
+
+resource "aws_secretsmanager_secret" "ldap-changelog-password" {
+  name = "${terraform.workspace}-ldap-changelog-password"
+}

infrastructure/terraform/per_account/qa/parameters/main.tf

@@ -38,3 +38,19 @@ resource "aws_secretsmanager_secret" "apigee-cpm-apikey" {
 resource "aws_secretsmanager_secret" "apigee-app-key" {
   name = "${terraform.workspace}-apigee-app-key"
 }
+
+resource "aws_secretsmanager_secret" "sds-hscn-endpoint" {
+  name = "${terraform.workspace}-sds-hscn-endpoint"
+}
+
+resource "aws_secretsmanager_secret" "ldap-host" {
+  name = "${terraform.workspace}-ldap-host"
+}
+
+resource "aws_secretsmanager_secret" "ldap-changelog-user" {
+  name = "${terraform.workspace}-ldap-changelog-user"
+}
+
+resource "aws_secretsmanager_secret" "ldap-changelog-password" {
+  name = "${terraform.workspace}-ldap-changelog-password"
+}

infrastructure/terraform/per_account/ref/parameters/main.tf

@@ -46,3 +46,11 @@ resource "aws_secretsmanager_secret" "sds-hscn-endpoint" {
 resource "aws_secretsmanager_secret" "ldap-host" {
   name = "${terraform.workspace}-ldap-host"
 }
+
+resource "aws_secretsmanager_secret" "ldap-changelog-user" {
+  name = "${terraform.workspace}-ldap-changelog-user"
+}
+
+resource "aws_secretsmanager_secret" "ldap-changelog-password" {
+  name = "${terraform.workspace}-ldap-changelog-password"
+}

infrastructure/terraform/per_workspace/modules/etl/sds/main.tf

@@ -319,6 +319,12 @@ data "aws_security_groups" "sds-ldap" {
 data "aws_secretsmanager_secret_version" "ldap_host" {
   secret_id = "${var.environment}-ldap-host"
 }
+data "aws_secretsmanager_secret_version" "ldap_changelog_user" {
+  secret_id = "${var.environment}-ldap-changelog-user"
+}
+data "aws_secretsmanager_secret_version" "ldap_changelog_password" {
+  secret_id = "${var.environment}-ldap-changelog-password"
+}
 
 module "trigger_update" {
   source = "./trigger/"
@@ -341,11 +347,13 @@ module "trigger_update" {
     # all compiled dependencies can find each other. Note: this is a hack - and
     # may result in version mismatches between system libs on the lambda. The stable
     # alternative is to run or deploy the service from a container.
-    LD_LIBRARY_PATH   = "/opt/python:/var/lang/lib:/lib64:/usr/lib64:/var/runtime:/var/runtime/lib:/var/task:/var/task/lib:/opt/lib"
-    TRUSTSTORE_BUCKET = var.truststore_bucket.id
-    CPM_FQDN          = "cpm.thirdparty.nhs.uk"
-    LDAP_HOST         = data.aws_secretsmanager_secret_version.ldap_host.secret_string
-    ETL_BUCKET        = module.bucket.s3_bucket_id
+    LD_LIBRARY_PATH         = "/opt/python:/var/lang/lib:/lib64:/usr/lib64:/var/runtime:/var/runtime/lib:/var/task:/var/task/lib:/opt/lib"
+    TRUSTSTORE_BUCKET       = var.truststore_bucket.id
+    CPM_FQDN                = "cpm.thirdparty.nhs.uk"
+    LDAP_HOST               = data.aws_secretsmanager_secret_version.ldap_host.secret_string
+    LDAP_CHANGELOG_USER     = data.aws_secretsmanager_secret_version.ldap_changelog_user.secret_string
+    LDAP_CHANGELOG_PASSWORD = data.aws_secretsmanager_secret_version.ldap_changelog_password.secret_string
+    ETL_BUCKET              = module.bucket.s3_bucket_id
   }
 
   vpc_subnet_ids         = data.aws_subnets.lambda-connectivity-private.ids

src/etl/sds/trigger/update/operations.py

@@ -28,14 +28,19 @@ def get_certs_from_s3_truststore(
 
 
 def prepare_ldap_client(
-    ldap: LdapModuleProtocol, ldap_host: str, cert_file: str, key_file: str
+    ldap: LdapModuleProtocol,
+    ldap_host: str,
+    cert_file: str,
+    key_file: str,
+    ldap_changelog_user: str,
+    ldap_changelog_password: str,
 ) -> LdapClientProtocol:
     ldap_client = ldap.initialize(ldap_host)
     ldap_client.set_option(ldap.OPT_X_TLS_CERTFILE, cert_file)
     ldap_client.set_option(ldap.OPT_X_TLS_KEYFILE, key_file)
     ldap_client.set_option(ldap.OPT_X_TLS_REQUIRE_CERT, ldap.OPT_X_TLS_ALLOW)
     ldap_client.set_option(ldap.OPT_X_TLS_NEWCTX, 0)
-    ldap_client.simple_bind_s()
+    ldap_client.simple_bind_s(ldap_changelog_user, ldap_changelog_password)
     return ldap_client
 
 
@@ -78,8 +83,12 @@ def get_latest_changelog_number_from_ldap(
         filterstr="(objectClass=*)",
         attrlist=["firstchangenumber", "lastchangenumber"],
     )
-    # return record["lastchangenumber"]  <-- think this is what we need to return, but currently empty
-    return 0
+
+    _, (unpack_record) = record
+
+    lastChangeNumber = int(unpack_record["lastchangenumber"][0].decode("utf-8"))
+
+    return lastChangeNumber
 
 
 def get_changelog_entries_from_ldap(

src/etl/sds/trigger/update/steps.py

@@ -53,6 +53,8 @@ def _prepare_ldap_client(data, cache: Cache):
         ldap_host=cache["ldap_host"],
         cert_file=str(cache["cert_file"]),
         key_file=str(cache["key_file"]),
+        ldap_changelog_user=cache["ldap_changelog_user"],
+        ldap_changelog_password=cache["ldap_changelog_password"],
     )
 
 

src/etl/sds/trigger/update/update.py

@@ -17,6 +17,8 @@ class ChangelogTriggerEnvironment(BaseEnvironment):
     CPM_FQDN: str
     LDAP_HOST: str
     ETL_BUCKET: str
+    LDAP_CHANGELOG_USER: str
+    LDAP_CHANGELOG_PASSWORD: str
 
 
 S3_CLIENT = boto3.client("s3")
@@ -34,6 +36,8 @@ class ChangelogTriggerEnvironment(BaseEnvironment):
     "key_file": Path(f"/tmp/{ENVIRONMENT.CPM_FQDN}.key"),
     "etl_bucket": ENVIRONMENT.ETL_BUCKET,
     "ldap_host": ENVIRONMENT.LDAP_HOST,
+    "ldap_changelog_user": ENVIRONMENT.LDAP_CHANGELOG_USER,
+    "ldap_changelog_password": ENVIRONMENT.LDAP_CHANGELOG_PASSWORD,
 }