Add datetime to tagging

NHSDigital · Oct 11, 2023 · cf04aaf · cf04aaf
1 parent b7e9e20
commit cf04aaf
Show file tree

Hide file tree

Showing 14 changed files with 45 additions and 160 deletions.
diff --git a/infrastructure/localstack/provider.tf b/infrastructure/localstack/provider.tf
@@ -37,13 +37,14 @@ provider "aws" {
   default_tags {
     tags = {
       Environment      = var.environment
-      Created          = local.created
+      LastUpdate       = var.updated_date
       Workspace        = replace(terraform.workspace, "_", "-")
       Project          = local.project
       Name             = "${local.project}--${replace(terraform.workspace, "_", "-")}"
       Owner            = "NHSE"
       ProjectShortName = "CPM"
       ProjectFullname  = "Connecting Party Manager"
+      Expiration       = var.expiration_date
     }
   }
 }
diff --git a/infrastructure/terraform/per_account/main.tf b/infrastructure/terraform/per_account/main.tf
@@ -1,17 +0,0 @@
-resource "aws_resourcegroups_group" "test" {
-  name = "workspace-resource-group"
-
-  resource_query {
-    query = <<JSON
-{
-  "ResourceTypeFilters": [],
-  "TagFilters": [
-    {
-      "Key": "Workspace",
-      "Values": ["Test"]
-    }
-  ]
-}
-JSON
-  }
-}

diff --git a/infrastructure/terraform/per_workspace/locals.tf b/infrastructure/terraform/per_workspace/locals.tf
@@ -1,5 +1,5 @@
 locals {
-  region  = "eu-west-2"
-  project = "nhse-cpm"
-  created = timestamp()
+  region       = "eu-west-2"
+  project      = "nhse-cpm"
+  current_time = timestamp()
 }
diff --git a/infrastructure/terraform/per_workspace/main.tf b/infrastructure/terraform/per_workspace/main.tf
@@ -1,8 +1,12 @@
 resource "aws_resourcegroups_group" "resource_group" {
   name = "${local.project}--${replace(terraform.workspace, "_", "-")}--resource-group"
   tags = {
-    Name    = "${local.project}--${replace(terraform.workspace, "_", "-")}--resource-group"
-    Created = local.created
+    Name      = "${local.project}--${replace(terraform.workspace, "_", "-")}--resource-group"
+    CreatedOn = local.current_time
+  }
+
+  lifecycle {
+    ignore_changes = [tags["CreatedOn"]]
   }
 
   resource_query {
@@ -38,7 +42,6 @@ module "products_table" {
   ]
   deletion_protection_enabled = var.deletion_protection_enabled
   kms_deletion_window_in_days = 7
-  created                     = local.created
 }
 
 # module "api_worker_create" {

diff --git a/infrastructure/terraform/per_workspace/modules/api_storage/dynamodb.tf b/infrastructure/terraform/per_workspace/modules/api_storage/dynamodb.tf
@@ -18,8 +18,7 @@ module "dynamodb_table" {
   point_in_time_recovery_enabled = true
 
   tags = {
-    Name    = var.name
-    Created = var.created
+    Name = var.name
   }
 
 }
diff --git a/infrastructure/terraform/per_workspace/modules/api_storage/iam.tf b/infrastructure/terraform/per_workspace/modules/api_storage/iam.tf
@@ -7,8 +7,7 @@ module "iam_policy_read" {
   description = "Read the ${var.name} table"
 
   tags = {
-    Name    = "${var.name}--iam-policy-read"
-    Created = var.created
+    Name = "${var.name}--iam-policy-read"
   }
 
   policy = jsonencode({
@@ -48,11 +47,9 @@ module "iam_policy_write" {
   description = "Write to the ${var.name} table"
 
   tags = {
-    Name    = "${var.name}--iam-policy-write"
-    Created = var.created
+    Name = "${var.name}--iam-policy-write"
   }
 
-
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [

diff --git a/infrastructure/terraform/per_workspace/modules/api_storage/kms.tf b/infrastructure/terraform/per_workspace/modules/api_storage/kms.tf
@@ -8,8 +8,7 @@ module "kms" {
   aliases = [var.name]
 
   tags = {
-    Name    = "${var.name}--kms"
-    Created = var.created
+    Name = "${var.name}--kms"
   }
 
 }
diff --git a/infrastructure/terraform/per_workspace/modules/api_storage/vars.tf b/infrastructure/terraform/per_workspace/modules/api_storage/vars.tf
@@ -20,5 +20,3 @@ variable "deletion_protection_enabled" {
 }
 
 variable "kms_deletion_window_in_days" {}
-
-variable "created" {}
diff --git a/infrastructure/terraform/per_workspace/provider.tf b/infrastructure/terraform/per_workspace/provider.tf
@@ -8,13 +8,14 @@ provider "aws" {
   default_tags {
     tags = {
       Environment      = var.environment
-      Created          = local.created
+      LastUpdated      = var.updated_date
       Workspace        = replace(terraform.workspace, "_", "-")
       Project          = local.project
       Name             = "${local.project}--${replace(terraform.workspace, "_", "-")}"
       Owner            = "NHSE"
       ProjectShortName = "CPM"
       ProjectFullname  = "Connecting Party Manager"
+      ExpirationDate   = var.expiration_date
     }
   }
 }
diff --git a/infrastructure/terraform/per_workspace/vars.tf b/infrastructure/terraform/per_workspace/vars.tf
@@ -14,3 +14,11 @@ variable "deletion_protection_enabled" {
   type    = bool
   default = false
 }
+
+variable "expiration_date" {
+  default = "NEVER"
+}
+
+variable "updated_date" {
+  default = "NEVER"
+}
diff --git a/scripts/infrastructure/terraform.mk b/scripts/infrastructure/terraform.mk
@@ -41,15 +41,3 @@ initialise--non-mgmt: aws--login ## Bootstrap the Non-MGMT AWS environments. Mus
 
 destroy--non-mgmt: aws--login ## Destroy the Non-MGMT AWS environments. Must provide TERRAFORM_ROLE_NAME keyword argument.
 	@ AWS_ACCESS_KEY_ID=$(AWS_ACCESS_KEY_ID) AWS_SECRET_ACCESS_KEY=$(AWS_SECRET_ACCESS_KEY) AWS_SESSION_TOKEN=$(AWS_SESSION_TOKEN) bash $(PATH_TO_INFRASTRUCTURE)/destroy-non-mgmt-resources.sh $(TERRAFORM_ROLE_NAME)
-
-terraform--ci-init: ## Run terraform init in the CI
-	@ AWS_ACCESS_KEY_ID=$(AWS_ACCESS_KEY_ID) AWS_SECRET_ACCESS_KEY=$(AWS_SECRET_ACCESS_KEY) AWS_SESSION_TOKEN=$(AWS_SESSION_TOKEN) PROJECT_PREFIX=$(PROJECT_PREFIX) bash $(PATH_TO_INFRASTRUCTURE)/terraform/terraform-ci-commands.sh ci-init $(TERRAFORM_ENVIRONMENT) $(TERRAFORM_ACCOUNT_WIDE) $(TERRAFORM_ARGS)
-
-terraform--ci-plan: ## Run terraform plan in the CI
-	@ AWS_ACCESS_KEY_ID=$(AWS_ACCESS_KEY_ID) AWS_SECRET_ACCESS_KEY=$(AWS_SECRET_ACCESS_KEY) AWS_SESSION_TOKEN=$(AWS_SESSION_TOKEN) PROJECT_PREFIX=$(PROJECT_PREFIX) bash $(PATH_TO_INFRASTRUCTURE)/terraform/terraform-ci-commands.sh ci-plan $(TERRAFORM_ENVIRONMENT) $(TERRAFORM_ACCOUNT_WIDE) $(TERRAFORM_ARGS)
-
-terraform--ci-apply: ## Run terraform apply in the CI
-	@ AWS_ACCESS_KEY_ID=$(AWS_ACCESS_KEY_ID) AWS_SECRET_ACCESS_KEY=$(AWS_SECRET_ACCESS_KEY) AWS_SESSION_TOKEN=$(AWS_SESSION_TOKEN) PROJECT_PREFIX=$(PROJECT_PREFIX) bash $(PATH_TO_INFRASTRUCTURE)/terraform/terraform-ci-commands.sh ci-apply $(TERRAFORM_ENVIRONMENT) $(TERRAFORM_ACCOUNT_WIDE) $(TERRAFORM_ARGS)
-
-terraform--ci-destroy: ## Run terraform destroy in the CI
-	@ AWS_ACCESS_KEY_ID=$(AWS_ACCESS_KEY_ID) AWS_SECRET_ACCESS_KEY=$(AWS_SECRET_ACCESS_KEY) AWS_SESSION_TOKEN=$(AWS_SESSION_TOKEN) PROJECT_PREFIX=$(PROJECT_PREFIX) bash $(PATH_TO_INFRASTRUCTURE)/terraform/terraform-ci-commands.sh ci-destroy $(TERRAFORM_ENVIRONMENT) $(TERRAFORM_ACCOUNT_WIDE) $(TERRAFORM_ARGS)
diff --git a/scripts/infrastructure/terraform/terraform-ci-commands.sh b/scripts/infrastructure/terraform/terraform-ci-commands.sh
diff --git a/scripts/infrastructure/terraform/terraform-commands.sh b/scripts/infrastructure/terraform/terraform-commands.sh
@@ -14,13 +14,15 @@ function _terraform() {
     local env
     local aws_account_id
     local var_file
-    local current_timestamp
+    local current_date
     local terraform_dir
+    local expiration_time
     env=$(_get_environment_name $TERRAFORM_ENVIRONMENT)
     aws_account_id=$(_get_aws_account_id "$env")
     var_file=$(_get_environment_vars_file "$env")
     terraform_dir=$(_get_terraform_dir "$env" "$TERRAFORM_ACCOUNT_WIDE")
-    current_timestamp="$(date '+%Y_%m_%d__%H_%M_%S')"
+    expiration_date=$(_get_expiration_date)
+    current_date=$(_get_current_date)
     local plan_file="./tfplan"
     # local ci_log_bucket="${PROFILE_PREFIX}--mgmt--github-ci-logging"
 
@@ -94,13 +96,16 @@ function _terraform_plan() {
     local aws_account_id=$4
     local args=${@:5}
 
+
     terraform init || return 1
     terraform workspace select "$env" || terraform workspace new "$env" || return 1
     terraform plan \
         -out="$plan_file" \
         -var-file="$var_file" \
         -var "assume_account=${aws_account_id}" \
-        -var "assume_role=${TERRAFORM_ROLE_NAME}" || return 1
+        -var "assume_role=${TERRAFORM_ROLE_NAME}" \
+        -var "updated_date=${current_date}" \
+        -var "expiration_date=${expiration_date}" || return 1
 }
 
 function _terraform_apply() {

diff --git a/scripts/infrastructure/terraform/terraform-utils.sh b/scripts/infrastructure/terraform/terraform-utils.sh
@@ -72,3 +72,15 @@ function _get_terraform_dir() {
     echo "${dir}/infrastructure/terraform/per_workspace"
   fi
 }
+
+function _get_current_date() {
+    #local timestamp=$(date -d '+72 hours' -u +"%Y-%m-%dT%H:%M:%SZ")
+    local timestamp=$(python -c "from datetime import datetime, timedelta, timezone; print(format(datetime.now(timezone.utc), '%Y-%m-%dT%H:%M:%SZ'))")
+    echo "${timestamp}"
+}
+
+function _get_expiration_date() {
+    #local timestamp=$(date -d '+72 hours' -u +"%Y-%m-%dT%H:%M:%SZ")
+    local timestamp=$(python -c "from datetime import datetime, timedelta, timezone; print(format(datetime.now(timezone.utc) + timedelta(hours=72), '%Y-%m-%dT%H:%M:%SZ'))")
+    echo "${timestamp}"
+}