feat: implement key rotation module for password management

.github/actions/key-replace/action.yml

@@ -0,0 +1,54 @@
+name: Terraform Key Replace
+description: Build and push Docker image to the registry
+inputs:
+  azure_creds:
+    description: Azure credentials
+    required: true
+  deploy_env:
+    description: The environment to deploy to
+    required: true
+  terraform_arm_client_id:
+    description: Terraform ARM client ID
+    required: true
+  terraform_arm_client_secret:
+    description: Terraform ARM client secret
+    required: true
+  terraform_arm_subscription_id:
+    description: Terraform ARM subscription ID
+    required: true
+  terraform_arm_tenant_id:
+    description: Terraform ARM tenant ID
+    required: true
+  okta_api_token:
+    description: Okta API token
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - uses: azure/login@v1
+      with:
+        creds: ${{ inputs.azure_creds }}
+    - uses: hashicorp/[email protected]
+      with:
+        terraform_version: 1.3.3
+    - name: Terraform Init
+      working-directory: ./ops
+      env: # all Azure interaction is through Terraform
+        ARM_CLIENT_ID: ${{ inputs.terraform_arm_client_id }}
+        ARM_CLIENT_SECRET: ${{ inputs.terraform_arm_client_secret }}
+        ARM_SUBSCRIPTION_ID: ${{ inputs.terraform_arm_subscription_id }}
+        ARM_TENANT_ID: ${{ inputs.terraform_arm_tenant_id }}
+        OKTA_API_TOKEN: ${{ inputs.okta_api_token }}
+      shell: bash
+      run: make init-${{ inputs.deploy_env }}
+    - name: Terraform Key Rotation
+      working-directory: ./ops
+      env: # all Azure interaction is through Terraform
+        ARM_CLIENT_ID: ${{ inputs.terraform_arm_client_id }}
+        ARM_CLIENT_SECRET: ${{ inputs.terraform_arm_client_secret }}
+        ARM_SUBSCRIPTION_ID: ${{ inputs.terraform_arm_subscription_id }}
+        ARM_TENANT_ID: ${{ inputs.terraform_arm_tenant_id }}
+        OKTA_API_TOKEN: ${{ inputs.okta_api_token }}
+      shell: bash
+      run: terraform -chdir=${{ inputs.deploy_env }}/persistent apply -auto-approve -lock-timeout=30m -replace="module.keys.random_password.db_administrator_password" -target="module.keys.random_password.db_administrator_password"

.github/workflows/deployDev.yml

@@ -18,6 +18,14 @@ on:
           - dev6
           - dev7
           - pentest
+      replace_keys:
+        description: 'Replace keys'
+        required: true
+        default: "false"
+        type: choice
+        options:
+          - "false"
+          - "true"
 
 env:
   NODE_VERSION: 18
@@ -54,11 +62,22 @@ jobs:
           okta_url: https://hhs-prime.oktapreview.com
           okta_client_id: ${{ vars.OKTA_CLIENT_ID }}
 
-  prerelease_backend:
+  prerelease:
     runs-on: ubuntu-latest
     needs: [build_frontend, build_docker]
     steps:
       - uses: actions/checkout@v4
+      - uses: ./.github/actions/key-replace
+        name: Replace keys
+        if: inputs.replace_keys == 'true'
+        with:
+          azure_creds: ${{ secrets.AZURE_CREDENTIALS }}
+          deploy_env: ${{ inputs.deploy_env }}
+          terraform_arm_client_id: ${{ secrets.TERRAFORM_ARM_CLIENT_ID }}
+          terraform_arm_client_secret: ${{ secrets.TERRAFORM_ARM_CLIENT_SECRET }}
+          terraform_arm_subscription_id: ${{ secrets.TERRAFORM_ARM_SUBSCRIPTION_ID }}
+          terraform_arm_tenant_id: ${{ secrets.TERRAFORM_ARM_TENANT_ID }}
+          okta_api_token: ${{ secrets.OKTA_API_TOKEN_NONPROD }}
       - uses: ./.github/actions/tf-deploy
         name: Deploy with Terraform
         with:
@@ -85,7 +104,7 @@ jobs:
     environment:
       name: ${{ inputs.deploy_env }}
       url: https://${{ inputs.deploy_env }}.simplereport.gov
-    needs: [prerelease_backend]
+    needs: [prerelease]
     steps:
       - uses: actions/checkout@v4
       - name: Promote and deploy

ops/demo/main.tf

@@ -8,6 +8,20 @@ locals {
     environment    = local.env
     resource_group = "${local.project}-${local.name}-${local.env}"
   }
+  cdc_tags = {
+    business_steward    = "[email protected]"
+    center              = "DDPHSS"
+    environment         = local.env
+    escid               = "3205"
+    funding_source      = "TBD"
+    pii_data            = "false"
+    security_compliance = "moderate"
+    security_steward    = "[email protected],[email protected],[email protected],[email protected]"
+    support_group       = "OMHS"
+    system              = "prim"
+    technical_steward   = "[email protected],[email protected],[email protected],[email protected]"
+    zone                = "EXTRANET"
+  }
 }
 
 # Frontend React App

ops/demo/persistent/main.tf

@@ -13,6 +13,20 @@ locals {
     environment    = local.env
     resource_group = "${local.project}-${local.name}-${local.env}"
   }
+  cdc_tags = {
+    business_steward    = "[email protected]"
+    center              = "DDPHSS"
+    environment         = local.env
+    escid               = "3205"
+    funding_source      = "TBD"
+    pii_data            = "false"
+    security_compliance = "moderate"
+    security_steward    = "[email protected],[email protected],[email protected],[email protected]"
+    support_group       = "OMHS"
+    system              = "prim"
+    technical_steward   = "[email protected],[email protected],[email protected],[email protected]"
+    zone                = "EXTRANET"
+  }
 }
 
 module "monitoring" {
@@ -34,10 +48,8 @@ resource "random_password" "random_nophi_password" {
   override_special = "!#$%&*()-_=+[]{}<>:?"
 }
 
-resource "random_password" "administrator_password" {
-  length           = 30
-  special          = false
-  override_special = "!#$%&*()-_=+[]{}<>:?"
+module "keys" {
+  source = "../../services/keys"
 }
 
 module "db" {
@@ -53,7 +65,7 @@ module "db" {
   log_workspace_id    = module.monitoring.log_analytics_workspace_id
   private_dns_zone_id = module.vnet.private_dns_zone_id
 
-  administrator_password = random_password.administrator_password.result
+  administrator_password = module.keys.db_administrator_password
   nophi_user_password    = random_password.random_nophi_password.result
 
   tags = local.management_tags
@@ -67,6 +79,7 @@ module "db_alerting" {
   action_group_ids = [
     data.terraform_remote_state.global.outputs.pagerduty_non_prod_action_id
   ]
+  cdc_tags = local.cdc_tags
 }
 
 module "vnet" {

ops/dev/main.tf

@@ -8,11 +8,10 @@ locals {
     environment    = local.env
     resource_group = "${local.project}-${local.name}-${local.env}"
   }
-  # a list of tags that the cdc requires
   cdc_tags = {
     business_steward    = "[email protected]"
     center              = "DDPHSS"
-    environment         = "dev"
+    environment         = local.env
     escid               = "3205"
     funding_source      = "TBD"
     pii_data            = "false"

ops/dev/persistent/main.tf

@@ -12,11 +12,10 @@ locals {
     environment    = local.env
     resource_group = "${local.project}-${local.name}-${local.env_level}"
   }
-  # a list of tags that the cdc requires
   cdc_tags = {
     business_steward    = "[email protected]"
     center              = "DDPHSS"
-    environment         = "dev"
+    environment         = local.env
     escid               = "3205"
     funding_source      = "TBD"
     pii_data            = "false"
@@ -47,9 +46,8 @@ resource "random_password" "random_nophi_password" {
   override_special = "!#$%&*()-_=+[]{}<>:?"
 }
 
-resource "random_password" "administrator_password" {
-  length  = 30
-  special = true
+module "keys" {
+  source = "../../services/keys"
 }
 
 module "db" {
@@ -65,7 +63,7 @@ module "db" {
   log_workspace_id    = module.monitoring.log_analytics_workspace_id
   private_dns_zone_id = module.vnet.private_dns_zone_id
 
-  administrator_password = random_password.administrator_password.result
+  administrator_password = module.keys.db_administrator_password
   nophi_user_password    = random_password.random_nophi_password.result
 
   tags = local.management_tags

ops/dev2/main.tf

@@ -10,6 +10,20 @@ locals {
     # environments should use the "local.env_level" convention where possible.
     resource_group = "${local.project}-${local.name}-${local.env_level}"
   }
+  cdc_tags = {
+    business_steward    = "[email protected]"
+    center              = "DDPHSS"
+    environment         = local.env
+    escid               = "3205"
+    funding_source      = "TBD"
+    pii_data            = "false"
+    security_compliance = "moderate"
+    security_steward    = "[email protected],[email protected],[email protected],[email protected]"
+    support_group       = "OMHS"
+    system              = "prim"
+    technical_steward   = "[email protected],[email protected],[email protected],[email protected]"
+    zone                = "EXTRANET"
+  }
 }
 
 # Frontend React App

ops/dev2/metabase.tf

@@ -34,4 +34,5 @@ module "metabase_service" {
   depends_on = [
     module.metabase_database
   ]
+  cdc_tags = local.cdc_tags
 }

ops/dev2/persistent/main.tf

@@ -14,6 +14,20 @@ locals {
     # environments should use the "local.env_level" convention where possible.
     resource_group = "${local.project}-${local.name}-${local.env_level}"
   }
+  cdc_tags = {
+    business_steward    = "[email protected]"
+    center              = "DDPHSS"
+    environment         = local.env
+    escid               = "3205"
+    funding_source      = "TBD"
+    pii_data            = "false"
+    security_compliance = "moderate"
+    security_steward    = "[email protected],[email protected],[email protected],[email protected]"
+    support_group       = "OMHS"
+    system              = "prim"
+    technical_steward   = "[email protected],[email protected],[email protected],[email protected]"
+    zone                = "EXTRANET"
+  }
 }
 
 module "monitoring" {
@@ -34,10 +48,8 @@ resource "random_password" "random_nophi_password" {
   override_special = "!#$%&*()-_=+[]{}<>:?"
 }
 
-resource "random_password" "administrator_password" {
-  length           = 30
-  special          = false
-  override_special = "!#$%&*()-_=+[]{}<>:?"
+module "keys" {
+  source = "../../services/keys"
 }
 
 module "db" {
@@ -53,7 +65,7 @@ module "db" {
   log_workspace_id    = module.monitoring.log_analytics_workspace_id
   private_dns_zone_id = module.vnet.private_dns_zone_id
 
-  administrator_password = random_password.administrator_password.result
+  administrator_password = module.keys.db_administrator_password
   nophi_user_password    = random_password.random_nophi_password.result
 
   tags = local.management_tags
@@ -67,6 +79,7 @@ module "db_alerting" {
   action_group_ids = [
     data.terraform_remote_state.global.outputs.pagerduty_non_prod_action_id
   ]
+  cdc_tags = local.cdc_tags
 }
 
 module "vnet" {

ops/dev3/main.tf

@@ -10,6 +10,20 @@ locals {
     # environments should use the "local.env_level" convention where possible.
     resource_group = "${local.project}-${local.name}-${local.env_level}"
   }
+  cdc_tags = {
+    business_steward    = "[email protected]"
+    center              = "DDPHSS"
+    environment         = local.env
+    escid               = "3205"
+    funding_source      = "TBD"
+    pii_data            = "false"
+    security_compliance = "moderate"
+    security_steward    = "[email protected],[email protected],[email protected],[email protected]"
+    support_group       = "OMHS"
+    system              = "prim"
+    technical_steward   = "[email protected],[email protected],[email protected],[email protected]"
+    zone                = "EXTRANET"
+  }
 }
 
 # Frontend React App

ops/dev3/metabase.tf

@@ -34,4 +34,5 @@ module "metabase_service" {
   depends_on = [
     module.metabase_database
   ]
+  cdc_tags = local.cdc_tags
 }