Add DB Ec2 instances access to postgres secrets - #18713

Merged

dave-belton merged 9 commits into

mainfrom

DBA-1282-Oracle-to-PostgreSQL-connectivity-for-ONR

Sep 2, 2026

dave-belton commented Sep 1, 2026

Contributor

No description provided.


          All DB Ec2 instances access to postgres secret

cd4fa03

dave-belton requested review from a team as code owners

September 1, 2026 09:28

github-actions Bot added the environments-repository label

dave-belton deployed to oasys-test

September 1, 2026 09:30

— with

GitHub Actions Active


          Can't use local variable at that point as tf fails with null value

14848d8

Error: Invalid template interpolation value
│
│   on locals_preproduction.tf line 218, in locals:
│  218:               "arn:aws:secretsmanager:*:*:secret:/postgres/database/${local.arns_integration.database_hostname}/*",
│     ├────────────────
│     │ local.arns_integration.database_hostname is null
│
│ The expression result is null. Cannot include a null value in a string
│ template.

modernisation-platform-ci (modernisation-platform-ci) requested changes

View reviewed changes

modernisation-platform-ci (modernisation-platform-ci) left a comment

Contributor

Terraform plan evaluation detected changes to resources that require approval from @ministryofjustice/modernsation-platform - please contact #ask-modernisation-platform for assistance

modernisation-platform-ci (modernisation-platform-ci) commented Sep 1, 2026

Contributor

dave-belton Terraform plan evaluation detected changes to resources that require approval from a member of @ministryofjustice/modernisation-platform - please contact #ask-modernisation-platform for assistance

Guidance on approving these PRs is available at https://user-guide.modernisation-platform.service.justice.gov.uk/runbooks/reviewing-mp-environments-prs.html#process-for-approving-prs

dave-belton and others added 2 commits

September 1, 2026 11:18


          Add access to KMS key to allow decryption of the secret

a732a92


          Merge branch 'main' into DBA-1282-Oracle-to-PostgreSQL-connectivity-f…

a5e920c

…or-ONR

modernisation-platform-ci (modernisation-platform-ci) requested changes

View reviewed changes

modernisation-platform-ci (modernisation-platform-ci) left a comment

Contributor

Terraform plan evaluation detected changes to resources that require approval from @ministryofjustice/modernsation-platform - please contact #ask-modernisation-platform for assistance

modernisation-platform-ci (modernisation-platform-ci) commented Sep 1, 2026

Contributor

dave-belton Terraform plan evaluation detected changes to resources that require approval from a member of @ministryofjustice/modernisation-platform - please contact #ask-modernisation-platform for assistance

Guidance on approving these PRs is available at https://user-guide.modernisation-platform.service.justice.gov.uk/runbooks/reviewing-mp-environments-prs.html#process-for-approving-prs

dave-belton had a problem deploying to oasys-test

September 1, 2026 10:21

— with

GitHub Actions Failure

modernisation-platform-ci (modernisation-platform-ci) requested changes

View reviewed changes

modernisation-platform-ci (modernisation-platform-ci) left a comment

Contributor

Terraform plan evaluation detected changes to resources that require approval from @ministryofjustice/modernsation-platform - please contact #ask-modernisation-platform for assistance

modernisation-platform-ci (modernisation-platform-ci) commented Sep 1, 2026

Contributor

dave-belton Terraform plan evaluation detected changes to resources that require approval from a member of @ministryofjustice/modernisation-platform - please contact #ask-modernisation-platform for assistance

Guidance on approving these PRs is available at https://user-guide.modernisation-platform.service.justice.gov.uk/runbooks/reviewing-mp-environments-prs.html#process-for-approving-prs


          TF fix

c32d565

MalformedPolicyDocument: Resource alias/kms-arns-integration-test must be in ARN format or "*"

modernisation-platform-ci (modernisation-platform-ci) requested changes

View reviewed changes

modernisation-platform-ci (modernisation-platform-ci) left a comment

Contributor

Terraform plan evaluation detected changes to resources that require approval from @ministryofjustice/modernsation-platform - please contact #ask-modernisation-platform for assistance

modernisation-platform-ci (modernisation-platform-ci) commented Sep 1, 2026

Contributor

dave-belton Terraform plan evaluation detected changes to resources that require approval from a member of @ministryofjustice/modernisation-platform - please contact #ask-modernisation-platform for assistance

Guidance on approving these PRs is available at https://user-guide.modernisation-platform.service.justice.gov.uk/runbooks/reviewing-mp-environments-prs.html#process-for-approving-prs

dave-belton deployed to oasys-test

September 1, 2026 10:34

— with

GitHub Actions Active


          Merge branch 'main' into DBA-1282-Oracle-to-PostgreSQL-connectivity-f…

fcce53a

…or-ONR

modernisation-platform-ci (modernisation-platform-ci) previously requested changes

View reviewed changes

modernisation-platform-ci (modernisation-platform-ci) left a comment

Contributor

Terraform plan evaluation detected changes to resources that require approval from @ministryofjustice/modernsation-platform - please contact #ask-modernisation-platform for assistance

modernisation-platform-ci (modernisation-platform-ci) commented Sep 2, 2026

Contributor

dave-belton Terraform plan evaluation detected changes to resources that require approval from a member of @ministryofjustice/modernisation-platform - please contact #ask-modernisation-platform for assistance

Guidance on approving these PRs is available at https://user-guide.modernisation-platform.service.justice.gov.uk/runbooks/reviewing-mp-environments-prs.html#process-for-approving-prs

Steve Williams (sj-williams) previously approved these changes

View reviewed changes

ep-93 reviewed

View reviewed changes

terraform/environments/oasys/locals_preproduction.tf Outdated

+                          actions = [
+                            "kms:Decrypt",
+                          ]
+                          resources = ["*"]

ep-93 Sep 2, 2026

Contributor

Could it be a specific resource to follow the least privilege. If you dont know the key ARN maybe a condition or restrict usage to secrets manager.


          DBA-1282: try to use the KMS resource ARN directly and try to additio…

9900a47

…nally restrict KMS use to requests via Secrets Manager.

dave-belton dismissed Steve Williams (sj-williams)’s stale review via

9900a47

September 2, 2026 10:36

dave-belton added 2 commits

September 2, 2026 11:36


          Merge branch 'main' into DBA-1282-Oracle-to-PostgreSQL-connectivity-f…

6c8dd68

…or-ONR


          DBA-1282: update preprod and prod to use the KMS resource ARN directl…

2741d4d

…y and restrict KMS use to requests via Secrets Manager

following successful change to test env

github-actions Bot commented Sep 2, 2026

Contributor

`Checkov Scan` Success

Show Output

*****************************

Checkov will check the following folders:
terraform/environments/oasys

*****************************

Running Checkov in terraform/environments/oasys
terraform scan results:

Passed checks: 228, Failed checks: 0, Skipped checks: 42


checkov_exitcode=0

`TFLint Scan` Success

Show Output

*****************************

Using default config
Installing "terraform" plugin...
The plugin was signed using a legacy PGP signing key. Please update the plugin to the latest version
Installed "terraform" (source: github.com/terraform-linters/tflint-ruleset-terraform, version: 0.15.0)
tflint checking:
terraform/environments/oasys

*****************************

Running tflint in terraform/environments/oasys
tflint_exitcode=0

ep-93 approved these changes

View reviewed changes

ep-93 dismissed modernisation-platform-ci (modernisation-platform-ci)’s stale review

September 2, 2026 11:47

.

dave-belton merged commit 485d75a into main

33 of 35 checks passed

dave-belton deleted the DBA-1282-Oracle-to-PostgreSQL-connectivity-for-ONR branch

September 2, 2026 12:01

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

environments-repository