Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 7 additions & 7 deletions ops/services/10-config/values/prod.sopsw.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -115,9 +115,9 @@
/ab2d/${env}/db/okta_client_password: ENC[AES256_GCM,data:4I7AQ3TVey7NWQo+LXSd00l5mWwquz15oS3V2pBn2FBeN1/a5M0/Eg==,iv:m3nAVFJBEXsmVMawZBLneZ8aPcs0Nt2q0cpXCQ2Dy5E=,tag:avn2pZ9No8MXzxPEdbSdAA==,type:str]
/ab2d/${env}/db/analyst_database_user: ENC[AES256_GCM,data:JG/JiPkKmblTAEs7,iv:dyYZPi6LB8eY0FmgQQmTAqqEBMurfnB6wniLiOIjuR8=,tag:ELGw9CEj3aVle3cmsSPEZg==,type:str]
/ab2d/${env}/db/analyst_database_password: ENC[AES256_GCM,data:durX20nFleVd1llp7fJ9ErhMuigmVW0b,iv:7hFlHHi7BuWvFzYrC/kxfxq8JSaTi81Vhs84l+9r8LM=,tag:zlz7SSFXnS3XwyPR6ZMxIA==,type:str]
/ab2d/${env}/core/sensitive/idr_service_id_name: ENC[AES256_GCM,data:E0jXiiSiwbmPiXmrqQK031o=,iv:kvYbZud/WrPgYjAHXdb3YoGmspBJNB3DYk3BAGLBqws=,tag:HshYUpVOfiPKnNm4juvCIg==,type:str]
/ab2d/${env}/core/sensitive/idr_role_name: ENC[AES256_GCM,data:rIDGsEzSQE2mMraWO5ogN0Y=,iv:90CXd/kfui7Xv1hSL51XGPk5hQ3X2O6r3mLgTjRMRUU=,tag:W6oTEdQqLynt17ZtQu/iJQ==,type:str]
/ab2d/${env}/core/sensitive/idr_warehouse_name: ENC[AES256_GCM,data:EZNcZbTFU4DwG9ucwDushA==,iv:faafJesK/34WMLs77i/1Dge1J7xMihm245DmmALS3+E=,tag:9ZZOTG3G9tNfb7TsQsbyjQ==,type:str]
/ab2d/${env}/idr-db-importer/sensitive/snowflake_user: ENC[AES256_GCM,data:A/Mc1iFNCtf9y0FhlZYxANs=,iv:1C/wQmqVdHiTLbZDUrMv7VWHXUj92NwhGzqF1qqpg2Q=,tag:1qmjvKD6xl2ucBr/SLb8tQ==,type:str]
/ab2d/${env}/idr-db-importer/sensitive/snowflake_role: ENC[AES256_GCM,data:dZAzpeZdmZWtSEBVK59LE5c=,iv:IWWK2drSykxQZRlKhGrqetTzzY1QggMa7o7lPEywGmk=,tag:t7jl+l7oPAfQfPqJcgaH7A==,type:str]
/ab2d/${env}/idr-db-importer/sensitive/snowflake_warehouse: ENC[AES256_GCM,data:rmNl3vevbRslCdhnVaQmsw==,iv:pFPJ1vDM4+xpFdI3Ygrr5rvlYBIa1qWSlygMkzgZZ4E=,tag:K9Hy0RqP1pzIzvnTNzZWXg==,type:str]
/ab2d/${env}/core/sensitive/idr_service_pwd: ENC[AES256_GCM,data:3VrkanXryb2Br1/wk8eO4R0=,iv:xOSkk75N4QYnNLGML/EmJkQBfLV6UTwYFE49GhwW9wI=,tag:ltowS0VEo3aEnOwR2yNfQQ==,type:str]
/ab2d/${env}/web/sensitive/tls_private_key: ENC[AES256_GCM,data:eJ60YH+sGqQ6J4kD0aRfpEQDHrvCQK9PT0OsY0c4zvZWnolbJ/WusAFt7XqzeBx3cAY8dV6Gb6YbwmLn/DBADI5sNV0K/agdRrBZraKkyuhr9sHqQ967wNCVgbqSpjqMtTtauX4ldJO6cOFvPWf5uFCKyZsfTRLP7YaNIeKU3c7p5/g41QqiC5lV3eeu5TvkQiI9qxFiX3pqq1kZ3cB5/K0UAfE8PeE7ocaILkLNr0Te7ozQL39BP8wQiVoJ9kpZ5EyUw3PWNxwXT0SkLozTxrKq5cZ+cIn3jW7VMsn4UKUTamrrrBF5/IJ3MPfwhViSuwFL7jS0wfkolucCxeSajy23MloMBXm34JAJGhZUc6kswp92HbHuHy3bOBz5WQl0dTbChKlSnQz895KXzejAw/e45kPetkaG7Ofu/ZqtvWGyq/THUnbc9GoeOmA5N1lyq3YHCr8DTLnB4vpoz1FMhtqB17zR4ZQeXNzO9Mkv8XfXXwHvINjWaAbXASQGaW0JG8ytg2SnG8rMxc+MnbTzresKDvoBgOdZfIeexqAklq60p3e7HEAnR3C9GFbKNcgSIZdxfr0MAN+QEPNdUQ68qV/Rl3eg84aAyjAditvYN4qrD3MBpLVl70orsCYOQVrSe3UiqpxjDSkb/+dYiiERdYNiIXxba001n4hjICrqhK8xTUPeUaQQvY/nnX4fgf1bdUk8kRYObkBeV2yd6G+spBykMn85JVx3R+pigdGezuxEIaCUTy1HpqSxSGT/PnpWMeFq1Yp9DdzM9DL14wXXj2a7kOYPkDQagpZeKe7P1eMQQ7aq3pBdXU3+pNfkGf5TL0RsxDeBQSLWi7FOcu8to4067D6T90+2WQRdcwKioy4BRyhsItKRyp6cE+W8TlMTkdqJ9pmibfcej4Oe4DeJiYrdDB+U3DyNaSZYBaiJzxquQG9DABOc53N6/f4LZEj2veH58o8KwWkOxUtsWsK/lk9harkfLY8siZ5S5y8CDzFJZqTf3mQCq9iys+g45aHhR3arqIqe8r6ze43tEj0sjg3fqxaQuLbQ1CT0pFELlmO9v85dA9JMz/xsL3EcGRQdLNtOxCmfUBPTstLvh415UpMqnOSa52aNx0j4G4hf1kmNBuUHUMB4iSfE4RBPX3yJ4+VImixarkTa0Y7X1oF4E6YTkt8t3hGgmhM+6+L17ziHlM3uSO/0vR4k+Z5ZKIWXLTfiFfAqVq0wMslKgnrB196n7+UZE7Qi+oahXMRrnUTXmI8KQpC2CXvhQYcJ0ZYAhUIIAHPR4lGKnkJWBYzA4jxlrbmYvElGzDYMegKOmxZ3tDt3TqbBS8dAlMVqO17uAgXyAkGQYgbOiW+Nx2Fr9iAXNAJ0ACkXWCbgqX+woizyoz8z6CJr1Lv7F4GRuBtPQUKNaUWgEtDbI/O0zAYABFF71OG+6+SBzsjM8nmCKw6LPxfr0yZvEWo7Xj6D8geB0bp8/gyv5+jxfaIyrR1j06DYXnafEiRoWqHwGPXp+/QiFotn/K6V9FxnLz2FIz4KID0eq5zTZCd3qCtcslKtynQQ+WNuBYeJh0gtqEhgCgQyqqpKtB305rKqUEs61zslBQf3qUs1RuJ2HCz/BhXBDIibZfts6wX76RyHgS6QyHq84ecZ4XZR29Gk4P5S7nKQMNLL3bk/KXbEF9XPdxSqdx2o+iyzJwyINp1Fk4U0s0dw7eJdPu5jX1Lj3LxQOPMWu7r6YexFLykwBR8R4//D0m11P6u7HldQSXwyjUTYxuqQ91rnZXacErLLK2y8bZDuIS7h1IsJiGsYcN33tZMZ2F2c5pFFQFJu9ig7MiaFbPTGpM9v7Olr3IPJQ3RgdogfNc1p6KHXPe+jD7gGpn8NC1YfrwibtiBuH7m3y7bIIhAqHcb1JHcirXZCMaitwZocRWflqENhWx8S4KjSxklRBeWsVA8gjzmZPHKbBFnjtxSNnmMZHsLiQKD796pWJuRrQnXtnD7AwR0kmtELOnUqhTEySXiKH2KnA4ekKo1GVE5kD2rmhorfXsx+QfBuo2LvZAhKA4bJPzlhS89Rw1Gvi9LZGVMoU0npFD6KMYLy9HiwyzwO/gsiPRiDRPLOdq/MYUADNrdlyyOQ1CvvKf36iR0R23inCcglw7Ag4Je/tmOH4sixL/XdFbkt0qrp1L1KzVWx5jPIPYyRPLnnzrgqtfxfC5bTFjt62bhDj3tR1eG/QWqMNBuBFcYx3x+hcTPHdLxtbOt4L9w9kohTt20q8cMw2ZcQRcmX,iv:79N5/LELqXZuIU1T4wza3YAA9xS1uYTghZ4h8g1Cvzc=,tag:Fnj8xbXfyl54ycRL0F5c1w==,type:str]
/ab2d/${env}/web/nonsensitive/tls_chain: |
Expand Down Expand Up @@ -310,20 +310,20 @@
7/qxXDgGpRtK4dw4LTzcqx+QGtVKnO7RcGzM7vRX+Bi6hG6H
-----END CERTIFICATE-----
/ab2d/${env}/api/sensitive/tls_private_key: ENC[AES256_GCM,data:uuAiVW36y8uA5ENFcXumfbQD1fsgbnfABhVb8JHFJrh8iI80b7LNbMpxx4y3g10PNQGyWOyccD3KGo6Ztcv2WlchNjzu+4YOoe3qg3cmGsrmJh5sds9YL+gXYM1Nb2M5et8kYjhoMFywxrj3pQcqno8cnHU6/YkrqbBu2t0qJjoGABWe/1Cgb+SeqhNoV4JRAl050RUqgQD6YT3pshKJuP5KMULfipIQkLUsIQihpa/miCVDpbb4NS+fHz3PBL81m9N5dGhlbMIyboPHEwt+v/TNi0DZesrWqESX7hH4ifx4xVFFpEC8YV95Mhr/6HU+bt29kAy9GkcJmUK6hRUAi4oZjPvFWQhSb1joHcw2HdqIAUiYCc0MmIr+cbGLe+MmxR9KXrK8wjymmgfzWlaUulkPj6fCc+8Y+DW7vr0+dFPmFj134PiRiP3i4IAP0DBDOP0g1owdISiwz/K219K5XWxM9nCMF50HYe9hOuL2Ch8b4zh3mlQr14AIzKEjNWFjHRXyEWqBONEXDKrakbtX9PrhL2hiPRXG2N85QZjK73uU1ZXH8YKpThDCyfU+7myX70YTNKhBjZuPwPp0SyJhVhCtcma9fveuHUi5hgr86B4Smtx0bI4duUyDeYl5Byr3HDQJa/PJ9FPfFiwE+vGd4AibqvaxfImvLQbDdxURcxgWpDgPf4Yr7lCAO/30+w/hliQKih7FnyEY3ZsV9PrkYbVzhgByMAiiqsfNWFj1KNrDr6aVGhgXn1hd9fbkHz9vLo0E0sN42brumIH/FTEiUF8e/PfizKNyW1eFcWeC0bi0VTR4BcSbpYy4d21pzhcbqfEsGMoK8qeMhZ3gZMbS4lbr77pLtPSBwU9KBzTcxZ1PhhUovvSA6fbFvkvbTfQixuXpaSfYANFR00LHOh21AmWkFv8gMI9ooJfqz8MBoMA5vEqP1paywnGQpB/7DY20DjijtNLdFBpLWTDXk4kyca4EGAO1DjEKJbBKA0E1RbZ6dHMODbVeLJm84qaCuDMFLKSj8GFyQ6Nlp2LIs8/J6H73qBkWTfpsaiBlTaIdoyr5w+CXnLnFOeJG2y/sGo8CClNpnJFMwD7ihkJG7GmPAWoMkY/rS2uB03CipgP4cCDnk+WbaZttYWtXEktXDs229g8DrouA/d+lDTyxKy6AtiWDqIqSbbRsvouKnBvKwjs7kgvttyfQPqBImR4Hl+FpnP01Us6KFMpCIo7AwxfsCulUbW3hv6pu+YT4TANj062brNevdhCNaUMdpsBv+NSqOFwFQFavFRHSWzup8bzZc5tZq8DxlCkZzxiQi0lOk5qfz7E/c18CffDKHbwf7ZU9sI7BiIJsjch84I16p01BPpVl0KAxOMC3ldDj3TUCj1eF5wTQ/KbOVdcAe8jTT8OWQvBjgPHe+csEVqLPHNBehmZ/awzJ7R3RgDQHD5LkFuSaw2t8iL9L2HEJ/qdSIsmLvTGBgU6bjbCqsQ3V9Qcx4hMxIW9Q+e3C4xTw3jFKiRFwRqm+NbdAqzkFjihOsfzBiZrvUPJar99odzZXi9OHIHNQCuX77gTy6ARsVDuSYHe4DhH71uHxISLsTrG0Dpq9kac9O1o5lQKzANe7pNHr0or1+BiM/qCYilD11bKOApPrsBrr9e9IaRjl48vYviY6EKDEi/jYHWeS3YpB8AyulSao9hGI7hcsiVOtt5E4bJKNhTgLGByLLX1L0gdfdzGM5NAF+ZMGkBQE13bcXXC1G4jN3Dpt6CNJFhQryu21Gi3g2n/+n1MzCclMzq5m46G1LhVatZOULben5OO2YcsjGiNrv0UoDsPccIOVqkSIV5p8gouh49mlezm6/QssHF8bt5c1zzaOL1ucvXoq9FoJbKwjHmbX0m5foWvHDlupqqKt9aeXMGCJCzVTiFsE5c8RTeJhp8ZksnVcgy5Z1U0zpe7FhwtmgMhk2LK+TQRSPrzfc9/ApSbTs3oJbfT9UTxFJnwpoqx3OtdcrAJEw9729Igsq5OYAyyjkFAYhb6Y+CPvyMx1dt0CHVBErVyslx9+sTMSB9Yx9foKvTlWmJpSOR/GcEmTu7Teo721Gh8TnY74myQ2yNoU7fZCWvBTZRYF2R9sWwhaAFREoWvmCkjxWdP1eqLaVRofZ9mLUivUrxOhbA1vJPhkB5Q7V9L7cLr+Jwj1zPThloqWtW6RTbYx1hybBUZ/YCwcM+X7CnvHK9zzSBc5fEhjg3Qhot0rbEXG4ONNjCnf2W72ZcX21FshbaK1GX2eABt3,iv:sS6Nf2BpWxNVLIrU2pU08xfzmTwC1r9oX6FYB4brKDc=,tag:hRHEvuOS4kugC3h2H6f+Jw==,type:str]
/ab2d/${env}/core/sensitive/idr_private_key: ENC[AES256_GCM,data:L0BIYSGX+pU225brUAfa0nLPZZzpiWiQWiAuXCnyFhJ/0ai/YvHJu4NXrDX27WR83KckaUoIVUzXVGlatIsAqdv7YWnNzOpRbeWW699FGZHROAXJcFz/wB8ToKATh64nGFKvhO9eaLvQ0BMbotU430pRVHXUGOSsn3xIaF2pYa9QFNs7bvqggSYwHcWAPgLdkVQcTraHhOkd++ZNfrnX8F7P1ldOAq/3L9TSLp0xNCZKT4BRcI/gVSDwlD0qeVJXCsue7yFgfdnWCto7ObHGU5gXX9/tEKjE826wuu6SLBA+CSuFOnKhH+w2SnSIdmSX/2+w/LvIAC8ASr0jUY4DoN+IvE4ZWOzTvTs72lOEMuDg8mTgezwXzfplpY6mA/hE9z7n70hh27/pR2cQV3oYCi8fMCUfkqSYKj9I61TjrN4i4j91886geMIK2qC9W7NZHBRGW48wMIg+mCKXcYZN7dbDO7zrprUuZAMbEWzi02FWZWM9q9+NdJTlce/w9YqRx1NDPZRWHUhMsybTm36W73eK3R11894Yas2muArP5XTmlFkqC8DRh5PCDSGTRhkBUhimwepvKkC0MnglNc8RdhF4DLyNXEQefht2fmO9as70lo9YfNYH94vz8+BUcd0gI0U9Um7uRzbuYAms9fbUcE9CzmXSih3I7MabwpU2SrpveXEDON6KSkviHSMHKaUU04fp1oeehuUrKw76xwVtK5R5CPLjTdFw3zAJ4iEJBLRLTMwcqFNbu+wxf0YiFJV5uLb+POTfOQRuMuVw9N/TMeWYViAt3Hc+sIY8l+hBBOjH2CALgCGSMvST0MHnbXa4yah8PqEIC0CxTg1B5zhILLxcz7cCQqxMzo16Mm8JWlr04+DnwSjB9yeoZpgTdHaAhJn9PV1TRrauqXGHVcXWj8rMh+g8h1YaiB5DARSQQUfBtJjUKvYFpQ3mBbF6AuaTiVTl43uSJTj5258Y52mfBvz3eL0W7yg93y+ItgHMdVIYoRNcmEj8qP4PksCAP1hzIKX1j+HGzZRpmHzRG8BGLKgprFKTwiJH3kI3AjDZ+vCYdsaYZYO5z4N4MS7yufmJgjC9Nv2VTji1qsw4h3ZRHGDZ1QCbkFwr1eXaB3E0y5FC6AbVIC+PjalURFyZgCkuWC65iWIyaoi/blpIgtZPBfEsBp1118XjGoGkrjiOf7ClzKia+uJWO0+IYxWkmNm2zWHqXcvCwg/FstqwSUkw8tIbiugus99ZuL1BzsVB+OYUVmMxRZ9o68ddQ3gQ2YHR1cRoPYZiBhh8tPIPmE8f/dR8kmXcu0l6dxHAyHPNenVlFt/1lesLYDdNbgXk0ZPh1iqfBllVlf7iRdU/vpC4inIO5qTi25nM59DevPFLCWv75I/DAmH41m6vy+d7rMhC0BGxn6Y1w70SYnoV6EwG8RqeCehr27mrBVg84ULBBMlGfCEuoS4dZdtf9rp+dCuG/AB7JoG2TY0ar22jy+1cfGQJfDaD6m1N8w8GRDfFwaAOxN+V7ZB7mG6aKagzgjcm82YJgyqgQ8guQBXLPeLsVTqkOTFBm4msVqrw5y+IRUwTENInvmRNtQ/Sna767C8V+OXXI929zeaizE/FaURKXrDboWJw3I+M7bX4eajW7T0aCRyKIQtvis0lQtw6/p6JuCmKPCzopftYLakLy66OYHWr/yehKoYO7qCAyy95JKQDD0AmRUjOLgCB83Dd0UzkJBflBGhvcVjId7F6o8zkhjP9W7XeL3QXcoUW2zZhu5dY4PwxyFkdxCHeRJjKNdHYf/g8s/h2t4kCklPNRB0kWpu8T1Q/VVfvWff8NRLoJxZoqpegXalwWZdDw/N2bZBp4Pk1lHtLaQRLgw1dAnIZSpCTzIz8Povgg1QSUW/hz9iQf06pZ+/xXbobIG2iUIqbx/vojGODWzWBnBta8lij1+xGdByEtsg1eSo48qrUSV3uR1p9+mMZD4x4D+UGMDh61X2i5u0lPwDYsZg72ZJLlTq1QIYPz8Kn4GoBlPvd8WX2GKQx5wfm3P11Q7hx8LwgQpI6ZZ66T7PinuJn1TXkap+S74Ll++9vzOVmwNSw1y8RXjJHiOgAg+yqanbzv+P21Q/U3FD6XlFinaNg7cENlmqv/hnjGxr1GDFEVMyHd34oZEmMSCZ8uGH/yZ8Wk3G13SlfCoQSDvtWzJ6JszP/f0sqZsmYGXrvSHphWipnYLNoNReZLySHMdUY9ZGalB1ljRDW7weGgYE7Su+QYHsrqFHta1TZ3yHz,iv:qJOJYXImiphnIPjTFdRGMpVR57q4yxp/LropP2I+k7I=,tag:AcnJ2EQ0V7yHuGHxzN95VQ==,type:str]
/ab2d/${env}/idr-db-importer/sensitive/snowflake_private_key: ENC[AES256_GCM,data:QsevuanujWAd8nq/2wtvyPqPnImT8VY/f72U/IeLCslq8x6RQR9g7khwK7vhnOqY5ZV+MOtV/J5ey9oEdrixalP1gp9Y3YuyMw77p/FVYRp7TOOTizUsnw1aexvVO4nbFLz2MaEWf5JIjJsNZhHKPGYsUrhQZS3WdRgqE61M6MJvMokTkyNWBX86whqWG4PBdqU4Kqg1WyUQsTo19HMc6BIgOSzlk8UEUFH1wQjXFB66UNmuuFJPO652C+7MShxVFqE/FdCgLpJjawIz9yKURlOpKKOO9MTzdPngqY5W2j93nFwbdF3YIo99qw4+ezM0CknW/cw/KddavOX7UrhDOULMlBWu6y2fYpuRr9UHctlF6iZ+17WhataNdRSjLgPvyCt+K8it0dtP7uzaRXGs74ItX5RyWxnsYCZD5/do0ICvLlSmXSRPaEAE/uLKyySPu4tmklT9zerrYbPNZ7hqEsHfdkJko/qBU+42s5LnXezTSkqhydqxwWL0PIjKgRcrurv1ibKYhL3xcZwxO03xrwh24LoadhqSDL3lOnhdQzl1v2CtzGtCcLyP4/+na0RqH8hlISSXgjwJuc5x7UQfO2XNXkRwjaA3sapr+vIFk7myXGNq0/NRILvVBQpsXom7uLaYGhDQrvHmYQNR2R+9UN9ke3O0pIxxHac/2pnJJC+ehRelDQCp9rbIIVOU2Ff/RvtfsqzivQTOyfqWKpWL2N7qkflHA5HBdjlXpvh4KWxMHadmrHJfoxcxKyLsjmS8DJYqwekoFkm4g9R3tUbcRuEaQRSw68moz6TXcf0/+26UAQrd4tpG/S9acSEVVus4q+Oi4la+yu1bLMFrhRqYlPhSSOsmdvsMuiJr8x8LIQTBWc+PEonO+iZWV1jBGuYZEqm+lts4CAJRMsGa4a+lwgO+zjUw8oF5+1eons7BeV0nmDvakNFZcMVnZmjDBVaMthxCVMiMdHlQ/y1uQoQWVHzaDXFSVEOX+Z3HLsNLVmYCwxEbQT0rJsG6/qFVW7bcuTDnb9reQDaWrNJSCmN5cvYhjXxWcj59RVdu03hNV7HtL+bliIrbYchbZ7m68Xg66tJ7KEGXcOvDBEjsLwyyHrUxeOjLfBtY8sqeFDhWdb9Av7K+zhtJih5wanh5ZhMmBtIzKLYM+nlL2rQtT4uQQZo6SR3J4mfbGJ4r2RJn/ptujylcuDbOQT1n2GkKEoMn0vQrsBMoQWtkFf3liHChba4tm+V3qZ0MmTUhs1GbMV3zwLIb48kEc8rALh0D3d/QP0/9eCCCd1ApLzauI7u79ykKqpoJTonh/gCCj1mGRE5agQ3ygRnrmVu+RlkChl57nCVHozYfk+7itG7/jJK46J48fU5jB7svvjxurw8zit2H+SV6jD4qSWmtpMQxoX6EORFSI6AMRR2mu3rfGnVDhQj3IgM1BIgtoyC8ZKxr1NR0lvqFIPtU8KB6tS0x1kSeHZzM1TwvkK/NVEfmDO0RkPs6alEMgQaYzre2ob1Iujhc0BBcE0IRj6t6BtcyF3NdfDJ035RLpDFvv1FVl2kNwf6slvrpH25ZXBqp8Z6jM2OTBmQR2pJ0CvKqysqDDHbG/1+T8EP92bWX39gb9tNXKrsbzjp2+iGiQUBWv78oayRx9VTb0+aIGwvMJz/PaoYj4QKVIUQ5lqHUKiVcFK0KxPS2tC/+WtwUWbvLZAglgI+S5pg+MtFQeq3Uyg7ZoCWYp9Z30sbsc1elo+REQd7adAeFJPmfxP1NWUHYyyP/nspGdRpVGKv9r4NYGiRmZfx8/hb5B1i3hN39N0VmqGkP0Ij1TdXLYxwWOnzTaxX5+M6JTagfW62myMr0AtFoF4XmiKrH0GUUmkFDuANfx+lCcsQYMJcdatIP/v+Q0HL/7OOAOXNGj+2jcmJ3f8K9ZWyJYqFyLra4IUGNmHxWPbTlF8u0UuAMnV+6rK5hQ99Aq1jMmcLKAnl34bBgCbU+HWBAJGQ2SKZykFoVQfP4klUlXSPVfqqeIVAFkv+h4md0Eri3KQ7YLFBEcTNQdr5h6kgQAM7C/FyUp22yQMlPnhbCqtCL5gdYQr3py6eQwzeEo/L55+m1I+mkjlu6GXRyzHRNzK5UGcB/WsP4cuX8A95u3myNt/xamfZ7B8fh/QNoY47xlrmRdOTtcLuhescaz/7M2eGPZD2/XXZ8Gkq4M4Zymucu0+IR3iDNaipDTITMNwzHTzjjaT6FSKR/W/bGQ2ykPpLP/PU0ATwVXdos5WQmMrAlbETZXP/B,iv:e1nLd1OhAvHfxm6kCFjfDbyxWkuK4vc4QQ77AQjHMHY=,tag:wXJF05qM8bEP10IuAsZN7w==,type:str]
/ab2d/${env}/insights/sensitive/administrators_yaml: ENC[AES256_GCM,data:zLBYs8x/Az1Sr89LnvCzb5+hSQDyBh19gtufdq2hpcPsFsg5TUAePlo5ZsuXM4G0J9+rPg16EfVPqWOl/cJUKENkDPfjga9sOeCUiZ1MeKOfRstiSRkK35L9syE6cVjjx4B2/ypicaMPXqODGhr02lVYNAv7wmbyl1zp3CgmfwQsPyWrg19iQga2AR/qwZisQWOrvwUmjv6cE2SvZ6QhB9EFY320f5tL4ltu7oojnKJxC1qnB4g4gYzGaG4hiBm6YtN4oiRLS0O4IxWPtlAAzQ3EGmxtuIFJrTW2M/ttHVZ5pWS0j+9Bs96AydrtcZ8i2BKqH84kmhfacqYGaKdDqkgSWogwiiv8hwgPDdFXJfDIsXP5cnOsyTBYiAsVgGfmmjL0EBoyQ1vQFuUx,iv:FmVN0KOvUUCsyN6ocafULC9SHl17E4vqoLcTocoHDHA=,tag:v+duTZkI6CpEnsMvnzuynA==,type:str]
/ab2d/${env}/bene-prefs/sensitive/bfd-sns-topic-arn: ENC[AES256_GCM,data:4Lo05HDtSlYvXuz1dxiH5MPc1rAQgPGiCddjGxqUNOL4NiS6rJhXYCWuuJtnsDC1BSTWKWjnOGSNJyvwdIG46JSb4jHi3RM=,iv:ZmlsOUmrveKz1lqwBGTw1q4BlhjSp/9wJ+FrUWEWwRI=,tag:h0Z8R6VUSWLqUUEzn4kM8Q==,type:str]
/ab2d/${env}/bene-prefs/sensitive/bfd-bucket-role-arn: ENC[AES256_GCM,data:QZCjtEr5wNqOFsjDrq1xLe45XQ4iK7vmOIbRCUex2pGGpoddtmuOquiLfQ+hm8HzuQnNwU1RwQC2LKRNYUC/uzZKVt7lerj4OAPRJfQc8LCgQ8ZDRj5gtCyIX9bOrPPwO4lM,iv:vOvQrcVJh/5urrgxRpn/wjm5gU5Xlst9ACCGreO70G4=,tag:mmUVKUzk2Ef4SC2j/hC8pg==,type:str]
sops:
kms:
- arn: arn:aws:kms:us-east-1:${ACCOUNT_ID}:alias/ab2d-prod
aws_profile: ""
created_at: "2025-06-10T18:29:53Z"
enc: AQICAHiiBcH1zXWffn77hoG6y6pEPZ+4jjugLfsVfebBM+L/LgFRiUHz9BFerz/OTGQMltW4AAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMMpJ8aa5bO5Tfke2oAgEQgDsL7xbz+8lCZG0cnuZBAfpih+vMoB082VnofgnC5AdYpv6ggcGLXckWRPXCWbCwKTATHh4h3jUl2lT1EQ==
- arn: arn:aws:kms:us-west-2:${ACCOUNT_ID}:alias/ab2d-prod
aws_profile: ""
- arn: arn:aws:kms:us-west-2:${ACCOUNT_ID}:alias/ab2d-prod
created_at: "2025-06-10T18:29:53Z"
enc: AQICAHhQOCwYYioO/Y8DTCCF3UDslbqq7E89gMxakADNsQ0frwG3hCM3g09qFSEm7fV/DDESAAAAfjB8BgkqhkiG9w0BBwagbzBtAgEAMGgGCSqGSIb3DQEHATAeBglghkgBZQMEAS4wEQQMCWATLsuplVdQvnQeAgEQgDvqARVB2qXPQg+uqgE8wP15bMkoFSm3WzgefyzBM/VvOWHUDQA8wiyY+MDL3BoMFEtk2GCFoPsYvVfMPw==
mac_only_encrypted: true
aws_profile: ""
unencrypted_regex: /nonsensitive/
mac_only_encrypted: true
version: 3.13.1
96 changes: 2 additions & 94 deletions ops/services/10-core/iam.tf
Original file line number Diff line number Diff line change
Expand Up @@ -244,68 +244,6 @@ resource "aws_iam_role_policy_attachment" "idr_kms" {
policy_arn = aws_iam_policy.kms_key_access.arn
}

resource "aws_iam_role" "idr_db_importer_task" {
permissions_boundary = data.aws_iam_policy.developer_boundary_policy.arn
name = "${local.service_prefix}-idr-db-importer-task"
path = "/delegatedadmin/developer/"

assume_role_policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Action = "sts:AssumeRole"
Effect = "Allow"
Sid = ""
Principal = {
Service = [
"ecs-tasks.amazonaws.com"
]
}
}
]
})
}

resource "aws_iam_policy" "idr_db_importer_task" {
name = "${module.platform.app}-${module.platform.env}-idr-db-importer-task"
description = "IDR DB Importer ECS task access to S3 bucket and KMS key."

policy = jsonencode({
Version = "2012-10-17"
Statement = [
{
Sid = "S3Access"
Effect = "Allow"
Action = [
"s3:AbortMultipartUpload",
"s3:GetObject",
"s3:PutObject",
"s3:DeleteObject",
"s3:ListBucket"
]
Resource = [
module.idr_db_importer_bucket.arn,
"${module.idr_db_importer_bucket.arn}/*"
]
},
{
Sid = "KmsAccessForS3"
Effect = "Allow"
Action = [
"kms:Decrypt",
"kms:GenerateDataKey"
]
Resource = module.platform.kms_alias_primary.target_key_arn
}
]
})
}

resource "aws_iam_role_policy_attachment" "idr_db_importer_task" {
role = aws_iam_role.idr_db_importer_task.name
policy_arn = aws_iam_policy.idr_db_importer_task.arn
}

resource "aws_iam_role" "idr_db_importer" {
name = "${module.platform.app}-${module.platform.env}-idr-db-importer"
path = "/delegatedadmin/developer/"
Expand Down Expand Up @@ -347,8 +285,8 @@ resource "aws_iam_policy" "idr_db_importer" {
"s3:ListBucket"
]
Resource = [
"${module.idr_db_importer_bucket.arn}",
"${module.idr_db_importer_bucket.arn}/*"
"arn:aws:s3:::${module.platform.app}-${module.platform.env}-idr-db-importer-*",
"arn:aws:s3:::${module.platform.app}-${module.platform.env}-idr-db-importer-*/*"
]
},
{
Expand All @@ -375,36 +313,6 @@ resource "aws_rds_cluster_role_association" "idr_db_importer" {
role_arn = aws_iam_role.idr_db_importer.arn
}

data "aws_iam_policy_document" "idr_db_importer_additional_bucket_policy" {
statement {
sid = "DenyReadAccess"
effect = "Deny"

actions = [
"s3:GetObject"
]

condition {
test = "StringNotEquals"
variable = "aws:PrincipalArn"
values = [
aws_iam_role.idr_db_importer.arn,
aws_iam_role.idr_db_importer_task.arn
]
}

principals {
type = "AWS"
identifiers = ["*"]
}

resources = [
module.idr_db_importer_bucket.arn,
"${module.idr_db_importer_bucket.arn}/*",
]
}
}

# Create KMS policy
resource "aws_iam_policy" "kms" {
name = "${local.service_prefix}-kms"
Expand Down
10 changes: 0 additions & 10 deletions ops/services/10-core/main.tf
Original file line number Diff line number Diff line change
Expand Up @@ -369,16 +369,6 @@ resource "aws_vpc_security_group_ingress_rule" "idr_endpoint_https" {
ip_protocol = "tcp"
}

module "idr_db_importer_bucket" {
source = "github.com/CMSgov/cdap//terraform/modules/bucket?ref=7c070cd2e8c6b1407961c35976553446df8fafd3"

additional_bucket_policies = [data.aws_iam_policy_document.idr_db_importer_additional_bucket_policy.json]
app = module.platform.app
env = local.parent_env
name = "${module.platform.app}-${module.platform.env}-idr-db-importer"
ssm_parameter = "/ab2d/${module.platform.env}/core/nonsensitive/idr-db-importer-bucket"
}

# Shared cluster to be initially used by the idr-db-importer task with the remaining services potentially being migrated later.
module "cluster" {
source = "github.com/CMSgov/cdap//terraform/modules/cluster?ref=7c070cd2e8c6b1407961c35976553446df8fafd3"
Expand Down
31 changes: 4 additions & 27 deletions ops/services/30-idr-db-importer/data.tf
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,14 @@ data "aws_ecs_cluster" "shared" {
cluster_name = "${local.app}-${local.env}"
}

data "aws_iam_role" "idr_db_importer_task" {
name = "${local.service_prefix}-${local.service}-task"
}

data "aws_iam_role" "idr_db_importer_task_execution" {
name = "${local.service_prefix}-${local.service}-task-execution"
}

data "aws_iam_role" "idr_db_importer_s3_import" {
name = "${local.app}-${local.env}-idr-db-importer"
}

data "aws_security_group" "idr_db_importer" {
name = "${local.service_prefix}-idr-db-importer"
vpc_id = module.platform.vpc_id
Expand All @@ -37,26 +37,3 @@ data "aws_ssm_parameter" "ab2d_db_user" {
name = "/ab2d/${local.env}/core/sensitive/database_user"
}

data "aws_ssm_parameter" "idr_db_importer_bucket" {
name = "/ab2d/${local.env}/core/nonsensitive/idr-db-importer-bucket"
}

data "aws_ssm_parameter" "idr_snowflake_user" {
count = module.platform.parent_env == "prod" ? 1 : 0
name = "/ab2d/${module.platform.parent_env}/core/sensitive/idr_service_id_name"
}

data "aws_ssm_parameter" "idr_snowflake_role" {
count = module.platform.parent_env == "prod" ? 1 : 0
name = "/ab2d/${module.platform.parent_env}/core/sensitive/idr_role_name"
}

data "aws_ssm_parameter" "idr_snowflake_warehouse" {
count = module.platform.parent_env == "prod" ? 1 : 0
name = "/ab2d/${module.platform.parent_env}/core/sensitive/idr_warehouse_name"
}

data "aws_ssm_parameter" "idr_private_key" {
count = module.platform.parent_env == "prod" ? 1 : 0
name = "/ab2d/${module.platform.parent_env}/core/sensitive/idr_private_key"
}
Loading
Loading