generated from ministryofjustice/template-repository
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
* Adding run-tests workflow * Trigger on change in workflow function too * Removing repeating code, adding fine-grained perms * Fixing flake version in reqs-dev * Removing path constraints * Add requests-mock * Adding moto * Adding envvars and aking sure it fails on broken tests * Trash panda demands a sacrifice * Reorganising the file structure and adding the terraform * Moving pyproject.toml back * And flake8 file too * Fixing some checkov ignoring others * Fixing checkov skip placements * Ignoring VPC requirement in terrascan * Placeent of ts:skip * Fix tfscan ref * Updating readme and adding example * ⬆️ Bump requests from 2.31.0 to 2.32.2 in the pip group (#7) * Cheating merge confilict * Only works in eu-west-2 * Adding required providers block * Updating readme * Language + line ength --------- Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
- Loading branch information
1 parent
15ee5ab
commit 8475f46
Showing
11 changed files
with
400 additions
and
67 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,63 @@ | ||
| name: CI - Unit and Integration Tests | ||
|
|
||
| on: | ||
| push: | ||
| workflow_dispatch: | ||
|
|
||
| permissions: | ||
| contents: read # Allow read access to repository contents | ||
| actions: write # Allow write access to actions to upload artifacts | ||
|
|
||
| jobs: | ||
| tests: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Check out the repository | ||
| uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4 | ||
|
|
||
| - name: Set up Python 3.11 | ||
| uses: actions/setup-python@f677139bbe7f9c59b41e40162b753c062f5d49a3 # v5.2.0 | ||
| with: | ||
| python-version: "3.11" | ||
|
|
||
| - name: Set environment variables | ||
| run: | | ||
| { | ||
| echo "AZURE_TENANT_ID=dummy_value"; | ||
| echo "AZURE_CLIENT_ID=dummy_value"; | ||
| echo "AZURE_CLIENT_SECRET=dummy_value"; | ||
| echo "LOG_LEVEL=INFO"; | ||
| } >> "$GITHUB_ENV" | ||
| - name: Install dependencies | ||
| run: | | ||
| set -e # Exit immediately if a command exits with a non-zero status | ||
| python -m pip install --upgrade pip | ||
| pip install -r function/requirements.txt | ||
| pip install -r function/requirements-dev.txt | ||
| - name: Run unit tests and log output | ||
| run: | | ||
| set -e # Ensure the script fails if the tests fail | ||
| python -m unittest discover -s "function/tests/unit" 2>&1 | tee "unit-test-results.log" | ||
| continue-on-error: false # Ensure the job fails if the tests do not run | ||
|
|
||
| - name: Upload unit test logs | ||
| if: always() | ||
| uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0 | ||
| with: | ||
| name: Unit Test Logs | ||
| path: "unit-test-results.log" | ||
|
|
||
| - name: Run integration tests and log output | ||
| run: | | ||
| set -e # Ensure the script fails if the tests fail | ||
| python -m unittest discover -s "function/tests/integration" 2>&1 | tee "integration-test-results.log" | ||
| continue-on-error: false # Ensure the job fails if the tests do not run | ||
|
|
||
| - name: Upload integration test logs | ||
| if: always() | ||
| uses: actions/upload-artifact@50769540e7f4bd5e21e526ee35c689e35e0d6874 # v4.4.0 | ||
| with: | ||
| name: Integration Test Logs | ||
| path: "integration-test-results.log" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -19,3 +19,7 @@ scrap.txt | |
| **/**__pycache__ | ||
| venv/ | ||
| entra-id-scim/ | ||
|
|
||
| # function code | ||
|
|
||
| **/function.zip | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,66 +1,77 @@ | ||
| # Ministry of Justice Template Repository | ||
|
|
||
| [](https://operations-engineering-reports.cloud-platform.service.justice.gov.uk/public-report/template-repository) | ||
|
|
||
| This template repository equips you with the default initial files required for a Ministry of Justice GitHub repository. | ||
|
|
||
| ## Included Files | ||
|
|
||
| The repository comes with the following preset files: | ||
|
|
||
| - LICENSE | ||
| - .gitignore | ||
| - CODEOWNERS | ||
| - dependabot.yml | ||
| - GitHub Actions example files | ||
| - Ministry of Justice Compliance Badge (public repositories only) | ||
|
|
||
| ## Setup Instructions | ||
|
|
||
| Once you've created your repository using this template, ensure the following steps: | ||
|
|
||
| ### Update readme | ||
|
|
||
| Edit this README.md file to document your project accurately. Take the time to create a clear, engaging, and informative README.md file. Include information like what your project does, how to install and run it, how to contribute, and any other pertinent details. | ||
|
|
||
| ### Update repository description | ||
|
|
||
| After you've created your repository, GitHub provides a brief description field that appears on the top of your repository's main page. This is a summary that gives visitors quick insight into the project. Using this field to provide a succinct overview of your repository is highly recommended. | ||
|
|
||
| This description and your README.md will be one of the first things people see when they visit your repository. It's a good place to make a strong, concise first impression. Remember, this is often visible in search results on GitHub and search engines, so it's also an opportunity to help people discover your project. | ||
|
|
||
| ### Grant Team Permissions | ||
|
|
||
| Assign permissions to the appropriate Ministry of Justice teams. Ensure at least one team is granted Admin permissions. Whenever possible, assign permissions to teams rather than individual users. | ||
|
|
||
| ### Read about the GitHub repository standards | ||
|
|
||
| Familiarise yourself with the Ministry of Justice GitHub Repository Standards. These standards ensure consistency, maintainability, and best practices across all our repositories. | ||
|
|
||
| You can find the standards [here](https://user-guide.operations-engineering.service.justice.gov.uk/documentation/information/mojrepostandards.html). | ||
|
|
||
| Please read and understand these standards thoroughly and enable them when you feel comfortable. | ||
|
|
||
| ### Modify the GitHub Standards Badge | ||
|
|
||
| Once you've ensured that all the [GitHub Repository Standards](https://user-guide.operations-engineering.service.justice.gov.uk/documentation/information/mojrepostandards.html) have been applied to your repository, it's time to update the Ministry of Justice (MoJ) Compliance Badge located in the readme file. | ||
|
|
||
| The badge demonstrates that your repository is compliant with MoJ's standards. Please follow these [instructions](https://user-guide.operations-engineering.service.justice.gov.uk/documentation/information/add-repo-badge.html) to modify the badge URL to reflect the status of your repository correctly. | ||
|
|
||
| **Please note** the badge will not function correctly if your repository is internal or private. In this case, you may remove the badge from your readme. | ||
|
|
||
| ### Manage Outside Collaborators | ||
|
|
||
| To add an Outside Collaborator to the repository, follow the guidelines detailed [here](https://github.com/ministryofjustice/github-collaborators). | ||
|
|
||
| ### Update CODEOWNERS | ||
|
|
||
| (Optional) Modify the CODEOWNERS file to specify the teams or users authorized to approve pull requests. | ||
|
|
||
| ### Configure Dependabot | ||
|
|
||
| Adapt the dependabot.yml file to match your project's [dependency manager](https://docs.github.com/en/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#package-ecosystem) and to enable [automated pull requests for package updates](https://docs.github.com/en/code-security/supply-chain-security). | ||
|
|
||
| ### Dependency Review | ||
|
|
||
| If your repository is private with no GitHub Advanced Security license, remove the `.github/workflows/dependency-review.yml` file. | ||
| # moj-terraform-scim-entra-id | ||
|
|
||
| [](https://operations-engineering-reports.cloud-platform.service.justice.gov.uk/public-github-repositories.html#moj-terraform-scim-entra-id) | ||
|
|
||
| This Terraform module configures a Lambda function for provisioning (and deprovisioning) AWS SSO Identity Store users and groups from EntraID. | ||
|
|
||
| The Lambda function used to use the SCIM endpoints (hence its name, _moj-terraform-scim-github_), but now uses the direct [Identity Store API](https://docs.aws.amazon.com/singlesignon/latest/IdentityStoreAPIReference/API_Operations.html). | ||
| The SCIM API has limitations such as not being able to list more than 50 groups or members (and doesn't support startIndex, so you can't paginate them), whereas the Identity Store API does allow pagination. | ||
| This allows us to deprovision users and groups using the Identity Store API, which you cannot do easily with the SCIM API. | ||
|
|
||
| This function only syncs EntraID groups that begin with `azure-aws-sso-` | ||
|
|
||
| ## Usage | ||
|
|
||
| ```hcl | ||
| module "scim" { | ||
| source = "github.com/ministryofjustice/moj-terraform-scim-entra-id" | ||
| # Required variables for the module | ||
| azure_tenant_id = "your-tenant-id" | ||
| azure_client_id = "your-client-id" | ||
| azure_client_secret = "your-client-secret" | ||
| } | ||
| ``` | ||
|
|
||
| <!-- BEGIN_TF_DOCS --> | ||
| ## Requirements | ||
|
|
||
| | Name | Version | | ||
| |------|---------| | ||
| | <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.0 | | ||
| | <a name="requirement_archive"></a> [archive](#requirement\_archive) | >= 2.4.0 | | ||
| | <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 5.0.0 | | ||
|
|
||
| ## Providers | ||
|
|
||
| | Name | Version | | ||
| |------|---------| | ||
| | <a name="provider_archive"></a> [archive](#provider\_archive) | >= 2.4.0 | | ||
| | <a name="provider_aws"></a> [aws](#provider\_aws) | >= 5.0.0 | | ||
|
|
||
| ## Modules | ||
|
|
||
| No modules. | ||
|
|
||
| ## Resources | ||
|
|
||
| | Name | Type | | ||
| |------|------| | ||
| | [aws_cloudwatch_event_rule.lambda_schedule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource | | ||
| | [aws_cloudwatch_event_target.lambda_target](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource | | ||
| | [aws_cloudwatch_log_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource | | ||
| | [aws_iam_policy.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource | | ||
| | [aws_iam_role.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource | | ||
| | [aws_iam_role_policy_attachment.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource | | ||
| | [aws_lambda_function.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function) | resource | | ||
| | [aws_lambda_permission.allow_eventbridge](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource | | ||
| | [archive_file.function](https://registry.terraform.io/providers/hashicorp/archive/latest/docs/data-sources/file) | data source | | ||
| | [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source | | ||
| | [aws_iam_policy_document.assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | ||
| | [aws_iam_policy_document.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source | | ||
| | [aws_kms_alias.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/kms_alias) | data source | | ||
|
|
||
| ## Inputs | ||
|
|
||
| | Name | Description | Type | Default | Required | | ||
| |------|-------------|------|---------|:--------:| | ||
| | <a name="input_azure_client_id"></a> [azure\_client\_id](#input\_azure\_client\_id) | Client ID for AzureAD application | `string` | n/a | yes | | ||
| | <a name="input_azure_client_secret"></a> [azure\_client\_secret](#input\_azure\_client\_secret) | Client Secret for AzureAD application | `string` | n/a | yes | | ||
| | <a name="input_azure_tenant_id"></a> [azure\_tenant\_id](#input\_azure\_tenant\_id) | Tenant ID for to use for user sync | `string` | n/a | yes | | ||
| | <a name="input_tags"></a> [tags](#input\_tags) | Tags to apply to resources | `map(any)` | `{}` | no | | ||
|
|
||
| ## Outputs | ||
|
|
||
| | Name | Description | | ||
| |------|-------------| | ||
| | <a name="output_lambda_function_name"></a> [lambda\_function\_name](#output\_lambda\_function\_name) | Name of the deployed Lambda function | | ||
| <!-- END_TF_DOCS --> |
Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.
Oops, something went wrong.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,26 @@ | ||
| terraform { | ||
| required_providers { | ||
| aws = { | ||
| source = "hashicorp/aws" | ||
| version = ">= 5.0.0" | ||
| } | ||
| archive = { | ||
| source = "hashicorp/archive" | ||
| version = ">= 2.4.0" | ||
| } | ||
| } | ||
| required_version = ">= 1.0" | ||
| } | ||
|
|
||
| provider "aws" { | ||
| region = "eu-west-2" | ||
| } | ||
|
|
||
| module "entra_id_scim_lambda" { | ||
| source = "../." | ||
|
|
||
| # Required variables for the module | ||
| azure_tenant_id = "your-tenant-id" # Replace with your Azure Tenant ID | ||
| azure_client_id = "your-client-id" # Replace with your Azure Client ID | ||
| azure_client_secret = "your-client-secret" # Replace with your Azure Client Secret | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
File renamed without changes.
Oops, something went wrong.