move to SSM (from S3) for config/secrets

.github/workflows/ci.yml

@@ -8,7 +8,10 @@ on:
 jobs:
   CI:
     runs-on: ubuntu-latest
-
+    permissions:
+      id-token: write
+      contents: read
+      pull-requests: write
     steps:
       - uses: actions/checkout@v3
 
@@ -18,7 +21,32 @@ jobs:
           cache: npm
           cache-dependency-path: 'pan-domain-node/package-lock.json'
 
-      - name: JS Build
+      - uses: actions/setup-node@v3
+        with:
+          node-version-file: '.nvmrc'
+          cache: npm
+          cache-dependency-path: 'cdk/package-lock.json'
+
+      - name: synth infra
+        working-directory: cdk
+        run: |
+          npm ci
+          npm test
+          npm run synth
+
+      - name: Upload infra definitions to Riff-Raff
+        uses: guardian/actions-riff-raff@v4
+        with:
+          roleArn: ${{ secrets.GU_RIFF_RAFF_ROLE_ARN }}
+          githubToken: ${{ secrets.GITHUB_TOKEN }}
+          app: pan-domain-authentication
+          projectName: 'pan-domain-authentication'
+          configPath: cdk/cdk.out/riff-raff.yaml
+          contentDirectories: |
+            cdk.out:
+              - cdk/cdk.out
+
+      - name: pan-domain-node JS Build
         run: |
           pushd pan-domain-node
 

cdk/.gitignore

@@ -0,0 +1,11 @@
+*.js
+!jest.config.js
+!jest.setup.js
+!.eslintrc.js
+*.d.ts
+node_modules
+dist
+
+# CDK asset staging directory
+.cdk.staging
+cdk.out

cdk/README.md

@@ -0,0 +1,5 @@
+# Infrastructure
+
+This directory defines the components to be deployed to AWS.
+
+See [`package.json`](./package.json) for a list of available scripts.

cdk/bin/cdk.ts

@@ -0,0 +1,26 @@
+import "source-map-support/register";
+import {GuRoot} from "@guardian/cdk/lib/constructs/root";
+import {PanDomainAuthentication} from "../lib/pan-domain-authentication";
+
+const stack = "pan-domain-authentication";
+const env = {region: "eu-west-1"};
+
+const app = new GuRoot();
+
+new PanDomainAuthentication(app, "PanDomainAuthentication-euwest-1-LOCAL", {
+  stack,
+  env,
+  stage: "LOCAL"
+});
+
+new PanDomainAuthentication(app, "PanDomainAuthentication-euwest-1-CODE", {
+  stack,
+  env,
+  stage: "CODE"
+});
+
+new PanDomainAuthentication(app, "PanDomainAuthentication-euwest-1-PROD", {
+  stack,
+  env,
+  stage: "PROD"
+});

cdk/cdk.json

@@ -0,0 +1,7 @@
+{
+  "app": "npx ts-node bin/cdk.ts",
+  "context": {
+    "aws-cdk:enableDiffNoFail": "true",
+    "@aws-cdk/core:stackRelativeExports": "true"
+  }
+}

cdk/jest.setup.js

@@ -0,0 +1 @@
+jest.mock("@guardian/cdk/lib/constants/tracking-tag");

cdk/lib/__snapshots__/pan-domain-authentication.test.ts.snap

@@ -0,0 +1,10 @@
+// Jest Snapshot v1, https://goo.gl/fbAQLP
+
+exports[`The PanDomainAuthentication stack matches the snapshot 1`] = `
+{
+  "Metadata": {
+    "gu:cdk:constructs": [],
+    "gu:cdk:version": "TEST",
+  },
+}
+`;

cdk/lib/pan-domain-authentication.test.ts

@@ -0,0 +1,12 @@
+import { App } from "aws-cdk-lib";
+import { Template } from "aws-cdk-lib/assertions";
+import { PanDomainAuthentication } from "./pan-domain-authentication";
+
+describe("The PanDomainAuthentication stack", () => {
+  it("matches the snapshot", () => {
+    const app = new App();
+    const stack = new PanDomainAuthentication(app, "PanDomainAuthentication", { stack: "pan-domain-authentication", stage: "TEST" });
+    const template = Template.fromStack(stack);
+    expect(template.toJSON()).toMatchSnapshot();
+  });
+});

cdk/lib/pan-domain-authentication.ts

@@ -0,0 +1,9 @@
+import type { GuStackProps } from "@guardian/cdk/lib/constructs/core";
+import { GuStack } from "@guardian/cdk/lib/constructs/core";
+import type { App } from "aws-cdk-lib";
+
+export class PanDomainAuthentication extends GuStack {
+  constructor(scope: App, id: string, props: GuStackProps) {
+    super(scope, id, props);
+  }
+}