✈️ APC MWAA

terraform/environments/analytical-platform-compute/acm.tf

@@ -0,0 +1,15 @@
+module "acm_certificate" {
+  #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
+  #checkov:skip=CKV_TF_2:Module registry does not support tags for versions
+
+  source  = "terraform-aws-modules/acm/aws"
+  version = "5.1.1"
+
+  zone_id                   = module.route53_zones.route53_zone_zone_id[local.environment_configuration.route53_zone]
+  domain_name               = local.environment_configuration.route53_zone
+  subject_alternative_names = ["*.${local.environment_configuration.route53_zone}"]
+
+  validation_method = "DNS"
+
+  tags = local.tags
+}

terraform/environments/analytical-platform-compute/alb.tf

@@ -0,0 +1,79 @@
+module "mwaa_alb" {
+  #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
+  #checkov:skip=CKV_TF_2:Module registry does not support tags for versions
+
+  source  = "terraform-aws-modules/alb/aws"
+  version = "9.13.0"
+
+  name    = "mwaa"
+  vpc_id  = module.vpc.vpc_id
+  subnets = module.vpc.public_subnets
+
+  security_group_ingress_rules = {
+    all_http = {
+      from_port   = 80
+      to_port     = 80
+      ip_protocol = "tcp"
+      description = "HTTP"
+      cidr_ipv4   = "0.0.0.0/0"
+    }
+    all_https = {
+      from_port   = 443
+      to_port     = 443
+      ip_protocol = "tcp"
+      description = "HTTPS"
+      cidr_ipv4   = "0.0.0.0/0"
+    }
+  }
+  security_group_egress_rules = {
+    all = {
+      ip_protocol = "-1"
+      cidr_ipv4   = module.vpc.vpc_cidr_block
+    }
+  }
+  listeners = {
+    http-https-redirect = {
+      port     = 80
+      protocol = "HTTP"
+      redirect = {
+        port        = "443"
+        protocol    = "HTTPS"
+        status_code = "HTTP_301"
+      }
+    }
+    https = {
+      port            = 443
+      protocol        = "HTTPS"
+      certificate_arn = module.acm_certificate.acm_certificate_arn
+
+      forward = {
+        target_group_key = "mwaa"
+      }
+    }
+  }
+  target_groups = {
+    mwaa = {
+      name_prefix = "tg"
+      protocol    = "HTTPS"
+      port        = 443
+      target_type = "ip"
+      target_id   = data.dns_a_record_set.mwaa_webserver_vpc_endpoint.addrs[0]
+      health_check = {
+        enabled  = true
+        path     = "/"
+        port     = "traffic-port"
+        protocol = "HTTPS"
+        matcher  = "200,302"
+      }
+    }
+  }
+  additional_target_group_attachments = {
+    mwaa = {
+      target_group_key = "mwaa"
+      target_id        = data.dns_a_record_set.mwaa_webserver_vpc_endpoint.addrs[1]
+      port             = 443
+    }
+  }
+
+  tags = local.tags
+}

terraform/environments/analytical-platform-compute/data.tf

@@ -82,3 +82,11 @@ data "aws_secretsmanager_secret_version" "actions_runners_token_apc_self_hosted_
 
   secret_id = module.actions_runners_token_apc_self_hosted_runners_github_app[0].secret_id
 }
+
+data "aws_vpc_endpoint" "mwaa_webserver" {
+  service_name = aws_mwaa_environment.main.webserver_vpc_endpoint_service
+}
+
+data "dns_a_record_set" "mwaa_webserver_vpc_endpoint" {
+  host = data.aws_vpc_endpoint.mwaa_webserver.dns_entry[0].dns_name
+}

terraform/environments/analytical-platform-compute/eks-cluster.tf

@@ -17,6 +17,16 @@ module "eks" {
   vpc_id                   = module.vpc.vpc_id
   control_plane_subnet_ids = module.vpc.intra_subnets
   subnet_ids               = module.vpc.private_subnets
+  cluster_security_group_additional_rules = {
+    vpc = {
+      description = "Allow traffic from the VPC"
+      from_port   = 0
+      to_port     = 65535
+      protocol    = "tcp"
+      type        = "ingress"
+      cidr_blocks = [module.vpc.vpc_cidr_block]
+    }
+  }
 
   authentication_mode                      = "API"
   enable_cluster_creator_admin_permissions = true
@@ -155,6 +165,11 @@ module "eks" {
         }
       }
     }
+    apc-mwaa = {
+      principal_arn     = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/mwaa-execution"
+      username          = "apc-mwaa"
+      kubernetes_groups = ["mwaa"]
+    }
     data-engineering-airflow = {
       principal_arn     = local.environment_configuration.data_engineering_airflow_execution_role_arn
       username          = "data-engineering-airflow"

terraform/environments/analytical-platform-compute/environment-configuration.tf

@@ -44,6 +44,10 @@ locals {
       /* UI */
       ui_hostname = "development.analytical-platform.service.justice.gov.uk"
 
+      /* MWAA */
+      airflow_version                 = "2.10.3"
+      airflow_environment_class       = "mw1.small"
+      airflow_webserver_instance_name = "Development"
     }
     test = {
       /* VPC */
@@ -88,6 +92,11 @@ locals {
 
       /* UI */
       ui_hostname = "test.analytical-platform.service.justice.gov.uk"
+
+      /* MWAA */
+      airflow_version                 = "2.10.3"
+      airflow_environment_class       = "mw1.medium"
+      airflow_webserver_instance_name = "Test"
     }
     production = {
       /* VPC */
@@ -133,6 +142,11 @@ locals {
       /* UI */
       ui_hostname = "analytical-platform.service.justice.gov.uk"
 
+      /* MWAA */
+      airflow_version                 = "2.10.3"
+      airflow_environment_class       = "mw1.medium"
+      airflow_webserver_instance_name = "Production"
+
       /* LF Domain Tags */
       cadet_lf_tags = {
         domain = ["bold", "civil", "courts", "general", "criminal_history", "development_sandpit", "electronic_monitoring", "finance", "interventions", "opg", "performance", "risk", "people", "prison", "probation", "staging", "victims", "victims_case_management"] # extracted from bucket paths

terraform/environments/analytical-platform-compute/iam-policies.tf

@@ -176,8 +176,6 @@ module "gha_mojas_airflow_iam_policy" {
 }
 
 data "aws_iam_policy_document" "analytical_platform_share_policy" {
-  #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
-  #checkov:skip=CKV_TF_2:Module registry does not support tags for versions
   #checkov:skip=CKV_AWS_110: test policy for development
   #checkov:skip=CKV_AWS_107: test policy for development
   #checkov:skip=CKV_AWS_111: test policy for development
@@ -268,11 +266,8 @@ module "analytical_platform_lake_formation_share_policy" {
 }
 
 data "aws_iam_policy_document" "quicksight_vpc_connection" {
-  #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
-  #checkov:skip=CKV_TF_2:Module registry does not support tags for versions
   #checkov:skip=CKV_AWS_111:Policy suggested by AWS documentation
   #checkov:skip=CKV_AWS_356:Policy suggested by AWS documentation
-
   statement {
     sid    = "QuickSightVPCConnection"
     effect = "Allow"
@@ -302,8 +297,6 @@ module "quicksight_vpc_connection_iam_policy" {
 }
 
 data "aws_iam_policy_document" "data_production_mojap_derived_bucket_lake_formation_policy" {
-  #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
-  #checkov:skip=CKV_TF_2:Module registry does not support tags for versions
   statement {
     sid    = "AllowS3ReadWriteAPDataProdDerivedTables"
     effect = "Allow"
@@ -456,24 +449,24 @@ module "copy_apdp_cadet_metadata_to_compute_policy" {
 }
 
 data "aws_iam_policy_document" "find_moj_data_quicksight_policy" {
-    statement {
-        effect = "Allow"
-        actions = [
-            "quicksight:GenerateEmbedUrlForAnonymousUser"
-        ]
-        resources = [
-            "arn:aws:quicksight:eu-west-2:${data.aws_caller_identity.current.account_id}:namespace/default",
-            "arn:aws:quicksight:eu-west-2:${data.aws_caller_identity.current.account_id}:dashboard/6898300c-69fe-4f84-b172-1784ab6bf1a0"
-        ]
-        condition {
-            test     = "ForAllValues:StringEquals"
-            variable = "quicksight:AllowedEmbeddingDomains"
-
-            values = [
-                "https://dev.find-moj-data.service.justice.gov.uk",
-            ]
-        }
+  statement {
+    effect = "Allow"
+    actions = [
+      "quicksight:GenerateEmbedUrlForAnonymousUser"
+    ]
+    resources = [
+      "arn:aws:quicksight:eu-west-2:${data.aws_caller_identity.current.account_id}:namespace/default",
+      "arn:aws:quicksight:eu-west-2:${data.aws_caller_identity.current.account_id}:dashboard/6898300c-69fe-4f84-b172-1784ab6bf1a0"
+    ]
+    condition {
+      test     = "ForAllValues:StringEquals"
+      variable = "quicksight:AllowedEmbeddingDomains"
+
+      values = [
+        "https://dev.find-moj-data.service.justice.gov.uk",
+      ]
     }
+  }
 }
 
 module "find_moj_data_quicksight_policy" {
@@ -489,3 +482,102 @@ module "find_moj_data_quicksight_policy" {
 
   tags = local.tags
 }
+
+# Based on CMK policy from https://docs.aws.amazon.com/mwaa/latest/userguide/mwaa-create-role.html#mwaa-create-role-json
+data "aws_iam_policy_document" "mwaa_execution_policy" {
+  statement {
+    effect  = "Deny"
+    actions = ["s3:ListAllMyBuckets"]
+    resources = [
+      "arn:aws:s3:::mojap-compute-${local.environment}-mwaa",
+      "arn:aws:s3:::mojap-compute-${local.environment}-mwaa/*"
+    ]
+  }
+  statement {
+    effect = "Allow"
+    actions = [
+      "s3:GetObject*",
+      "s3:GetBucket*",
+      "s3:List*"
+    ]
+    resources = [
+      "arn:aws:s3:::mojap-compute-${local.environment}-mwaa",
+      "arn:aws:s3:::mojap-compute-${local.environment}-mwaa/*"
+    ]
+  }
+  statement {
+    effect = "Allow"
+    actions = [
+      "logs:CreateLogStream",
+      "logs:CreateLogGroup",
+      "logs:PutLogEvents",
+      "logs:GetLogEvents",
+      "logs:GetLogRecord",
+      "logs:GetLogGroupFields",
+      "logs:GetQueryResults"
+    ]
+    resources = ["arn:aws:logs:${data.aws_region.current.name}:${data.aws_caller_identity.current.account_id}:log-group:airflow-${local.environment}-*"]
+  }
+  statement {
+    effect    = "Allow"
+    actions   = ["logs:DescribeLogGroups"]
+    resources = ["*"]
+  }
+  statement {
+    effect    = "Allow"
+    actions   = ["s3:GetAccountPublicAccessBlock"]
+    resources = ["*"]
+  }
+  statement {
+    effect    = "Allow"
+    actions   = ["cloudwatch:PutMetricData"]
+    resources = ["*"]
+  }
+  statement {
+    effect = "Allow"
+    actions = [
+      "sqs:ChangeMessageVisibility",
+      "sqs:DeleteMessage",
+      "sqs:GetQueueAttributes",
+      "sqs:GetQueueUrl",
+      "sqs:ReceiveMessage",
+      "sqs:SendMessage"
+    ]
+    resources = ["arn:aws:sqs:${data.aws_region.current.name}:*:airflow-celery-*"]
+  }
+  statement {
+    effect = "Allow"
+    actions = [
+      "kms:Decrypt",
+      "kms:DescribeKey",
+      "kms:GenerateDataKey*",
+      "kms:Encrypt"
+    ]
+    resources = [module.mwaa_kms.key_arn]
+    condition {
+      test     = "StringLike"
+      variable = "kms:ViaService"
+      values = [
+        "s3.${data.aws_region.current.name}.amazonaws.com",
+        "sqs.${data.aws_region.current.name}.amazonaws.com"
+      ]
+    }
+  }
+  statement {
+    sid       = "AllowEKSDescribeCluster"
+    effect    = "Allow"
+    actions   = ["eks:DescribeCluster"]
+    resources = [module.eks.cluster_arn]
+  }
+}
+
+module "mwaa_execution_iam_policy" {
+  #checkov:skip=CKV_TF_1:Module registry does not support commit hashes for versions
+  #checkov:skip=CKV_TF_2:Module registry does not support tags for versions
+
+  source  = "terraform-aws-modules/iam/aws//modules/iam-policy"
+  version = "5.52.2"
+
+  name   = "mwaa-execution"
+  policy = data.aws_iam_policy_document.mwaa_execution_policy.json
+}