Wardship: Add IP addresses and remove security group setup scripts

terraform/environments/wardship/application_variables.json

@@ -1,7 +1,6 @@
 {
   "accounts": {
     "development": {
-      "moj_ip": "81.134.202.29/32",
       "db_name": "wardship_db_dev",
       "identifier": "wardship-db-dev",
       "db_username": "dbadmin",
@@ -23,7 +22,6 @@
       "tactical_products_db_secrets_arn": "tspb4H"
     },
     "preproduction": {
-      "moj_ip": "81.134.202.29/32",
       "db_name": "wardship_db_pre_prod",
       "identifier": "wardship-db-pre-prod",
       "db_username": "dbadmin",
@@ -45,7 +43,6 @@
       "tactical_products_db_secrets_arn": "kVCGj1"
     },
     "production": {
-      "moj_ip": "81.134.202.29/32",
       "db_name": "wardship_db_prod",
       "identifier": "wardship-db-prod",
       "db_username": "dbadmin",

terraform/environments/wardship/load_balancer.tf

@@ -4,11 +4,19 @@ resource "aws_security_group" "wardship_lb_sc" {
   vpc_id      = data.aws_vpc.shared.id
 
   ingress {
-    description = "allow access on HTTPS for the MOJ VPN"
+    description = "allow access on HTTPS for the Dom1 Cisco VPN"
     from_port   = 443
     to_port     = 443
     protocol    = "tcp"
-    cidr_blocks = [local.application_data.accounts[local.environment].moj_ip]
+    cidr_blocks = ["194.33.192.1/32"]
+  }
+
+  ingress {
+    description = "allow access on HTTPS for the Global Protect VPN"
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["35.176.93.186/32"]
   }
 
   // Allow all User IPs
@@ -30,7 +38,10 @@ resource "aws_security_group" "wardship_lb_sc" {
       "194.33.192.0/25",
       "157.203.176.0/25",
       "201.33.21.5/32",
-      "54.94.206.111/32"
+      "54.94.206.111/32",
+      "18.169.147.172/32",
+      "18.130.148.126/32",
+      "35.176.148.126/32"
     ]
   }
 

terraform/environments/wardship/rds.tf

@@ -84,48 +84,6 @@ data "http" "myip" {
   url = "http://ipinfo.io/json"
 }
 
-resource "null_resource" "setup_db" {
-  count      = local.is-development ? 0 : 1
-  depends_on = [aws_db_instance.wardship_db]
-
-  provisioner "local-exec" {
-    interpreter = ["bash", "-c"]
-    command     = "chmod +x ./migrate_db.sh; ./migrate_db.sh"
-
-    environment = {
-      SOURCE_DB_HOSTNAME   = jsondecode(data.aws_secretsmanager_secret_version.get_tactical_products_rds_credentials.secret_string)["SOURCE_DB_HOSTNAME"]
-      SOURCE_DB_NAME       = jsondecode(data.aws_secretsmanager_secret_version.get_tactical_products_rds_credentials.secret_string)["SOURCE_DB_NAME"]
-      SOURCE_DB_USERNAME   = jsondecode(data.aws_secretsmanager_secret_version.get_tactical_products_rds_credentials.secret_string)["SOURCE_DB_USERNAME"]
-      SOURCE_DB_PASSWORD   = jsondecode(data.aws_secretsmanager_secret_version.get_tactical_products_rds_credentials.secret_string)["SOURCE_DB_PASSWORD"]
-      DB_HOSTNAME          = aws_db_instance.wardship_db.address
-      DB_NAME              = aws_db_instance.wardship_db.db_name
-      WARDSHIP_DB_USERNAME = local.application_data.accounts[local.environment].db_username
-      WARDSHIP_DB_PASSWORD = random_password.password.result
-    }
-  }
-  triggers = {
-    always_run = "${timestamp()}"
-  }
-}
-
-// executes a local script to set up the security group for the source RDS instance.
-resource "null_resource" "setup_source_rds_security_group" {
-  provisioner "local-exec" {
-    interpreter = ["bash", "-c"]
-    command     = "chmod +x ./setup-security-group-${local.environment}.sh; ./setup-security-group-${local.environment}.sh"
-
-    environment = {
-      RDS_SECURITY_GROUP            = aws_security_group.modernisation_wardship_access.id
-      RDS_SOURCE_ACCOUNT_ACCESS_KEY = jsondecode(data.aws_secretsmanager_secret_version.get_tactical_products_rds_credentials.secret_string)["ACCESS_KEY"]
-      RDS_SOURCE_ACCOUNT_SECRET_KEY = jsondecode(data.aws_secretsmanager_secret_version.get_tactical_products_rds_credentials.secret_string)["SECRET_KEY"]
-      RDS_SOURCE_ACCOUNT_REGION     = "eu-west-2"
-    }
-  }
-  triggers = {
-    always_run = "${timestamp()}"
-  }
-}
-
 // Sets up empty database for Development environment
 resource "null_resource" "setup_dev_db" {
   count = local.is-development ? 1 : 0