fix(infra): fix the remaining terraform constant changes

.circleci/common.yml

@@ -169,8 +169,6 @@ commands:
             echo 'export SECRET_VALUE="$(aws secretsmanager get-secret-value --secret-id CodeBuild/Default --query SecretString --output text)"' >> "$BASH_ENV"
             echo 'export TERRAFORM_TOKEN="$(echo $SECRET_VALUE | jq -r '.terraform_token')"' >> "$BASH_ENV"
             echo 'export PAGERDUTY_TOKEN="$(echo $SECRET_VALUE | jq -r '.mozilla_pagerduty_token')"' >> "$BASH_ENV"
-            echo 'export GITHUB_ACCESS_TOKEN="$(echo $SECRET_VALUE | jq -r '.github_access_token')"' >> "$BASH_ENV"
-            echo 'export GITHUB_TOKEN="$(echo $SECRET_VALUE | jq -r '.github_access_token')"' >> "$BASH_ENV"
       - run:
           name: Save off terraform token
           command: |
@@ -180,6 +178,60 @@ commands:
             rc="${rc}}"
             echo "$rc" > ~/.terraformrc
 
+  setup_github_bot:
+    steps:
+      - run:
+          name: Get Github Bot Token
+          command: |
+            app_id=$GITHUB_APP_ID
+            pem="$(echo "$GITHUB_APP_PRIVATE_KEY" | base64 -d)"
+            installation_id=$GITHUB_INSTALLATION_APP_ID
+
+            now=$(date +%s)
+            iat=$((${now} - 60)) # Issues 60 seconds in the past
+            exp=$((${now} + 600)) # Expires 15 minutes in the future
+
+            b64enc() { openssl base64 | tr -d '=' | tr '/+' '_-' | tr -d '\n'; }
+
+            header_json='{
+                "typ":"JWT",
+                "alg":"RS256"
+            }'
+            # Header encode
+            header=$( echo -n "${header_json}" | b64enc )
+
+            payload_json='{
+                "iat":'"${iat}"',
+                "exp":'"${exp}"',
+                "iss":'"${app_id}"'
+            }'
+            # Payload encode
+            payload=$( echo -n "${payload_json}" | b64enc )
+
+            # Signature
+            header_payload="${header}"."${payload}"
+            signature=$( 
+                openssl dgst -sha256 -sign <(echo -n "${pem}") \
+                <(echo -n "${header_payload}") | b64enc 
+            )
+
+            # Create JWT
+            JWT="${header_payload}"."${signature}"
+
+            # Make a POST request to GitHub API to get the installation token
+            response=$(curl -s -X POST \
+              -H "Accept: application/vnd.github.v3+json" \
+              -H "Authorization: Bearer $JWT" \
+              -d "{}" \
+              "https://api.github.com/app/installations/$installation_id/access_tokens")
+
+            # Extract the token from the response
+            token=$(echo "$response" | jq -r '.token')
+            echo "export GITHUB_TOKEN=$token" >> $BASH_ENV
+            echo "export GH_TOKEN=$token" >> $BASH_ENV
+            echo "export GITHUB_ACCESS_TOKEN=$token" >> $BASH_ENV
+
+
 jobs:
 
   infrastructure:
@@ -224,6 +276,7 @@ jobs:
             mv tfcmt /home/circleci/tfcmt
             chmod a+x /home/circleci/tfcmt
       - install_codebuild_secrets
+      - setup_github_bot
       - unless:
           # Only compile if we do not use raw hcl
           condition: <<parameters.uses_raw_hcl>>

infrastructure/annotations-api/src/dynamodb.ts

@@ -49,6 +49,16 @@ export class DynamoDB extends Construct {
           },
         ],
       },
+      lifecycle: {
+        ignoreChanges: [
+          // Bug in terraform with DynamoDB and global secondary indexes
+          // https://github.com/hashicorp/terraform-provider-aws/issues/671
+          // https://github.com/hashicorp/terraform-provider-aws/issues/671#issuecomment-346711738
+          'global_secondary_index',
+          'read_capacity',
+          'write_capacity',
+        ],
+      },
     });
   }
 }

infrastructure/pocket-event-bridge/src/event-rules/shareable-lists-api-events/shareableListItemEventRules.ts

@@ -52,7 +52,7 @@ export class ShareableListItemEvents extends Construct {
       this,
       pagerDuty,
       this.snsTopicDlq.name,
-      `${eventConfig.shareableList.name}-Rule-dlq-alarm`,
+      `${eventConfig.shareableListItem.name}-Rule-dlq-alarm`,
       true,
       4,
       300,

infrastructure/pocket-event-bridge/src/event-rules/utils.ts

@@ -1,6 +1,7 @@
 import { config } from '../config';
 import { PocketPagerDuty } from '@pocket-tools/terraform-modules';
 import { cloudwatchMetricAlarm } from '@cdktf/provider-aws';
+import { Construct } from 'constructs';
 
 /**
  * Function to create alarms for Dead-letter queues
@@ -18,7 +19,7 @@ import { cloudwatchMetricAlarm } from '@cdktf/provider-aws';
  * @private
  */
 export function createDeadLetterQueueAlarm(
-  stack,
+  stack: Construct,
   pagerDuty: PocketPagerDuty,
   queueName: string,
   alarmName: string,

packages/terraform-modules/src/base/ApplicationDynamoDBTable.spec.ts

@@ -165,6 +165,28 @@ describe('ApplicationDynamoDBTable', () => {
     expect(synthed).toMatchSnapshot();
   });
 
+  it('renders dynamo db table ignoring global secondary iundex changes', () => {
+    BASE_CONFIG.writeCapacity = {
+      tracking: 1,
+      max: 10,
+      min: 3,
+    };
+
+    BASE_CONFIG.readCapacity = {
+      tracking: 1,
+      max: 10,
+      min: 3,
+    };
+
+    const synthed = Testing.synthScope((stack) => {
+      new ApplicationDynamoDBTable(stack, 'testDynamoDBTable', {
+        ...BASE_CONFIG,
+        lifecycle: { ignoreChanges: ['global_secondary_index'] },
+      });
+    });
+    expect(synthed).toMatchSnapshot();
+  });
+
   it('renders dynamo db table that is not protected from being destroyed', () => {
     BASE_CONFIG.preventDestroyTable = false;
 

packages/terraform-modules/src/base/ApplicationDynamoDBTable.ts

@@ -80,13 +80,19 @@ export class ApplicationDynamoDBTable extends Construct {
       config.capacityMode ?? ApplicationDynamoDBTableCapacityMode.PROVISIONED
     ).valueOf();
 
+    const ignoreChanges = [
+      'read_capacity',
+      'write_capacity',
+      ...(config.lifecycle ? config.lifecycle.ignoreChanges : []),
+    ].filter((value) => typeof value === 'string');
+
     this.dynamodb = new dynamodbTable.DynamodbTable(this, `dynamodb_table`, {
       ...config.tableConfig,
       billingMode: billingMode,
       tags: config.tags,
       name: config.prefix,
       lifecycle: {
-        ignoreChanges: ['read_capacity', 'write_capacity'],
+        ignoreChanges: [...new Set(ignoreChanges)], // use set to remove duplicates
         // Protect the table from being removed, unless preventDestroyTable is explicitly set to false.
         preventDestroy: config.preventDestroyTable !== false,
       },

packages/terraform-modules/src/base/__snapshots__/ApplicationDynamoDBTable.spec.ts.snap

@@ -305,6 +305,226 @@ exports[`ApplicationDynamoDBTable renders dynamo db table global secondary index
 }"
 `;
 
+exports[`ApplicationDynamoDBTable renders dynamo db table ignoring global secondary iundex changes 1`] = `
+"{
+  "data": {
+    "aws_iam_policy_document": {
+      "testDynamoDBTable_ReadCapacity_assume_role_policy_document_54F698F0": {
+        "statement": [
+          {
+            "actions": [
+              "sts:AssumeRole"
+            ],
+            "effect": "Allow",
+            "principals": [
+              {
+                "identifiers": [
+                  "application-autoscaling.amazonaws.com"
+                ],
+                "type": "Service"
+              }
+            ]
+          }
+        ]
+      },
+      "testDynamoDBTable_ReadCapacity_policy_document_EF789C68": {
+        "statement": [
+          {
+            "actions": [
+              "application-autoscaling:*",
+              "cloudwatch:DescribeAlarms",
+              "cloudwatch:PutMetricAlarm"
+            ],
+            "effect": "Allow",
+            "resources": [
+              "*"
+            ]
+          },
+          {
+            "actions": [
+              "dynamodb:DescribeTable",
+              "dynamodb:UpdateTable"
+            ],
+            "effect": "Allow",
+            "resources": [
+              "\${aws_dynamodb_table.testDynamoDBTable_dynamodb_table_A3DD49A4.arn}",
+              "\${aws_dynamodb_table.testDynamoDBTable_dynamodb_table_A3DD49A4.arn}*"
+            ]
+          }
+        ]
+      },
+      "testDynamoDBTable_WriteCapacity_assume_role_policy_document_5A7EA325": {
+        "statement": [
+          {
+            "actions": [
+              "sts:AssumeRole"
+            ],
+            "effect": "Allow",
+            "principals": [
+              {
+                "identifiers": [
+                  "application-autoscaling.amazonaws.com"
+                ],
+                "type": "Service"
+              }
+            ]
+          }
+        ]
+      },
+      "testDynamoDBTable_WriteCapacity_policy_document_9032D023": {
+        "statement": [
+          {
+            "actions": [
+              "application-autoscaling:*",
+              "cloudwatch:DescribeAlarms",
+              "cloudwatch:PutMetricAlarm"
+            ],
+            "effect": "Allow",
+            "resources": [
+              "*"
+            ]
+          },
+          {
+            "actions": [
+              "dynamodb:DescribeTable",
+              "dynamodb:UpdateTable"
+            ],
+            "effect": "Allow",
+            "resources": [
+              "\${aws_dynamodb_table.testDynamoDBTable_dynamodb_table_A3DD49A4.arn}",
+              "\${aws_dynamodb_table.testDynamoDBTable_dynamodb_table_A3DD49A4.arn}*"
+            ]
+          }
+        ]
+      }
+    }
+  },
+  "resource": {
+    "aws_appautoscaling_policy": {
+      "testDynamoDBTable_testDynamoDBTable_dynamodb_table_A3DD49A4_ReadCapacity_table_policy_558BE4C0": {
+        "depends_on": [
+          "aws_appautoscaling_target.testDynamoDBTable_testDynamoDBTable_dynamodb_table_A3DD49A4_ReadCapacity_table_target_5A95550B",
+          "aws_dynamodb_table.testDynamoDBTable_dynamodb_table_A3DD49A4"
+        ],
+        "name": "DynamoDBReadCapacityUtilization:\${aws_appautoscaling_target.testDynamoDBTable_testDynamoDBTable_dynamodb_table_A3DD49A4_ReadCapacity_table_target_5A95550B.resource_id}",
+        "policy_type": "TargetTrackingScaling",
+        "resource_id": "\${aws_appautoscaling_target.testDynamoDBTable_testDynamoDBTable_dynamodb_table_A3DD49A4_ReadCapacity_table_target_5A95550B.resource_id}",
+        "scalable_dimension": "\${aws_appautoscaling_target.testDynamoDBTable_testDynamoDBTable_dynamodb_table_A3DD49A4_ReadCapacity_table_target_5A95550B.scalable_dimension}",
+        "service_namespace": "\${aws_appautoscaling_target.testDynamoDBTable_testDynamoDBTable_dynamodb_table_A3DD49A4_ReadCapacity_table_target_5A95550B.service_namespace}",
+        "target_tracking_scaling_policy_configuration": {
+          "predefined_metric_specification": {
+            "predefined_metric_type": "DynamoDBReadCapacityUtilization"
+          },
+          "target_value": 1
+        }
+      },
+      "testDynamoDBTable_testDynamoDBTable_dynamodb_table_A3DD49A4_WriteCapacity_table_policy_45352666": {
+        "depends_on": [
+          "aws_appautoscaling_target.testDynamoDBTable_testDynamoDBTable_dynamodb_table_A3DD49A4_WriteCapacity_table_target_EC052FEE",
+          "aws_dynamodb_table.testDynamoDBTable_dynamodb_table_A3DD49A4"
+        ],
+        "name": "DynamoDBWriteCapacityUtilization:\${aws_appautoscaling_target.testDynamoDBTable_testDynamoDBTable_dynamodb_table_A3DD49A4_WriteCapacity_table_target_EC052FEE.resource_id}",
+        "policy_type": "TargetTrackingScaling",
+        "resource_id": "\${aws_appautoscaling_target.testDynamoDBTable_testDynamoDBTable_dynamodb_table_A3DD49A4_WriteCapacity_table_target_EC052FEE.resource_id}",
+        "scalable_dimension": "\${aws_appautoscaling_target.testDynamoDBTable_testDynamoDBTable_dynamodb_table_A3DD49A4_WriteCapacity_table_target_EC052FEE.scalable_dimension}",
+        "service_namespace": "\${aws_appautoscaling_target.testDynamoDBTable_testDynamoDBTable_dynamodb_table_A3DD49A4_WriteCapacity_table_target_EC052FEE.service_namespace}",
+        "target_tracking_scaling_policy_configuration": {
+          "predefined_metric_specification": {
+            "predefined_metric_type": "DynamoDBWriteCapacityUtilization"
+          },
+          "target_value": 1
+        }
+      }
+    },
+    "aws_appautoscaling_target": {
+      "testDynamoDBTable_testDynamoDBTable_dynamodb_table_A3DD49A4_ReadCapacity_table_target_5A95550B": {
+        "depends_on": [
+          "aws_dynamodb_table.testDynamoDBTable_dynamodb_table_A3DD49A4"
+        ],
+        "max_capacity": 10,
+        "min_capacity": 3,
+        "resource_id": "table/\${aws_dynamodb_table.testDynamoDBTable_dynamodb_table_A3DD49A4.name}",
+        "role_arn": "\${aws_iam_role.testDynamoDBTable_ReadCapacity_role_2B9645BB.arn}",
+        "scalable_dimension": "dynamodb:table:ReadCapacityUnits",
+        "service_namespace": "dynamodb"
+      },
+      "testDynamoDBTable_testDynamoDBTable_dynamodb_table_A3DD49A4_WriteCapacity_table_target_EC052FEE": {
+        "depends_on": [
+          "aws_dynamodb_table.testDynamoDBTable_dynamodb_table_A3DD49A4"
+        ],
+        "max_capacity": 10,
+        "min_capacity": 3,
+        "resource_id": "table/\${aws_dynamodb_table.testDynamoDBTable_dynamodb_table_A3DD49A4.name}",
+        "role_arn": "\${aws_iam_role.testDynamoDBTable_WriteCapacity_role_4BB8E3F1.arn}",
+        "scalable_dimension": "dynamodb:table:WriteCapacityUnits",
+        "service_namespace": "dynamodb"
+      }
+    },
+    "aws_dynamodb_table": {
+      "testDynamoDBTable_dynamodb_table_A3DD49A4": {
+        "attribute": [
+          {
+            "name": "attribeautiful",
+            "type": "shrugs!"
+          }
+        ],
+        "billing_mode": "PROVISIONED",
+        "global_secondary_index": [
+        ],
+        "hash_key": "123",
+        "lifecycle": {
+          "ignore_changes": [
+            "read_capacity",
+            "write_capacity",
+            "global_secondary_index"
+          ],
+          "prevent_destroy": true
+        },
+        "name": "abides-"
+      }
+    },
+    "aws_iam_policy": {
+      "testDynamoDBTable_ReadCapacity_autoscaling_policy_52DA6649": {
+        "name": "abides--ReadCapacity-AutoScalingPolicy",
+        "policy": "\${data.aws_iam_policy_document.testDynamoDBTable_ReadCapacity_policy_document_EF789C68.json}"
+      },
+      "testDynamoDBTable_WriteCapacity_autoscaling_policy_9632CE60": {
+        "name": "abides--WriteCapacity-AutoScalingPolicy",
+        "policy": "\${data.aws_iam_policy_document.testDynamoDBTable_WriteCapacity_policy_document_9032D023.json}"
+      }
+    },
+    "aws_iam_role": {
+      "testDynamoDBTable_ReadCapacity_role_2B9645BB": {
+        "assume_role_policy": "\${data.aws_iam_policy_document.testDynamoDBTable_ReadCapacity_assume_role_policy_document_54F698F0.json}",
+        "name": "abides--ReadCapacity-AutoScalingRole"
+      },
+      "testDynamoDBTable_WriteCapacity_role_4BB8E3F1": {
+        "assume_role_policy": "\${data.aws_iam_policy_document.testDynamoDBTable_WriteCapacity_assume_role_policy_document_5A7EA325.json}",
+        "name": "abides--WriteCapacity-AutoScalingRole"
+      }
+    },
+    "aws_iam_role_policy_attachment": {
+      "testDynamoDBTable_ReadCapacity_role_attachment_3C0829C2": {
+        "depends_on": [
+          "aws_iam_role.testDynamoDBTable_ReadCapacity_role_2B9645BB",
+          "aws_iam_policy.testDynamoDBTable_ReadCapacity_autoscaling_policy_52DA6649"
+        ],
+        "policy_arn": "\${aws_iam_policy.testDynamoDBTable_ReadCapacity_autoscaling_policy_52DA6649.arn}",
+        "role": "\${aws_iam_role.testDynamoDBTable_ReadCapacity_role_2B9645BB.name}"
+      },
+      "testDynamoDBTable_WriteCapacity_role_attachment_8ABB9833": {
+        "depends_on": [
+          "aws_iam_role.testDynamoDBTable_WriteCapacity_role_4BB8E3F1",
+          "aws_iam_policy.testDynamoDBTable_WriteCapacity_autoscaling_policy_9632CE60"
+        ],
+        "policy_arn": "\${aws_iam_policy.testDynamoDBTable_WriteCapacity_autoscaling_policy_9632CE60.arn}",
+        "role": "\${aws_iam_role.testDynamoDBTable_WriteCapacity_role_4BB8E3F1.name}"
+      }
+    }
+  }
+}"
+`;
+
 exports[`ApplicationDynamoDBTable renders dynamo db table that is not protected from being destroyed 1`] = `
 "{
   "resource": {