Combine LZ and DMZ develop branches

.github/workflows/frontend.yml

@@ -59,6 +59,10 @@ jobs:
         run: npm run build
       - name: Test
         run: npm run test
+      - name: Package
+        run: npx sls package
+        env:
+          SLS_DEBUG: '*'
   deploy_staging:
     needs: [lint, test]
     runs-on: ubuntu-latest

.github/workflows/infrastructure.yml

@@ -57,6 +57,7 @@ jobs:
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
 
       - name: Terraform validation
         run: terraform validate
@@ -66,13 +67,15 @@ jobs:
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
 
       - name: Terraform apply
         if: github.ref == 'refs/heads/develop'
         run: terraform apply stage.plan
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
 
       - if: ${{ always() }}
         run: rm stage.plan || true
@@ -96,25 +99,29 @@ jobs:
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
 
       - name: Terraform validation
         run: terraform validate
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
 
       - name: Terraform plan
         run: terraform plan -var-file=prod.tfvars -out prod.plan
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
 
       - name: Terraform apply
         if: github.ref == 'refs/heads/production'
         run: terraform apply prod.plan
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
+          AWS_DEFAULT_REGION: us-east-1
 
       - if: ${{ always() }}
         run: rm prod.plan || true

backend/Dockerfile.worker

@@ -58,8 +58,6 @@ RUN pip3.10 install --upgrade pip
 
 RUN apt remove dav1d && apt autoclean && apt autoremove
 
-# Python dependencies
-
 COPY worker/requirements.txt worker/requirements.txt
 
 RUN pip install -r worker/requirements.txt

backend/env.yml

@@ -1,8 +1,26 @@
 ---
 dev:
   DUMMY:
+  RESOURCE_POLICY:
+    - Effect: Allow
+      Principal: '*'
+      Action: execute-api:Invoke
+      Resource: execute-api:/${self:provider.stage}/*/*
+  ENDPOINT_TYPE: REGIONAL
+  VPC_ENDPOINT: dummy
+  REGION: us-east-1
 
-staging:
+staging-dmz:
+  REGION: us-east-1
+  ENDPOINT_TYPE: REGIONAL
+  RESOURCE_POLICY:
+    - Effect: Allow
+      Principal: '*'
+      Action: execute-api:Invoke
+      Resource: execute-api:/staging/*/*
+  COGNITO_URL: https://cognito-idp.us-east-1.amazonaws.com
+  BACKEND_DOMAIN: https://api.staging-cd.crossfeed.cyber.dhs.gov
+  EMAIL_REGION: us-east-1
   DB_DIALECT: postgres
   DB_PORT: 5432
   DB_HOST: ${ssm:/crossfeed/staging/DATABASE_HOST}
@@ -27,6 +45,7 @@ staging:
   LOGIN_GOV_JWT_KEY: ${ssm:/crossfeed/staging/LOGIN_GOV_JWT_KEY}
   LOGIN_GOV_ISSUER: ${ssm:/crossfeed/staging/LOGIN_GOV_ISSUER}
   DOMAIN: ${ssm:/crossfeed/staging/DOMAIN}
+  CERT_DOMAIN: api.staging-cd.crossfeed.cyber.dhs.gov
   FARGATE_SG_ID: ${ssm:/crossfeed/staging/WORKER_SG_ID}
   FARGATE_SUBNET_ID: ${ssm:/crossfeed/staging/WORKER_SUBNET_ID}
   DMZ_CIDR: ${ssm:/crossfeed/staging/DMZ_CIDR}
@@ -61,7 +80,17 @@ staging:
   REACT_APP_COGNITO_USER_POOL_ID: us-east-1_iWciADuOe
   REACT_APP_COGNITO_CALLBACK_URL: https://staging-cd.crossfeed.cyber.dhs.gov/okta-callback
 
-prod:
+prod-dmz:
+  REGION: us-east-1
+  ENDPOINT_TYPE: REGIONAL
+  RESOURCE_POLICY:
+    - Effect: Allow
+      Principal: '*'
+      Action: execute-api:Invoke
+      Resource: execute-api:/prod/*/*
+  COGNITO_URL: https://cognito-idp.us-east-1.amazonaws.com
+  BACKEND_DOMAIN: https://api.crossfeed.cyber.dhs.gov
+  EMAIL_REGION: us-east-1
   DB_DIALECT: postgres
   DB_PORT: 5432
   DB_HOST: ${ssm:/crossfeed/prod/DATABASE_HOST}
@@ -79,6 +108,7 @@ prod:
   LOGIN_GOV_JWT_KEY: ${ssm:/crossfeed/prod/LOGIN_GOV_JWT_KEY}
   LOGIN_GOV_ISSUER: ${ssm:/crossfeed/prod/LOGIN_GOV_ISSUER}
   DOMAIN: ${ssm:/crossfeed/prod/DOMAIN}
+  CERT_DOMAIN: crossfeed.cyber.dhs.gov
   FARGATE_SG_ID: ${ssm:/crossfeed/prod/WORKER_SG_ID}
   FARGATE_SUBNET_ID: ${ssm:/crossfeed/prod/WORKER_SUBNET_ID}
   FARGATE_MAX_CONCURRENCY: 300
@@ -112,6 +142,123 @@ prod:
   REACT_APP_COGNITO_USER_POOL_ID: us-gov-west-1_L1ZjQdUKA
   REACT_APP_COGNITO_CALLBACK_URL: https://crossfeed.cyber.dhs.gov/okta-callback
 
+staging:
+  REGION: us-gov-east-1
+  ENDPOINT_TYPE: PRIVATE
+  API_GATEWAY_NAME: staging-crossfeed
+  LAMBDA_ROLE: crossfeed-staging-us-gov-east-1-lambdaRole
+  STACK_NAME: crossfeed-staging
+  COGNITO_URL: https://cognito-idp.us-gov-west-1.amazonaws.com
+  BACKEND_DOMAIN: https://api.staging.crossfeed.cyber.dhs.gov
+  EMAIL_REGION: us-gov-west-1
+  DB_DIALECT: postgres
+  DB_PORT: 5432
+  DB_HOST: ${ssm:/crossfeed/staging/DATABASE_HOST}
+  DB_NAME: ${ssm:/crossfeed/staging/DATABASE_NAME}
+  DB_USERNAME: ${ssm:/crossfeed/staging/DATABASE_USER}
+  DB_PASSWORD: ${ssm:/crossfeed/staging/DATABASE_PASSWORD}
+  JWT_SECRET: ${ssm:/crossfeed/staging/APP_JWT_SECRET}
+  LOGIN_GOV_REDIRECT_URI: ${ssm:/crossfeed/staging/LOGIN_GOV_REDIRECT_URI}
+  LOGIN_GOV_BASE_URL: ${ssm:/crossfeed/staging/LOGIN_GOV_BASE_URL}
+  LOGIN_GOV_JWT_KEY: ${ssm:/crossfeed/staging/LOGIN_GOV_JWT_KEY}
+  LOGIN_GOV_ISSUER: ${ssm:/crossfeed/staging/LOGIN_GOV_ISSUER}
+  DOMAIN: ${ssm:/crossfeed/staging/DOMAIN}
+  CERT_DOMAIN: staging.crossfeed.cyber.dhs.gov
+  FARGATE_SG_ID: ${ssm:/crossfeed/staging/WORKER_SG_ID}
+  FARGATE_SUBNET_ID: ${ssm:/crossfeed/staging/WORKER_SUBNET_ID}
+  FARGATE_MAX_CONCURRENCY: 100
+  SCHEDULER_ORGS_PER_SCANTASK: 10
+  FARGATE_CLUSTER_NAME: crossfeed-staging-worker
+  FARGATE_TASK_DEFINITION_NAME: crossfeed-staging-worker
+  FARGATE_LOG_GROUP_NAME: crossfeed-staging-worker
+  CROSSFEED_SUPPORT_EMAIL_SENDER: [email protected]
+  CROSSFEED_SUPPORT_EMAIL_REPLYTO: [email protected]
+  FRONTEND_DOMAIN: https://staging.crossfeed.cyber.dhs.gov
+  SLS_LAMBDA_PREFIX: '${self:service}-${self:provider.stage}'
+  USE_COGNITO: 1
+  REACT_APP_USER_POOL_ID: ${ssm:/crossfeed/staging/USER_POOL_ID}
+  REACT_APP_USER_POOL_KEY: ${ssm(raw):/crossfeed/staging/OKTA_USER_POOL_KEY}
+  WORKER_USER_AGENT: ${ssm:/crossfeed/staging/WORKER_USER_AGENT}
+  WORKER_SIGNATURE_PUBLIC_KEY: ${ssm:/crossfeed/staging/WORKER_SIGNATURE_PUBLIC_KEY}
+  ELASTICSEARCH_ENDPOINT: ${ssm:/crossfeed/staging/ELASTICSEARCH_ENDPOINT}
+  REACT_APP_TERMS_VERSION: ${ssm:/crossfeed/staging/REACT_APP_TERMS_VERSION}
+  MATOMO_URL: http://matomo.cfs.lz.us-cert.gov
+  EXPORT_BUCKET_NAME: cisa-crossfeed-staging-exports
+  PE_API_URL: ${ssm:/crossfeed/staging/PE_API_URL}
+  REPORTS_BUCKET_NAME: cisa-crossfeed-staging-reports
+  VPC_ENDPOINT: ${ssm:/crossfeed/staging/BACKEND_VPC_ENDPOINT}
+  CLOUDWATCH_BUCKET_NAME: cisa-crossfeed-staging-cloudwatch
+  STAGE: staging
+  PE_FARGATE_CLUSTER_NAME: pe-staging-worker
+  PE_FARGATE_TASK_DEFINITION_NAME: pe-staging-worker
+  EMAIL_BUCKET_NAME: cisa-crossfeed-staging-html-email
+  REACT_APP_COGNITO_DOMAIN: crossfeed-staging-okta-idp.auth-fips.us-gov-west-1.amazoncognito.com
+  REACT_APP_COGNITO_CLIENT_ID: 3vd67chnkk7dg3jt3nkoidf94e
+  REACT_APP_COGNITO_USER_POOL_ID: us-gov-west-1_N84vh2cq2
+  REACT_APP_COGNITO_CALLBACK_URL: https://staging.crossfeed.cyber.dhs.gov/okta-callback
+  MDL_USERNAME: ${ssm:/crossfeed/staging/MDL_USERNAME}
+  MDL_PASSWORD: ${ssm:/crossfeed/staging/MDL_PASSWORD}
+  MDL_NAME: ${ssm:/crossfeed/staging/MDL_NAME}
+
+prod:
+  REGION: us-gov-east-1
+  ENDPOINT_TYPE: PRIVATE
+  COGNITO_URL: https://cognito-idp.us-gov-west-1.amazonaws.com
+  BACKEND_DOMAIN: https://api.crossfeed.cyber.dhs.gov
+  EMAIL_REGION: us-gov-west-1
+  DB_DIALECT: postgres
+  DB_PORT: 5432
+  DB_HOST: ${ssm:/crossfeed/prod/DATABASE_HOST}
+  DB_NAME: ${ssm:/crossfeed/prod/DATABASE_NAME}
+  DB_USERNAME: ${ssm:/crossfeed/prod/DATABASE_USER}
+  DB_PASSWORD: ${ssm:/crossfeed/prod/DATABASE_PASSWORD}
+  MDL_USERNAME: ${ssm:/crossfeed/prod/MDL_USERNAME}
+  MDL_PASSWORD: ${ssm:/crossfeed/prod/MDL_PASSWORD}
+  MDL_NAME: ${ssm:/crossfeed/prod/MDL_NAME}
+  JWT_SECRET: ${ssm:/crossfeed/prod/APP_JWT_SECRET}
+  LOGIN_GOV_REDIRECT_URI: ${ssm:/crossfeed/prod/LOGIN_GOV_REDIRECT_URI}
+  LOGIN_GOV_BASE_URL: ${ssm:/crossfeed/prod/LOGIN_GOV_BASE_URL}
+  LOGIN_GOV_JWT_KEY: ${ssm:/crossfeed/prod/LOGIN_GOV_JWT_KEY}
+  LOGIN_GOV_ISSUER: ${ssm:/crossfeed/prod/LOGIN_GOV_ISSUER}
+  DOMAIN: ${ssm:/crossfeed/prod/DOMAIN}
+  CERT_DOMAIN: staging.crossfeed.cyber.dhs.gov
+  FARGATE_SG_ID: ${ssm:/crossfeed/prod/WORKER_SG_ID}
+  FARGATE_SUBNET_ID: ${ssm:/crossfeed/prod/WORKER_SUBNET_ID}
+  FARGATE_MAX_CONCURRENCY: 300
+  SCHEDULER_ORGS_PER_SCANTASK: 50
+  FARGATE_CLUSTER_NAME: crossfeed-prod-worker
+  FARGATE_TASK_DEFINITION_NAME: crossfeed-prod-worker
+  FARGATE_LOG_GROUP_NAME: crossfeed-prod-worker
+  CROSSFEED_SUPPORT_EMAIL_SENDER: [email protected]
+  CROSSFEED_SUPPORT_EMAIL_REPLYTO: [email protected]
+  FRONTEND_DOMAIN: https://crossfeed.cyber.dhs.gov
+  SLS_LAMBDA_PREFIX: '${self:service}-${self:provider.stage}'
+  USE_COGNITO: 1
+  REACT_APP_USER_POOL_ID: ${ssm:/crossfeed/prod/USER_POOL_ID}
+  REACT_APP_USER_POOL_KEY: ${ssm(raw):/crossfeed/prod/OKTA_USER_POOL_KEY}
+  WORKER_USER_AGENT: ${ssm:/crossfeed/prod/WORKER_USER_AGENT}
+  WORKER_SIGNATURE_PUBLIC_KEY: ${ssm:/crossfeed/prod/WORKER_SIGNATURE_PUBLIC_KEY}
+  ELASTICSEARCH_ENDPOINT: ${ssm:/crossfeed/prod/ELASTICSEARCH_ENDPOINT}
+  REACT_APP_TERMS_VERSION: ${ssm:/crossfeed/prod/REACT_APP_TERMS_VERSION}
+  MATOMO_URL: http://matomo.cfs.lz.us-cert.gov
+  EXPORT_BUCKET_NAME: cisa-crossfeed-prod-exports
+  PE_API_URL: ${ssm:/crossfeed/prod/PE_API_URL}
+  REPORTS_BUCKET_NAME: cisa-crossfeed-prod-reports
+  VPC_ENDPOINT: ${ssm:/crossfeed/prod/BACKEND_VPC_ENDPOINT}
+  CLOUDWATCH_BUCKET_NAME: cisa-crossfeed-prod-cloudwatch
+  STAGE: prod
+  PE_FARGATE_CLUSTER_NAME: pe-prod-worker
+  PE_FARGATE_TASK_DEFINITION_NAME: pe-prod-worker
+  EMAIL_BUCKET_NAME: cisa-crossfeed-prod-html-email
+  REACT_APP_COGNITO_DOMAIN: crossfeed-prod-okta-idp.auth-fips.us-gov-west-1.amazoncognito.com
+  REACT_APP_COGNITO_CLIENT_ID: 1nacnjc6sejbala9uf97eeq9o1
+  REACT_APP_COGNITO_USER_POOL_ID: us-gov-west-1_L1ZjQdUKA
+  REACT_APP_COGNITO_CALLBACK_URL: https://crossfeed.cyber.dhs.gov/okta-callback
+
+
+## added dev option for vpc to remove the warning
+## from 'npx sls package' during backend 'test' github action
+## Warning: Invalid configuration encountered at 'provider.vpc': must be object
 dev-vpc:
   securityGroupIds:
     - dummy
@@ -130,6 +277,22 @@ prod-vpc:
   subnetIds:
     - ${ssm:/crossfeed/prod/SUBNET_ID}
 
+staging-lz-vpc:
+  securityGroupIds:
+    - ${ssm:/crossfeed/staging/SG_ID}
+  subnetIds:
+    - ${ssm:/crossfeed/staging/SUBNET_ID}
+
+prod-lz-vpc:
+  securityGroupIds:
+    - ${ssm:/crossfeed/prod/SG_ID}
+  subnetIds:
+    - ${ssm:/crossfeed/prod/SUBNET_ID}
+
 staging-ecs-cluster: ${ssm:/crossfeed/staging/WORKER_CLUSTER_ARN}
 
 prod-ecs-cluster: ${ssm:/crossfeed/prod/WORKER_CLUSTER_ARN}
+
+staging-lz-ecs-cluster: ${ssm:/crossfeed/staging/WORKER_CLUSTER_ARN}
+
+prod-lz-ecs-cluster: ${ssm:/crossfeed/prod/WORKER_CLUSTER_ARN}