[Issue 1621] Adds Analytics secrets

[coilysiren]

Summary

Fixes #1621

Time to review: 2 mins

Changes proposed

• Adds the dev / staging / prod configuration for the analytics service secrets
• Adds the "ACTION" env var for dev / staging / prod, with inline explanations of what it does

Relevant Terraform diff

  # module.service.aws_ecs_task_definition.app must be replaced
-/+ resource "aws_ecs_task_definition" "app" {
      ~ arn                      = "arn:aws:ecs:us-east-1:315341936575:task-definition/analytics-dev:11" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-east-1:315341936575:task-definition/analytics-dev" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [
              ~ {
                  ~ environment            = [
                      + {
                          + name  = "ACTION"
                          + value = "show-results"
                        },
                        {
                            name  = "AWS_REGION"
                            value = "us-east-1"
                        },
                        # (6 unchanged elements hidden)
                    ]
                  ~ linuxParameters        = {
                      ~ capabilities       = {
                          - add  = []
                            # (1 unchanged attribute hidden)
                        }
                        # (1 unchanged attribute hidden)
                    }
                  - mountPoints            = []
                    name                   = "analytics-dev"
                  - portMappings           = []
                  ~ secrets                = [
                      + {
                          + name      = "ANALYTICS_REPORTING_CHANNEL_ID"
                          + valueFrom = "/analytics/dev/reporting-channel-id"
                        },
                      + {
                          + name      = "ANALYTICS_SLACK_BOT_TOKEN"
                          + valueFrom = "/analytics/dev/slack-bot-token"
                        },
                      + {
                          + name      = "GH_TOKEN"
                          + valueFrom = "/analytics/dev/github-token"
                        },
                    ]
                  - systemControls         = []
                  - volumesFrom            = []
                    # (6 unchanged attributes hidden)
                },
            ] # forces replacement
        )
      ~ id                       = "analytics-dev" -> (known after apply)
      ~ revision                 = 11 -> (known after apply)
      - tags                     = {} -> null
        # (9 unchanged attributes hidden)
    }

  # module.service.aws_iam_role_policy.task_executor will be updated in-place
  ~ resource "aws_iam_role_policy" "task_executor" {
        id     = "analytics-dev-task-executor:analytics-dev-task-executor-role-policy"
        name   = "analytics-dev-task-executor-role-policy"
      ~ policy = jsonencode(
          ~ {
              ~ Statement = [
                    # (8 unchanged elements hidden)
                    {
                        Action   = [
                            "ecr:GetDownloadUrlForLayer",
                            "ecr:BatchGetImage",
                            "ecr:BatchCheckLayerAvailability",
                        ]
                        Effect   = "Allow"
                        Resource = "arn:aws:ecr:us-east-1:315341936575:repository/simpler-grants-gov-analytics"
                        Sid      = "ECRPullAccess"
                    },
                  + {
                      + Action   = "ssm:GetParameters"
                      + Effect   = "Allow"
                      + Resource = [
                          + "arn:aws:ssm:*:*:parameter/analytics/dev/slack-bot-token",
                          + "arn:aws:ssm:*:*:parameter/analytics/dev/reporting-channel-id",
                          + "arn:aws:ssm:*:*:parameter/analytics/dev/github-token",
                        ]
                      + Sid      = "SecretsAccess"
                    },
                ]
                # (1 unchanged attribute hidden)
            }
        )
        # (1 unchanged attribute hidden)
    }

Testing

https://us-east-1.console.aws.amazon.com/ecs/v2/clusters/analytics-dev/tasks/77e9ca77054345b1a8c97b9ba3601858/logs?region=us-east-1

It's working now 😎

[coilysiren]

#837 isn't done yet, so I added my own personal token

[coilysiren]

dev / staging are #z_bot-analytics-ci-test, prod is #z_bot-sprint-reporting

[widal001]

Looks good to me! Not super familiar with terraform code, but the comments are helpful and the screenshot shared in the PR looks right as well!