[NRL-1922] Use env for AWS_REGION in scripts. Fix other Sonar warnings

Author: mattdean3-nhs

scripts/aws_session_assume.py

@@ -1,4 +1,6 @@
 #!/usr/bin/env python
+import os
+
 import boto3
 
 _AWS_ACCOUNT_FOR_ENV = {
@@ -13,6 +15,8 @@
     "prod": "prod",
 }
 
+AWS_REGION = os.getenv("AWS_REGION", "eu-west-2")
+
 
 def get_account_name(env: str):
     if env not in _AWS_ACCOUNT_FOR_ENV:
@@ -23,7 +27,7 @@ def get_account_name(env: str):
 
 def get_account_id(env: str):
     account_name = get_account_name(env)
-    secretsmanager = boto3.client("secretsmanager", region_name="eu-west-2")
+    secretsmanager = boto3.client("secretsmanager", region_name=AWS_REGION)
     secret_id = f"nhsd-nrlf--mgmt--{account_name}-account-id"
     result = secretsmanager.get_secret_value(SecretId=secret_id)
     account_id = result["SecretString"]
@@ -34,7 +38,7 @@ def get_account_id(env: str):
 def get_boto_session(env: str) -> boto3.Session:
     account_id = get_account_id(env)
 
-    sts = boto3.client("sts", region_name="eu-west-2")
+    sts = boto3.client("sts", region_name=AWS_REGION)
     result = sts.assume_role(
         RoleArn=f"arn:aws:iam::{account_id}:role/terraform",
         RoleSessionName="get-account-id",

scripts/bootstrap.sh

@@ -122,12 +122,6 @@ function _bootstrap() {
     #----------------
     "destroy-non-mgmt")
       _check_non_mgmt || return 1
-      # TODO: Reintroduce the admin check - but should be fine for all developers
-      # if [[ "$(aws sts get-caller-identity)" != *dev* || "$(aws sts get-caller-identity)" != *NHSDAdminRole* ]]; then
-      #     echo "Please log in as dev with an Admin account" >&2
-      #     return 1
-      # fi
-
       local workspace
       workspace=$2
       # Fetch the resources using the AWS CLI command
@@ -148,7 +142,7 @@ function _bootstrap() {
                   ;;
               arn:aws:logs* )
                   echo "Deleting... : $arn"
-                  new_var=$(echo "$arn" | awk -F':' '{print $NF}')
+                  new_var=$(echo "$arn" | awk -F':' '{print $NF}') # NOSONAR (S1192) NF is not a env var
                   aws logs delete-log-group --log-group-name $new_var
                   ;;
               arn:aws:secretsmanager* )
@@ -164,13 +158,13 @@ function _bootstrap() {
                   ;;
               arn:aws:dynamodb* )
                   echo "Deleting... : $arn"
-                  new_var=$(echo "$arn" | awk -F':' '{print $NF}')
-                  table=$(echo "$arn" | awk -F'/' '{print $NF}')
+                  new_var=$(echo "$arn" | awk -F':' '{print $NF}')  # NOSONAR (S1192) NF is not a env var
+                  table=$(echo "$arn" | awk -F'/' '{print $NF}')  # NOSONAR (S1192) NF is not a env var
                   aws dynamodb delete-table --table-name $table
                   ;;
               arn:aws:s3* )
                   echo "Deleting... : $arn"
-                  new_var=$(echo "$arn" | awk -F':' '{print $NF}')
+                  new_var=$(echo "$arn" | awk -F':' '{print $NF}') # NOSONAR (S1192) NF is not a env var
                   local versioned_objects
                   versioned_objects=$(aws s3api list-object-versions \
                                       --bucket "${new_var}" \
@@ -184,9 +178,9 @@ function _bootstrap() {
                   ;;
               arn:aws:ssm* )
                   echo "Deleting... : $arn"
-                  new_var=$(echo "$arn" | awk -F':' '{print $NF}')
-                  suffix=$(echo "$arn" | awk -F'/' '{print $NF}')
-                  name=$(echo "$new_var" | awk -F'/' '{print $(NF-1)}')
+                  new_var=$(echo "$arn" | awk -F':' '{print $NF}')  # NOSONAR (S1192) NF is not a env var
+                  suffix=$(echo "$arn" | awk -F'/' '{print $NF}')  # NOSONAR (S1192) NF is not a env var
+                  name=$(echo "$new_var" | awk -F'/' '{print $(NF-1)}')  # NOSONAR (S1192) NF is not a env var
                   aws ssm delete-parameter --name $name/$suffix
                   ;;
               arn:aws:acm* )
@@ -195,8 +189,8 @@ function _bootstrap() {
                   ;;
               arn:aws:firehose* )
                   echo "Deleting... : $arn"
-                  new_var=$(echo "$arn" | awk -F':' '{print $NF}')
-                  name=$(echo "$new_var" | awk -F'/' '{print $NF}')
+                  new_var=$(echo "$arn" | awk -F':' '{print $NF}')  # NOSONAR (S1192) NF is not a env var
+                  name=$(echo "$new_var" | awk -F'/' '{print $NF}')  # NOSONAR (S1192) NF is not a env var
                   aws firehose delete-delivery-stream --delivery-stream-name $name
                   ;;
               * )

scripts/set_smoketest_permissions.py

@@ -1,16 +1,19 @@
 #!/usr/bin/env python
 import json
+import os
 
 import fire
 from aws_session_assume import get_boto_session
 
+AWS_REGION = os.getenv("AWS_REGION", "eu-west-2")
+
 
 def main(secret_env_name: str = "dev", bucket_env_name: str = "dev", env: str = "dev"):
     boto_session = get_boto_session(env)
 
     print("Getting smoke test parameters from AWS....")  # noqa
     smoke_test_params_name = f"nhsd-nrlf--{secret_env_name}--smoke-test-parameters"
-    secretsmanager = boto_session.client("secretsmanager", region_name="eu-west-2")
+    secretsmanager = boto_session.client("secretsmanager", region_name=AWS_REGION)
     smoke_test_params_value = secretsmanager.get_secret_value(
         SecretId=smoke_test_params_name
     )

scripts/truststore.sh

@@ -34,6 +34,7 @@ function _truststore_help() {
     echo "  restore-archived-ca <env>       - restore an archived certificate authority"
     echo "  restore-archived-cert <env>     - restore an archived client certificate"
     echo
+    return 0
 }
 
 # read an input file and substitute all the ${} entries
@@ -400,6 +401,8 @@ function _truststore() {
         "restore-archived-cert") _restore_archived_cert $args ;;
         *) _truststore_help $args ;;
     esac
+
+    return 0
 }
 
 _truststore $@

terraform/account-wide-infrastructure/modules/glue/LogSchemaGeneration/LogSchemaGeneration.ipynb

@@ -12,6 +12,7 @@
     ")\n",
     "import json\n",
     "from datetime import datetime, timedelta\n",
+    "import os\n",
     "from typing import List, Dict, Any"
    ]
   },
@@ -22,7 +23,8 @@
    "outputs": [],
    "source": [
     "# Initialize CloudWatch client\n",
-    "session = boto3.Session(profile_name=\"nhsd-nrlf-dev\")\n",
+    "AWS_REGION = os.getenv(\"AWS_REGION\", \"eu-west-2\")\n",
+    "session = boto3.Session(profile_name=\"nhsd-nrlf-dev\", region_name=AWS_REGION)\n",
     "client = session.client(\"logs\")"
    ]
   },