feat(core): ARC-1906 fetch env from ssm #52
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| NODE_ENV= | ||
| LOG_LEVEL= | ||
| DB_HOST= | ||
| DB_PORT= | ||
| DB_USER= | ||
| DB_PASSWORD= | ||
| DB_DATABASE= | ||
| DB_SCHEMA= | ||
| REDIS_HOST= | ||
| REDIS_PORT= | ||
| REDIS_URL= | ||
| REDIS_PASSWORD= | ||
| REDIS_DATABASE= | ||
| JWT_SECRET= | ||
| JWT_ISSUER= |
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| import {DataAwsSecurityGroup} from '@cdktf/provider-aws/lib/data-aws-security-group'; | ||
| import {DataAwsSsmParameter} from '@cdktf/provider-aws/lib/data-aws-ssm-parameter'; | ||
| import {DataAwsSubnets} from '@cdktf/provider-aws/lib/data-aws-subnets'; | ||
| import {TerraformStack} from 'cdktf'; | ||
| import {readFileSync} from 'fs'; | ||
|
|
||
| export const env = { | ||
|
There was a problem hiding this comment. Why do we need to add properties here also? There was a problem hiding this comment. These are all params that should be loaded from SSM. The idea is that the env file is a list of SSM param keys, we query SSM for those keys at runtime, and then we pass the values from SSM to the CDK where needed. There was a problem hiding this comment. we will be maintainig all our env variables here only. not in .env. storing all our env inside an object makes them accessible easily, we don't have to add any further logic to separate our required env from the system env variables. this is one approcah, and may be its possible to do in some better way There was a problem hiding this comment. Let's discuss it tomorrow @Tyagi-Sunny There was a problem hiding this comment. @jamescrowley321 so we can easily assume that the properties that user wants to fetch from SSM. User will have to specify those beforehand. There was a problem hiding this comment. Here is what I recommend
There was a problem hiding this comment. Why cant we do all of this in Code Pipeline ? Ideally we do these things in code pipeline or jenkins or whatever tool we use for CI/CD. So that application code remains unaware of tool to use. It just accesses everything from env. CI/CD pipeline scripts read values from SSM or Vault and put into the env while deploying the service. |
||
| AWS_REGION: "", | ||
| DB_HOST: "", | ||
| DB_PORT: 5432, | ||
| DB_USER: "", | ||
| DB_PASSWORD: "", | ||
| DB_DATABASE: "", | ||
| DB_SCHEMA: "", | ||
| JWT_SECRET: "", | ||
| ACM_CERTIFICATE_ARN: "", | ||
| HOSTED_ZONE_ID: "", | ||
| DOMAIN_NAME: "", | ||
| NAMESPACE: "", | ||
| ENV: "", | ||
| S3_BUCKET: "" | ||
| }; | ||
|
|
||
| interface EnvVar { | ||
| [key: string]: string; | ||
| } | ||
|
|
||
| export const getSubnetIds = (scope: TerraformStack) => { | ||
| const subnets = new DataAwsSubnets(scope, "private_subnets", { | ||
| filter: [ | ||
| { | ||
| name: "tag:Name", | ||
| values: ['demoTagName'], //Replace demoTagName by Name Tag of subnet id | ||
| }, | ||
| ], | ||
| }); | ||
| return subnets.ids; | ||
| } | ||
|
|
||
| export const getSecurityGroup = (scope: TerraformStack) => { | ||
| const sgroup = new DataAwsSecurityGroup(scope, "security_group", { | ||
| filter: [ | ||
| { | ||
| name: "tag:Name", | ||
| values: ['demoTagName'], //Replace demoTagName by Name Tag of security group | ||
| }, | ||
| ], | ||
| }); | ||
| return [sgroup.id]; | ||
| }; | ||
|
|
||
|
|
||
| export const getEnv = (scope: TerraformStack) => { | ||
| let envVar: EnvVar = {}; | ||
| checkEnv(); | ||
|
|
||
| for (const key in process.env) { | ||
| // Check if the property is directly defined on the object (not inherited) | ||
| if (process.env.hasOwnProperty(key)) { | ||
| //read value from ssm | ||
| const ssm = new DataAwsSsmParameter(scope, "db_admin_username_ssm_param", { | ||
| name: process.env[key] ?? '', | ||
| withDecryption: true | ||
| }); | ||
| // Copy the value from process.env to envVar | ||
| envVar[key] = ssm.value; | ||
| } | ||
| } | ||
|
|
||
| return envVar; | ||
| } | ||
|
|
||
|
|
||
| export const checkEnv = () => { | ||
| let envToCheck = readFileSync('../.env.schema', "utf8").split(/[\n =]/).filter(Boolean); | ||
|
There was a problem hiding this comment. This misses the case when there are comments in the env. also I think it would be better to split it into lines by splitting it first into "\n" and then take the left side of "=" (i.e. line[0]), because this code assumes that the values will not be there and the values will be filtered using filter(Boolean) so in case the user has a value with a property in the .env.schema this code will treat that (value) as property also. You don't need to deal with values anyway, you just need properties. you can use this There was a problem hiding this comment. Why would you always assume a .env file? We should just be checking for environment variables. Assuming an ENV assumes a CI/CD process creates a file when it does There was a problem hiding this comment. We can use |
||
| envToCheck.forEach(key => { | ||
| if (!env.hasOwnProperty(key)) { | ||
| throw new Error(`env is missing- ${key}`); | ||
| } | ||
| }) | ||
| } | ||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This implementation is still incorrect.