Skip to content

Commit 0932943

Browse files
zkodjozkodjo
committed
init: repo
0 parents  commit 0932943

File tree

19 files changed

+515
-0
lines changed

19 files changed

+515
-0
lines changed

‎.github/workflows/terraform.yml

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
name: deploy.indent-pagerduty-decision-integration
2+
3+
on:
4+
push:
5+
branches:
6+
- main
7+
pull_request:
8+
workflow_dispatch:
9+
10+
env:
11+
AWS_REGION: 'us-west-2'
12+
13+
jobs:
14+
terraform:
15+
name: 'Terraform'
16+
runs-on: ubuntu-latest
17+
steps:
18+
- name: Checkout
19+
uses: actions/checkout@v2
20+
21+
- name: Setup Terraform
22+
uses: hashicorp/setup-terraform@v1
23+
24+
- name: Configure AWS Credentials
25+
uses: aws-actions/configure-aws-credentials@v1
26+
with:
27+
aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
28+
aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
29+
aws-session-token: ${{ secrets.AWS_SESSION_TOKEN }} # if you have/need it
30+
aws-region: ${{ env.AWS_REGION }}
31+
32+
- name: Add profile credentials to ~/.aws/credentials
33+
run: |
34+
aws configure set aws_access_key_id ${{ secrets.AWS_ACCESS_KEY_ID }} --profile default
35+
aws configure set aws_secret_access_key ${{ secrets.AWS_SECRET_ACCESS_KEY }} --profile default
36+
37+
- name: Terraform Format
38+
id: fmt
39+
run: terraform fmt -check -diff
40+
41+
- name: Build Webhook (template-aws-lambda-pagerduty-decision-webhook)
42+
run: npm run deploy:prepare && npm install && npm run build
43+
44+
- name: Terraform Init
45+
id: init
46+
run: terraform init
47+
48+
- name: Terraform Plan
49+
id: plan
50+
if: github.event_name == 'pull_request'
51+
run: terraform plan -input=false -no-color
52+
continue-on-error: true
53+
env:
54+
TF_VAR_indent_webhook_secret: ${{ secrets.INDENT_WEBHOOK_SECRET }}
55+
TF_VAR_pagerduty_key: ${{ secrets.PAGERDUTY_KEY }}
56+
57+
- uses: actions/github-script@0.9.0
58+
if: github.event_name == 'pull_request'
59+
env:
60+
PLAN: "terraform\n${{ steps.plan.outputs.stdout }}"
61+
with:
62+
github-token: ${{ secrets.GITHUB_TOKEN }}
63+
script: |
64+
const output = `#### Terraform Format and Style 🖌\`${{ steps.fmt.outcome }}\`
65+
#### Terraform Initialization ⚙️\`${{ steps.init.outcome }}\`
66+
#### Terraform Plan 📖\`${{ steps.plan.outcome }}\`
67+
<details><summary>Show Plan</summary>
68+
\`\`\`${process.env.PLAN}\`\`\`
69+
</details>
70+
*Actor: @${{ github.actor }}, Event: \`${{ github.event_name }}\`*`;
71+
github.issues.createComment({
72+
issue_number: context.issue.number,
73+
owner: context.repo.owner,
74+
repo: context.repo.repo,
75+
body: output
76+
})
77+
- name: Terraform Plan Status
78+
if: steps.plan.outcome == 'failure'
79+
run: exit 1
80+
81+
- name: Terraform Apply
82+
if: github.ref == 'refs/heads/main' && github.event_name == 'push'
83+
run: terraform apply -input=false -auto-approve
84+
env:
85+
TF_VAR_indent_webhook_secret: ${{ secrets.INDENT_WEBHOOK_SECRET }}
86+
TF_VAR_pagerduty_key: ${{ secrets.PAGERDUTY_KEY }}

‎.gitignore

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
data
2+
dist
3+
lib
4+
.env
5+
node_modules
6+
*.tfstate
7+
.terraform
8+
*.tfstate.*
9+
terraform/config/*.tfvars
10+
!terraform/config/example.tfvars

‎README.md

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# Indent + PagerDuty Integration
2+
3+
This repository contains one webhook (AWS Lambda) to enable auto approvals for on-call rotation participants from Pagerduty using [Indent](https://indent.com/docs).
4+
5+
## Quicklinks
6+
7+
- [Indent Support](https://support.indent.com)
8+
- [GitHub Secrets](./settings/secrets/actions)
9+
- [GitHub Actions](./actions/workflows/terraform.yml)
10+
11+
## Configuration
12+
13+
Before you deploy these webhooks for the first time, [create an S3 bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/create-bucket-overview.html) to store Terraform state, add your credentials as [GitHub Secrets](https://docs.github.com/en/actions/security-guides/encrypted-secrets), then update the bucket in `main.tf` once you're done.
14+
15+
<details><summary><strong>1. Configuring the S3 bucket</strong></summary>
16+
<p>
17+
18+
- [Go to AWS S3](https://s3.console.aws.amazon.com/s3/buckets) and select an existing bucket or create a new one.
19+
- Select the settings given your environment:
20+
- Name — easily identifiable name for the bucket (example = indent-deploy-state-123)
21+
- Region — where you plan to deploy the Lambda (default = us-west-2)
22+
- Bucket versioning — if you want to have revisions of past deployments (default = disabled)
23+
- Default encryption — server-side encryption for deployment files (default = Enable)
24+
25+
</p>
26+
</details>
27+
28+
<details><summary><strong>2. Configuring AWS credentials</strong></summary>
29+
<p>
30+
31+
- [Go to AWS IAM → New User](https://console.aws.amazon.com/iam/home#/users$new?step=details) and create a new user for deploys, e.g. `indent-terraform-deployer`
32+
- Configure the service account access:
33+
- Credential type — select **Access key - Programmatic access**
34+
- Permissions — select **Attach existing policies directly** and select `AdministratorAccess`
35+
- Add the `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` as GitHub Secrets to this repo
36+
37+
</p>
38+
</details>
39+
40+
<details><summary><strong>3. Connecting to PagerDuty</strong></summary>
41+
42+
- [Go to PagerDuty > Integrations > API Access Keys](https://support.pagerduty.com/docs/api-access-keys#section-generate-a-general-access-rest-api-key) and create a new API key, then give the ke a descriptive name like `Indent Auto Approvals`
43+
- Add this as `PAGERDUTY_KEY` as a GitHub Secret
44+
45+
</details>
46+
47+
<details><summary><strong>4. Connecting to Indent</strong></summary>
48+
49+
- If you're setting up as part of a catalog flow, you should be presented a **Webhook Secret** or [go to your Indent space and create a webhook](https://indent.com/spaces?next=/manage/spaces/[space]/webhooks/new)
50+
- Add this as `INDENT_WEBHOOK_SECRET` as a GitHub Secret
51+
52+
</details>
53+
54+
<details><summary><strong>5. Deploy</strong></summary>
55+
56+
- Enter the bucket you created in `main.tf` in the `backend` configuration
57+
- This will automatically kick off a deploy, or you can [manually trigger from GitHub Actions](./actions/workflows/terraform.yml)
58+
59+
</details>
60+
61+
### Actions secrets
62+
63+
Add the credentials for one of the authentication options below to your GitHub Secrets.
64+
65+
<details open><summary>Configuring secrets / environment variables</summary>
66+
<p>
67+
68+
| Name | Value |
69+
| --------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
70+
| INDENT_WEBHOOK_SECRET | Get this from your [Indent App](https://indent.com/spaces?next=/manage/spaces/%5Bspace%5D/apps) or an [Indent Webhook](https://indent.com/spaces?next=/manage/spaces/%5Bspace%5D/webhooks) in the Dashboard |
71+
| PAGERDUTY_KEY | Create an [API access key](https://support.pagerduty.com/docs/api-access-keys#section-generate-a-general-access-rest-api-key) for programatically getting on-call schedule participants. |
72+
| AWS_ACCESS_KEY_ID | [Your Programmatic AWS Access Key ID](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) |
73+
| AWS_SECRET_ACCESS_KEY | [Your Programmatic AWS Secret Access Key](https://docs.aws.amazon.com/general/latest/gr/aws-sec-cred-types.html#access-keys-and-secret-access-keys) |
74+
| AWS_SESSION_TOKEN | Optional: [Your AWS Session Token](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html#using-temp-creds-sdk-cli). **Note: If you use an AWS Session ID you will need to update it for each deployment once the session expires** |
75+
76+
</p>
77+
</details>
78+
79+
## Deployment
80+
81+
This repository auto-deploys to AWS when you push or merge PRs to the `main` branch. You can manually redeploy the webhooks by re-running the [latest GitHub Action job](https://docs.github.com/en/actions/managing-workflow-runs/re-running-workflows-and-jobs).

‎main.tf

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
terraform {
2+
backend "s3" {
3+
encrypt = true
4+
bucket = ""
5+
key = "indent/terraform.tfstate"
6+
}
7+
}
8+
9+
module "pagerduty-auto-approval-webhook" {
10+
source = "./terraform"
11+
12+
aws_region = var.aws_region
13+
indent_webhook_secret = var.indent_pull_webhook_secret
14+
pagerduty_key = var.pagerduty_key
15+
}

‎outputs.tf

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
output "pagerduty_auto_approval_webhook_url" {
2+
value = module.pagerduty_auto_approval_webhook.api_base_url
3+
description = "The URL of the deployed Lambda"
4+
}

‎package.json

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
{
2+
"name": "@indent/template-aws-lambda-pagerduty",
3+
"version": "0.0.0",
4+
"description": "A Node.js starter for Terraform on AWS with Indent and PagerDuty.",
5+
"main": "index.js",
6+
"private": true,
7+
"scripts": {
8+
"build": "tsc",
9+
"clean:dist": "rm -rf dist",
10+
"clean:modules": "rm -rf node_modules",
11+
"clean:tf": "rm -rf terraform/.terraform && rm -rf terraform/terraform.tfstate*",
12+
"clean:all": "npm run clean:dist; npm run clean:tf; npm run clean:modules",
13+
"create:all": "npm run deploy:init; npm run deploy:prepare; npm run deploy:all",
14+
"deploy:init": "cd terraform; terraform init",
15+
"deploy:prepare": "npm install --production && ./scripts/build-layers.sh",
16+
"deploy:all": "npm run build && npm run tf:apply -auto-approve",
17+
"destroy:all": "npm run tf:destroy -auto-approve",
18+
"tf:plan": "cd terraform && terraform plan -var-file ./config/terraform.tfvars",
19+
"tf:apply": "cd terraform && terraform apply -compact-warnings -var-file ./config/terraform.tfvars",
20+
"tf:destroy": "cd terraform && terraform destroy -auto-approve -var-file ./config/terraform.tfvars"
21+
},
22+
"author": "Indent Inc <open@indent.com>",
23+
"license": "Apache-2.0",
24+
"repository": {
25+
"type": "git",
26+
"url": "https://github.com/indentapis/template-aws-lambda-pagerduty.git"
27+
},
28+
"devDependencies": {
29+
"@types/aws-lambda": "^8.10.39",
30+
"@types/node": "^13.9.8",
31+
"@types/node-fetch": "^2.5.5",
32+
"ts-loader": "^6.2.2",
33+
"typescript": "^3.8.3"
34+
},
35+
"dependencies": {
36+
"@indent/integration-pagerduty": "canary",
37+
"@indent/runtime-aws-lambda": "canary",
38+
"@indent/webhook": "latest",
39+
"@indent/types": "latest",
40+
"ts-node": "^8.5.4"
41+
}
42+
}

‎scripts/build-layers.sh

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
#!/usr/bin/env bash
2+
set -x
3+
set -e
4+
5+
ROOT_DIR="$(pwd)"
6+
7+
OUTPUT_DIR="$(pwd)/dist"
8+
9+
LAYER_DIR=$OUTPUT_DIR/layers/nodejs
10+
11+
mkdir -p $LAYER_DIR
12+
13+
cp -LR node_modules $LAYER_DIR
14+
15+
cd $OUTPUT_DIR/layers
16+
17+
zip -q -r layers.zip nodejs

‎src/index.ts

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
import { PagerdutyDecisionIntegration } from '@indent/integration-pagerduty'
2+
import { getLambdaHandler } from '@indent/runtime-aws'
3+
4+
export const handle = getLambdaHandler({
5+
integrations: [new PagerdutyDecisionIntegration()],
6+
})

‎terraform/apiGateway.tf

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
resource "aws_api_gateway_rest_api" "api_gateway_rest_api" {
2+
name = "api_gateway"
3+
description = "Api Gateway for Lambda"
4+
}
5+
6+
resource "aws_api_gateway_resource" "api_gateway" {
7+
rest_api_id = aws_api_gateway_rest_api.api_gateway_rest_api.id
8+
parent_id = aws_api_gateway_rest_api.api_gateway_rest_api.root_resource_id
9+
path_part = "{proxy+}"
10+
}
11+
12+
resource "aws_api_gateway_method" "api_gateway_method" {
13+
rest_api_id = aws_api_gateway_rest_api.api_gateway_rest_api.id
14+
resource_id = aws_api_gateway_resource.api_gateway.id
15+
http_method = "ANY"
16+
authorization = "NONE"
17+
18+
request_parameters = {
19+
"method.request.header.x-indent-signature" = true
20+
"method.request.header.x-indent-timestamp" = true
21+
}
22+
}
23+
24+
resource "aws_api_gateway_integration" "api_gateway_integration" {
25+
rest_api_id = aws_api_gateway_rest_api.api_gateway_rest_api.id
26+
resource_id = aws_api_gateway_method.api_gateway_method.resource_id
27+
http_method = aws_api_gateway_method.api_gateway_method.http_method
28+
29+
integration_http_method = "POST"
30+
type = "AWS_PROXY"
31+
uri = aws_lambda_function.lambda.invoke_arn
32+
}
33+
34+
resource "aws_api_gateway_method" "api_gateway_root_method" {
35+
rest_api_id = aws_api_gateway_rest_api.api_gateway_rest_api.id
36+
resource_id = aws_api_gateway_rest_api.api_gateway_rest_api.root_resource_id
37+
http_method = "ANY"
38+
authorization = "NONE"
39+
40+
request_parameters = {
41+
"method.request.header.x-indent-signature" = true
42+
"method.request.header.x-indent-timestamp" = true
43+
}
44+
}
45+
46+
resource "aws_api_gateway_integration" "api_gateway_root_integration" {
47+
rest_api_id = aws_api_gateway_rest_api.api_gateway_rest_api.id
48+
resource_id = aws_api_gateway_method.api_gateway_root_method.resource_id
49+
http_method = aws_api_gateway_method.api_gateway_root_method.http_method
50+
51+
integration_http_method = "POST"
52+
type = "AWS_PROXY"
53+
uri = aws_lambda_function.lambda.invoke_arn
54+
}
55+
56+
resource "aws_api_gateway_deployment" "api_gateway_deployment" {
57+
depends_on = [
58+
aws_api_gateway_integration.api_gateway_integration,
59+
aws_api_gateway_integration.api_gateway_root_integration,
60+
]
61+
62+
rest_api_id = aws_api_gateway_rest_api.api_gateway_rest_api.id
63+
stage_name = "dev"
64+
}

‎terraform/config/.gitkeep

Whitespace-only changes.

0 commit comments

Comments
 (0)