HTTP API Gateway2 - How to auto map authorizer to route in Terraform - terraform-provider-aws

i would to rigger for attach authorization to route, as the pic.
enter image description here
when i used the same way "attach" the authorizer to a route in terraform .
terraform Apply complete!
resource "aws_apigatewayv2_deployment" "deployment_trigger" {
api_id = aws_apigatewayv2_api.logservice-apigw.id
description = "trigger deployment"
triggers = {
redeployment = sha1(join(",", tolist([
jsonencode(aws_apigatewayv2_integration.Lambda_Integration),
jsonencode(aws_apigatewayv2_route.route),
])))
}
lifecycle {
create_before_destroy = true
}
}
but i used the same way attach the authorizer to a route ,terraform also apply complete ,acyually awsconsole was failed.
resource "aws_apigatewayv2_authorizer" "authorizer_non_prod" {
###checkov:skip=CKV_AWS_76: "Ensure API Gateway has Access Logging enabled"
name = var.authorizer_name
authorizer_type = "REQUEST"
authorizer_uri = data.aws_lambda_function.lambda_logservice[2].invoke_arn
api_id = aws_apigatewayv2_api.logservice-apigw.id
authorizer_payload_format_version = "2.0"
identity_sources = ["$request.header.Authorization"]
authorizer_result_ttl_in_seconds = var.authorizer_result_ttl_in_seconds
enable_simple_responses = var.enable_simple_responses
authorizer_credentials_arn = aws_iam_role.log_service_lambda_role.arn
}
resource "aws_apigatewayv2_deployment" "authorization_triggers" {
api_id = aws_apigatewayv2_api.logservice-apigw.id
description = "trigger deployment"
triggers = {
redeployment = sha1(join(",", tolist([
jsonencode(aws_apigatewayv2_authorizer.authorizer_non_prod),
jsonencode(aws_apigatewayv2_route.route),
])))
}
lifecycle {
create_before_destroy = true
}
}
how can i fix ? thanks!
enter image description here

Related

send notification from background worker

am using ABP to build my project
I have a module to generate big size files using background worker, and after each successful file generated I need to send notification, but is not working !
I've put the background job in the core project and the queue in the engine project,
the DB notification tables are updated successfully (new record inserted so the pull notification will work fine !), but the browser doesn't receive the notification (so I can inform him that his file is ready), but there is no errors and no any notification send to the browser.
here is the worker class:
public class GeneratedFileWorker : BackgroundWorkerBase, ISingletonDependency
{
.
.
.
[UnitOfWork]
[AutomaticRetry(Attempts = 0)]
public override async System.Threading.Tasks.Task ExecuteAsync()
{
var notificationData = new NotificationData();
notificationData["URL"] = "app/main/data/generatedfiles";
using (AbpSession.Use(TenantConsts.DefaultTenantId, TenantConsts.UserServiceId))
{
GetDownloadArticleInput getDownloadArticleInput = new GetDownloadArticleInput();
if (pendingRequest is not null)
{
var entityType = _lookupItemManager.Get(pendingRequest.EntityTypeId).Code;
dynamic Args = JsonConvert.DeserializeObject<GetDownloadArticleInput>(String.Empty);
switch (entityType)
{
case "Article":
Args = JsonConvert.DeserializeObject<GetDownloadArticleInput>(pendingRequest.ExtensionData);
break;
case "ArticlesList":
Args = JsonConvert.DeserializeObject<GetDownloadArticlesInput>(pendingRequest.ExtensionData);
break;
};
GeneratedFile generatedFileDto = new GeneratedFile();
try
{
generatedFileDto = await _generateFile.Generate(Args);
await _appNotifier.SendMessageAsync(new UserIdentifier(1, pendingRequest.CreatorUserId.Value),string.Format(_LocalizationSource.GetString("GeneratedFile.fileIsNotready"), _lookupItemManager.GetTitle(pendingRequest.EntityTypeId)), notificationData, NotificationSeverity.Error);
else
await _appNotifier.SendMessageAsync(new UserIdentifier(1, pendingRequest.CreatorUserId.Value), string.Format(_LocalizationSource.GetString("GeneratedFile.fileIsready"), _lookupItemManager.GetTitle(pendingRequest.EntityTypeId)), notificationData, NotificationSeverity.Success);
}
catch (Exception ex)
{
pendingRequest.CurrentStateId = _lookupItemManager.GetByCode(LookupCategories.GeneratedFileStatus, "Failed").Id;
pendingRequest.OperationResult = ex.ToString();
await _generatedFileRepository.UpdateAsync(pendingRequest);
await _appNotifier.SendMessageAsync(new UserIdentifier(1, pendingRequest.CreatorUserId.Value), string.Format(_LocalizationSource.GetString("GeneratedFile.fileIsNotready"), _lookupItemManager.GetTitle(pendingRequest.EntityTypeId)), notificationData, NotificationSeverity.Error);
}
}
}
}
I have 2 cases here:
first one working when I define the queue in the host project, and
second one not working when I define the queue in the engine project

I need support to add the AWS variables in Terraform

Need support to add following variables to my terraform code so that user can input the details and it can create the desired resources in AWS. I don't know how to do that your kind support will be highly appreciated.
`
resource "aws_instance" "ec2" {
ami = "ami-0fe0b2cf0e1f25c8a"
instance_type = "t2.micro"
vpc_security_group_ids = [var.security_group_id]
subnet_id = var.subnet_id
key_name = var.key
}
variable "security_group_id" {
type = string
description = "Enter the SG"
}
variable "key" {
description = "Enter the Kaypair"
}
variable "subnet_id" {
type = string
description = "Enter the Subnet"
}
`
How can i add following AWS variables
Size, AZ, HDD, Port
I have tried the following code.But due to lack of knowledge i dont know how to add the required variables e.g there are resources + data source.
resource "aws_instance" "ec2" {
ami = "ami-0fe0b2cf0e1f25c8a"
instance_type = "t2.micro"
vpc_security_group_ids = [var.security_group_id]
subnet_id = var.subnet_id
key_name = var.key
}
variable "security_group_id" {
type = string
description = "Enter the SG"
}
variable "key" {
description = "Enter the Kaypair"
}
variable "subnet_id" {
type = string
description = "Enter the Subnet"
}
#Malik, hopefully, this will help you and give you a bit of an idea how to initiate your config.
https://github.com/ishuar/terraform-eks/blob/main/examples/private_cluster/eks-ec2-private-jump-host.tf#L253
this only includes basic configuration for EC2 Instances.
If you are looking for a module then its better to look into: https://github.com/terraform-aws-modules/terraform-aws-ec2-instance
unfortunately, there are multiple ways of defining the resources that you have to add to your Ec2 instance but the very standard and basic way would be
resource "aws_instance" "ec2" {
count = var.instance_count
ami = "ami-0fe0b2cf0e1f25c8a"
instance_type = "t2.micro"
vpc_security_group_ids = [var.security_group_id]
subnet_id = var.subnet_id
key_name = var.key
tags = { Name = "${var.name}-${count.index + 1}" }
## For the root volume attached to Ec2 instance
root_block_device {
delete_on_termination = var.delete_on_termination
encrypted = var.encrypted
iops = var.iops
volume_size = var.volume_size
volume_type = var.volume_type
throughput = var.throughput
}
## For the additional EBS block device attached to Ec2 instance
ebs_block_device {
delete_on_termination = var.delete_on_termination
device_name = var.device_name
encrypted = var.encrypted
iops = var.iops
kms_key_id = var.kms_key_id
snapshot_id = var.snapshot_id
volume_size = var.volume_size
volume_type = var.volume_type
throughput = var.throughput
}
}
Regarding ports I assume you mean the ports to access, those can be controlled via security groups.
I hope this info somewhat helps even though it is not exactly a module of complete aws_instance resource somewhat you can have an idea.

How to Output the Cosmos DB Primary and Secondary Connection Strings using Terraform

I need to output the Primary Connection or Secondary Connection Strings to use this connection string as an input value in Azure Data Factory MongoApi Linked Services to connect the database to upload the Json files from Azure storage account to Azure cosmos db. But I'm getting the error message while output the connection strings using terraform
Can Someone please check and help me in this with detailed explanation is much appreciated.
output "cosmosdb_connection_strings" {
value = data.azurerm_cosmosdb_account.example.connection_strings
sensitive = true
}
Error: Unsupported attribute
│
│ on outputs.tf line 21, in output "cosmosdb_connection_strings":
│ 21: value = data.azurerm_cosmosdb_account.example.connection_strings
│
│ This object has no argument, nested block, or exported attribute named "connection_strings"
I tried to reproduce the same in my environment:
resource "azurerm_cosmosdb_account" "db" {
name = "tfex-cosmos-db-31960"
location = "westus2"
resource_group_name = data.azurerm_resource_group.example.name
offer_type = "Standard"
kind = "MongoDB"
enable_automatic_failover = true
capabilities {
name = "EnableAggregationPipeline"
}
capabilities {
name = "mongoEnableDocLevelTTL"
}
capabilities {
name = "MongoDBv3.4"
}
capabilities {
name = "EnableMongo"
}
consistency_policy {
consistency_level = "BoundedStaleness"
max_interval_in_seconds = 300
max_staleness_prefix = 100000
}
geo_location {
location = "eastus"
failover_priority = 0
}
}
You can get the output using below code:
output "cosmosdb_connectionstrings" {
value = "AccountEndpoint=${azurerm_cosmosdb_account.db.endpoint};AccountKey=${azurerm_cosmosdb_account.db.primary_key};"
sensitive = true
}
I have below terraform azurerm provider version:
terraform {
required_providers {
azapi = {
source = "azure/azapi"
version = "=0.1.0"
}
azurerm = {
source = "hashicorp/azurerm"
version = "=3.0.2"
}
Try upgrade you terraform version.
You can even traverse the array of connection strings and output required one whith below code:
output "cosmosdb_connectionstrings" {
value = tostring("${azurerm_cosmosdb_account.db.connection_strings[0]}")
sensitive = true
}
Result:
As they are sensitive you cannot see output values to the UI, but you can export to required resource.
I Have created a keyvault and exported the connection strings to keyvault.
data "azurerm_client_config" "current" {}
resource "azurerm_key_vault" "example" {
name = "kaexamplekeyvault"
location = data.azurerm_resource_group.example.location
resource_group_name = data.azurerm_resource_group.example.name
enabled_for_disk_encryption = true
tenant_id = data.azurerm_client_config.current.tenant_id
soft_delete_retention_days = 7
purge_protection_enabled = false
sku_name = "standard"
access_policy {
tenant_id = data.azurerm_client_config.current.tenant_id
object_id = data.azurerm_client_config.current.object_id
key_permissions = [
"Get","List", "Backup", "Create"
]
secret_permissions = [
"Get","List", "Backup", "Delete", "Purge", "Recover", "Restore", "Set"
]
storage_permissions = [
"Get", "List", "Backup", "Delete", "DeleteSAS", "GetSAS", "ListSAS", "Purge", "Recover", "RegenerateKey", "Restore", "Set", "SetSAS", "Update",
]
}
}
resource "azurerm_key_vault_secret" "example" {
count = length(azurerm_cosmosdb_account.db.connection_strings)
name = "ASCosmosDBConnectionString-${count.index}"
value = tostring("${azurerm_cosmosdb_account.db.connection_strings[count.index]}")
key_vault_id = azurerm_key_vault.example.id
}
Then you can check the connection string values in your keyvault.
check the version and click on show secret from which you can copy the secret value which is connection string.
I have found two ways and implemented both ways were working.
In the first way I can be able to store the primary connection string of the cosmos db using azurerm_cosmosdb_account.acc.connection_strings[0] with index number. So, it will only store the Primary Connection String.
resource "azurerm_key_vault_secret" "ewo11" {
name = "Cosmos-DB-Primary-String"
value = azurerm_cosmosdb_account.acc.connection_strings[0]
key_vault_id = azurerm_key_vault.ewo11.id
depends_on = [
azurerm_key_vault.ewo11,
azurerm_key_vault_access_policy.aduser,
azurerm_key_vault_access_policy.demo-terraform-automation
]
}
In the Second Way is I'm creating it manually by using join function. I have found some common values in the connection string, like wise I have creating and I'm successfully able to connect with this string.
output "cosmosdb_account_primary_key" {
value = azurerm_cosmosdb_account.acc.primary_key
sensitive = true
}
locals {
kind = "mongodb"
db_name = azurerm_cosmosdb_account.acc.name
common_value = ".mongo.cosmos.azure.com:10255/?ssl=true&replicaSet=globaldb&retrywrites=false&maxIdleTimeMS=120000&appName="
}
output "cosmosdb_connection_strings" {
value = join("", [local.kind, ":", "//", azurerm_cosmosdb_account.acc.name, ":", azurerm_cosmosdb_account.acc.primary_key, "#", local.db_name, local.common_value, "#", local.db_name, "#"])
sensitive = true
}
resource "azurerm_key_vault_secret" "example" {
name = "cosmos-connection-string"
value = join("", [local.kind, ":", "//", azurerm_cosmosdb_account.acc.name, ":", azurerm_cosmosdb_account.acc.primary_key, "#", local.db_name, local.common_value, "#", local.db_name, "#"])
key_vault_id = data.azurerm_key_vault.example.id
}
In both ways I can be able to fix the problems.
If we want to see the sensitive values, we check those values in terraform.tfstate file. It will be available when we call them in outputs.

Corda - Specifying an app name for a mock network

If I call flowSession.getCounterpartyFlowInfo() from a unit test using MockNetwork, it returns FlowInfo(flowVersion=1, appName=<unknown>)
Here is my current MockNetwork configuration:
network = MockNetwork(
MockNetworkParameters(
cordappsForAllNodes = listOf(
TestCordapp.findCordapp("com.example.contract"),
TestCordapp.findCordapp("com.example.workflow")
),
networkParameters = testNetworkParameters(
minimumPlatformVersion = 5
)
)
)
Is there a way to specify the appName of an application running in a mock network?
I don't think there is a configuration for that. The appName is derived from the jar file name by removing the '.jar' extension.
For the MockNode, the packages are scanned and classes are loaded.
Here is how it's derived:
val Class<out FlowLogic<*>>.appName: String
get() {
val jarFile = location.toPath()
return if (jarFile.isRegularFile() && jarFile.toString().endsWith(".jar")) {
jarFile.fileName.toString().removeSuffix(".jar")
} else {
"<unknown>"
}
}

How to have an an ALB point to the same application over 2 different protocols?

I have an application that I am deploying to AWS on ECS using Terraform. I would like to set it up so that it can perform a health check over HTTP, but require authentication and perform all other activities over HTTPS. However, I have no idea how to set this up and nothing I'm trying is working. Ideally, the HTTPS port should be 8080 (not sure if this is possible, if it's not please advise; it's not a big deal to use a different port). The HTTP port would ideally also be 8080 but can be different as well (I know nothing about networking and not sure if I can hit the same port with 2 different protocols to access 2 different sets of endpoints).
Here's the most recent iteration of what I've tried (abbreviated to only show the parts I think are important); I've tried other things as well but this is the most recent:
resource "aws_ecs_service" "service" {
name = "${var.app_name}-service"
cluster = aws_ecs_cluster.main.id
task_definition = aws_ecs_task_definition.app.arn
desired_count = var.app_count
launch_type = "FARGATE"
health_check_grace_period_seconds = 240
network_configuration {
security_groups = [var.security_group_id]
subnets = var.private_subnet_ids
assign_public_ip = true
}
load_balancer {
target_group_arn = aws_alb_target_group.app.id
container_name = var.app_name
container_port = var.app_port
}
depends_on = [aws_alb_listener.listener]
}
resource "aws_alb_target_group" "app" {
name = "${var.app_name}-target-group"
port = 443
protocol = "HTTPS"
vpc_id = var.vpc_id
target_type = "ip"
health_check {
interval = "30"
protocol = "HTTPS"
matcher = "200-299"
timeout = "3"
path = var.app_health_check_path
unhealthy_threshold = "3"
}
}
resource "aws_alb_listener" "listener" {
load_balancer_arn = var.alb_arn
port = var.alb_listener_port
protocol = "HTTPS"
ssl_policy = "ELBSecurityPolicy-2016-08"
certificate_arn = var.ssl_cert
default_action {
type = "fixed-response"
fixed_response {
content_type = "text/plain"
message_body = "contact admin for ${var.app_name} access"
status_code = 403
}
}
}
resource "aws_lb_listener_rule" "cf_auth_listener_rule" {
listener_arn = aws_alb_listener.listener.arn
priority = 101
action {
type = "forward"
target_group_arn = aws_alb_target_group.app.arn
}
condition {
http_header {
http_header_name = <HEADER_NAME>
values = [<HEADER_VALUE>]
}
}
}
resource "aws_lb_listener_rule" "health_check_listener_rule" {
listener_arn = aws_alb_listener.listener.arn
priority = 1
action {
type = "forward"
target_group_arn = aws_alb_target_group.app.arn
}
condition {
path_pattern {
values = [var.app_health_check_path]
}
}
}
The problem I'm having is that my service is starting, but then immediately shutting down due to failed health check. It seems the ALB can't contact the health check endpoint to perform the health check.

Resources