API Key rotation for Grafana Workspace

veerapratapg commented 10 months ago

What does this PR do?

Added a module to enable Grafana API Key rotation --> grafana-key-rotation
Made appropriate changes to the eks-monitoring module to retrieve the details of the resources created in the in this module to be used for the above key rotation module.
Modified the existing-cluster-with-base-and-infra example to create create the grafana-key-rotation module.

Motivation

The current existing-cluster-with-base-and-infra example does not rotate the expired Grafana Workspace API keys automatically.
Modifying the example to enable key rotation for External Secrets deployed to the EKS Cluster as part of this solution.
Steps provided in https://docs.aws.amazon.com/prometheus/latest/userguide/obs_accelerator.html

More

[X] Yes, I have tested the PR using my local account setup (Provide any test evidence report under Additional Notes)
[X] Yes, I ran pre-commit run -a with this PR
[ ] Yes, I have added a new example under examples to support my PR (when applicable)
[ ] Yes, I have updated the Pages for this feature

Note: Not all the PRs required examples and docs.

For Moderators

[ ] E2E Test successfully complete before merge?

Additional Notes

veerapratapg commented 10 months ago

Tagging reviewers --> @bonclay7 @lewinkedrs

veerapratapg commented 9 months ago

Made the following changes to incorporate the suggestions from @lewinkedrs :

Added a README.md doc to grafana-key-rotation module with information regarding :
- What the module does and the resources it creates
- How to enable/disable it.
- Some of the configuration options.
Performed testing with the latest version of python runtime for Lambda, "3.12", and the solution is working as expected.
Removed test from the names of policy attachment resources.
Also removed white spaces from the mentioned files.
Added variables for python runtime, event bridge scheduler expressions to provide additional flexibility for users.

veerapratapg commented 9 months ago

Made the changes suggested by @bonclay7 and removed managed_grafana_workspace_id from the SSM parameter name created through external-secrets to reduce the number of changes made.

github-actions[bot] commented 7 months ago

This PR has been automatically marked as stale because it has been open 60 days with no activity. Remove stale label or comment or this PR will be closed in 10 days

veerapratapg commented 6 months ago

Working on the incorporating unit tests for the Lambda function per my conversation with bonclay7@

veerapratapg commented 5 months ago

Added Unit Tests for Lambda function in the grafana-key-rotation module in the directory ./modules/grafana-key-rotation/tests/unit/src. Also added a ReadMe file in the same location with a quick overview of steps to run the Tests.

github-actions[bot] commented 3 months ago

This PR has been automatically marked as stale because it has been open 60 days with no activity. Remove stale label or comment or this PR will be closed in 10 days

veerapratapg commented 2 months ago

Closing this PR as Managed Grafana v9 and 10 introduced Service account and service account token (SAT) APIs, instead of API Keys.

aws-observability / terraform-aws-observability-accelerator