Setup AWS VPN for database access

patheard commented 2 years ago

Description

As a developer, I want a secure way to access the Notify database instance locally, so that I can troubleshoot issues Notify data without worrying about unauthorized access to the data.

Acceptance Criteria** (Definition of done)

[x] Setup AWS VPN for Staging and Production accounts.
[x] Configure VPN access for each team member that requires access to the database.
[x] Remove the jumpbox
[x] ADR for the VPN choice and options.

QA Steps

[x] Connect to the Staging and Production VPN using your credentials.
[x] Test that you can access the database while connected to the VPN.
[x] Test that you can access Redis while connected to the VPN.
[x] Check that the jumpbox pods are no longer deployed to Kubernetes.

Additional context

We currently have hasura to audit the manually executed SQL statements in production by developers but it's limited in some ways:

Admin shared account: there is no way to exactly identify who executed what, i.e. we only have the what.
There are times when we need to bypass hasura as the tool is limited. For example, to download the notifications table in its entirety (or dump the whole database to debug locally) is difficult with Hasura.

Hence this card would increase the overall security on how we access the database.

jimleroyer commented 2 years ago

Hey team! Please add your planning poker estimate with ZenHub @patheard @sastels

sastels commented 2 years ago

we might still want the jumpbox for non-db related things? @jimleroyer what else have we used it for?

patheard commented 2 years ago

I've also used it for Redis access, but that could be setup with the VPN as well.

jimleroyer commented 2 years ago

VPN is installed from within the network, but restrict the access? We need to allow extra usage, unlike the jumpbox? Just wondering. (if we can still access Redis, that would certainly be helpful!)

patheard commented 2 years ago

Yup, the way you set up the VPN is to grant it access to specific security groups, so in the case of Redis, we'd just need to allow the VPN traffic access to the EKS cluster security group: https://github.com/cds-snc/notification-terraform/blob/main/aws/elasticache/elasticache.tf#L24-L26

yaelberger-commits commented 2 years ago

Please add your planning poker estimate with ZenHub @jzbahrai

ben851 commented 8 months ago

I was testing this yesterday when I discovered costing issues in Dev. I will resume testing today to ensure nothing is broken when this moves to staging.

ben851 commented 8 months ago

PR was approved, but I didn't merge at EOD. I will merge today.

ben851 commented 8 months ago

Note that the VPN adds $200/month in costing to each AWS account.

ben851 commented 8 months ago

Merged to staging. Need to test.

ben851 commented 8 months ago

Running into some DNS issues in dev. Debugging