feat(mtls): trust store and mtls #1430

jonahkaye · 2024-01-18T20:23:47Z

Refs: #1377

Dependencies

Upstream: https://github.com/metriport/metriport-internal/pull/1435

Description

implementing mTLS for API GW. This required a refactor to use aws-apigatewayv2 which supports adding an ownershipCertificate to the domain name, which is needed if you are running mTLS with private certs. See cdk docs for implementation I followed. Basically we needed to use a HTTP api instead of a REST API
added truststore bucket and bundle: https://s3.console.aws.amazon.com/s3/buckets/mtls-trust-bundle-staging?region=us-west-1&bucketType=general&tab=objects
got an OwnershipCertificate issued by AWS to ihe.staging.metriport.com: https://us-east-2.console.aws.amazon.com/acm/home?region=us-east-2#/certificates/745df350-1970-41cc-bcf9-8c23977a441d
discovered tha WAF is not compatible with HTTP api
Because this PR required using the same A record and Domain name in the new gateway as the old one, it actually had a more complicated deployment process. Needed to branch to staging with all the IHE stack code basically commented out, and then push changes, and then comment it out again to restore staging to a clean state

Testing

Staging
- branch to staging
- test there with our own cert
- verify that without the cert we cant get throug
- have testing partner ping us (qvera). Or we could just get their certs from their endpoints and test ourselves hehe. That saves effort since I dont have to mock responses or wait on them so they dont freak out

Release Plan

Merge this. Note that in order for this to not fail on release to staging, will need to branch to staging first with a branch that removes IHE stack code, and then merge. See above for why. This should not be required when ship to prod since there is no IHE stack on prod yet
add to go Live that we need to add counterpart bucket and bundle to aws

Refs: #1377

…n v1 Refs: #1377

Refs: #1377

Refs: #1377'

Refs: #1377

Goncharo

flagging this a needs review, for bookkeeping due to this: #1430 (comment)

Refs: #1442

Goncharo

added some Qs - also once this PR is approved I'd suggest just creating the prod resources as well, rather than waiting for go-live ( so we don't forget)

Goncharo · 2024-02-26T07:24:42Z

packages/lambdas/src/inbound-patient-discovery.ts

@@ -17,6 +17,7 @@ export const handler = Sentry.AWSLambda.wrapHandler(async (event: APIGatewayProx
 id: payload.id,
 timestamp: payload.timestamp,
 samlAttributes: payload.samlAttributes,
+ patientResource: payload.patientResource,


what does this have to do with mTLS?

ah nothing was just an improvement to the PD logic. Was a lingering change I just added herer

Goncharo · 2024-02-26T07:25:40Z

packages/infra/lib/ihe-stack/ihe-gateway.ts

+ addProxyRoute("/v1/patient-discovery", buildInboundAddress(patientDiscoveryPort), apiGateway);
+ addProxyRoute("/v1/document-query", buildInboundAddress(documentQueryPort), apiGateway);
+ addProxyRoute("/v1/document-retrieval", buildInboundAddress(documentRetrievalPort), apiGateway);


why did you remove const apiRootV1 = api.root.addResource("v1"); in favor of putting /v1 in every URL?

why not just build there from the apiRootV1?

APIGatewayV2 doesnt support ".root" or the type that apiRoot was (an apig.IResource). This was the only way I could figure out to from the aws docs

Goncharo

Refs: #1442

github-actions · 2024-02-26T17:02:03Z

🎉 This PR is included in version 5.63.0-develop.7 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

github-actions · 2024-02-28T21:16:01Z

🎉 This PR is included in version 5.64.0-develop.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

github-actions · 2024-02-28T22:57:05Z

🎉 This PR is included in version 5.64.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

feat(mtls): trust store and mtls

dc627af

Refs: #1377

jonahkaye self-assigned this Jan 18, 2024

jonahkaye had a problem deploying to staging January 18, 2024 20:31 — with GitHub Actions Failure

jonahkaye temporarily deployed to staging January 18, 2024 20:31 — with GitHub Actions Inactive

jonahkaye added 2 commits January 18, 2024 19:02

feat(mtls): refactoring to use apigatway v2 since no ownership cert i…

46ae449

…n v1 Refs: #1377

feat(mtls): apigateway v2 refactor and ownership cert

ca3f52e

Refs: #1377

jonahkaye had a problem deploying to staging January 19, 2024 03:49 — with GitHub Actions Failure

jonahkaye temporarily deployed to staging January 19, 2024 03:49 — with GitHub Actions Inactive

jonahkaye had a problem deploying to staging January 19, 2024 03:49 — with GitHub Actions Failure

jonahkaye temporarily deployed to staging January 19, 2024 03:49 — with GitHub Actions Inactive

feat(mtls): fix

a6a83c3

Refs: #1377'

jonahkaye had a problem deploying to staging January 19, 2024 04:10 — with GitHub Actions Failure

jonahkaye temporarily deployed to staging January 19, 2024 04:10 — with GitHub Actions Inactive

jonahkaye had a problem deploying to staging January 19, 2024 04:10 — with GitHub Actions Failure

feat(mtls): aligning aws cdk versions

796bff8

Refs: #1377

jonahkaye had a problem deploying to staging January 19, 2024 04:24 — with GitHub Actions Failure

jonahkaye temporarily deployed to staging January 19, 2024 04:24 — with GitHub Actions Inactive

jonahkaye had a problem deploying to staging January 19, 2024 04:24 — with GitHub Actions Failure

jonahkaye temporarily deployed to staging January 19, 2024 04:24 — with GitHub Actions Inactive

jonahkaye requested a deployment to staging January 19, 2024 04:40 — with GitHub Actions Abandoned

jonahkaye had a problem deploying to staging January 19, 2024 04:40 — with GitHub Actions Failure

jonahkaye requested a deployment to staging January 19, 2024 05:06 — with GitHub Actions Abandoned

jonahkaye had a problem deploying to staging January 19, 2024 05:06 — with GitHub Actions Failure

jonahkaye temporarily deployed to staging January 19, 2024 05:06 — with GitHub Actions Inactive

Goncharo requested changes Feb 7, 2024

View reviewed changes

jonahkaye added 2 commits February 25, 2024 20:17

feat(mtls): merging changes

26770cc

Refs: #1442

feat(mtls): cdk version

5781081

Refs: #1442

jonahkaye temporarily deployed to staging February 26, 2024 05:02 — with GitHub Actions Inactive

jonahkaye had a problem deploying to staging February 26, 2024 05:02 — with GitHub Actions Failure

feat(mtls): slash

899e9dd

Refs: #1442

jonahkaye had a problem deploying to staging February 26, 2024 05:13 — with GitHub Actions Failure

jonahkaye temporarily deployed to staging February 26, 2024 05:13 — with GitHub Actions Inactive

jonahkaye had a problem deploying to staging February 26, 2024 05:13 — with GitHub Actions Failure

feat(mtls): back to searching for bucket

958efef

Refs: #1442

jonahkaye temporarily deployed to staging February 26, 2024 05:50 — with GitHub Actions Inactive

jonahkaye had a problem deploying to staging February 26, 2024 05:50 — with GitHub Actions Failure

feat(mtls): ownership cert through cdk

6011021

Refs: #1442

jonahkaye temporarily deployed to staging February 26, 2024 06:13 — with GitHub Actions Inactive

jonahkaye had a problem deploying to staging February 26, 2024 06:13 — with GitHub Actions Failure

jonahkaye requested a review from Goncharo February 26, 2024 07:16

Goncharo reviewed Feb 26, 2024

View reviewed changes

Goncharo approved these changes Feb 26, 2024

View reviewed changes

feat(mtls): no need for ownership certificate arn

7507b94

Refs: #1442

jonahkaye merged commit 66428d4 into develop Feb 26, 2024
7 checks passed

jonahkaye deleted the 1377-mutual-tls branch February 26, 2024 16:22

RamilGaripov mentioned this pull request Feb 26, 2024

RELEASE 2024-02-26 #1667

Merged

16 tasks

github-actions bot added the released on @develop label Feb 26, 2024

github-actions bot added the released label Feb 28, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(mtls): trust store and mtls #1430

feat(mtls): trust store and mtls #1430

jonahkaye commented Jan 18, 2024 •

edited

Loading

Goncharo left a comment

Goncharo left a comment

Goncharo Feb 26, 2024

jonahkaye Feb 26, 2024

Goncharo Feb 26, 2024

jonahkaye Feb 26, 2024

Goncharo left a comment

github-actions bot commented Feb 26, 2024

github-actions bot commented Feb 28, 2024

github-actions bot commented Feb 28, 2024

feat(mtls): trust store and mtls #1430

feat(mtls): trust store and mtls #1430

Conversation

jonahkaye commented Jan 18, 2024 • edited Loading

Dependencies

Description

Testing

Release Plan

Goncharo left a comment

Choose a reason for hiding this comment

Goncharo left a comment

Choose a reason for hiding this comment

Goncharo Feb 26, 2024

Choose a reason for hiding this comment

jonahkaye Feb 26, 2024

Choose a reason for hiding this comment

Goncharo Feb 26, 2024

Choose a reason for hiding this comment

jonahkaye Feb 26, 2024

Choose a reason for hiding this comment

Goncharo left a comment

Choose a reason for hiding this comment

github-actions bot commented Feb 26, 2024

github-actions bot commented Feb 28, 2024

github-actions bot commented Feb 28, 2024

jonahkaye commented Jan 18, 2024 •

edited

Loading