tasks

#!/bin/bash

set -Eeo pipefail

AWS_REGION=eu-west-2
AWS_HELPERS_VERSION="0.2.26"
echo "AWS helper scripts version: $AWS_HELPERS_VERSION"

# Do not change the file name as the aws helper scripts depend on it
AWS_HELPERS_FILE="utils/$AWS_HELPERS_VERSION/aws-helpers"

mkdir -p "utils/$AWS_HELPERS_VERSION"
if [[ ! -f $AWS_HELPERS_FILE ]];then
  wget --quiet -O $AWS_HELPERS_FILE https://github.com/nhsconnect/prm-deductions-support-infra/releases/download/${AWS_HELPERS_VERSION}/aws-helpers
fi
chmod +x $AWS_HELPERS_FILE
source $AWS_HELPERS_FILE

function tf_plan {
  operation=$1

  aws_account_arn=$(aws sts get-caller-identity | jq -r .Arn)

  if [[ $aws_account_arn =~ "gocd_agent-prod" || $aws_account_arn =~ "Deployer" ]]; then
    COMMON_ACCOUNT_ROLE="CiToEnvLinker"
  else
    COMMON_ACCOUNT_ROLE="CiReadOnly"
  fi
  echo "Instructing terraform to assume ${COMMON_ACCOUNT_ROLE} role for cross account actions"
  COMMON_ACCOUNT_ID=$(_get_aws_ssm_secret "/repo/ci/user-input/external/aws-account-id")

  terraform init
  terraform get # modules
  if [[ "${operation}" == "create" ]]; then
    terraform plan -var common_account_id="${COMMON_ACCOUNT_ID}" -var common_account_role="${COMMON_ACCOUNT_ROLE}" -var-file=terraform.tfvars -out="nhs_deployment.tfplan"
  elif [[ "${operation}" == "destroy" ]]; then
    terraform plan -var common_account_id="${COMMON_ACCOUNT_ID}" -var common_account_role="${COMMON_ACCOUNT_ROLE}" -var-file=terraform.tfvars -out="nhs_deployment.tfplan" -destroy
  else
    echo "Unknown operation (should be create or destroy), got: ${operation}"
    exit 1
  fi
}

function tf_apply {
  terraform init
  terraform get # modules
  terraform apply nhs_deployment.tfplan
}

function _get_aws_ssm_secret {
  secret_id=$1
  json=$(aws ssm get-parameter --with-decryption --region $AWS_REGION --name $secret_id)
  if [ $? != 0 ]; then
    >&2 echo "Failed to obtain AWS secret from SSM: $secret_id"
    exit 5
  fi
  echo $json | jq -r ".Parameter.Value"
}

command="$1"
case "${command}" in
  tf)
      dojo "bash"
      ;;
  _tf_plan)
      _assume_environment_role "prod" true
      tf_plan "$2"
      ;;
  tf_plan)
      dojo "./tasks _tf_plan $2"
      ;;
  _tf_apply)
      _assume_environment_role "prod" true
      tf_apply
      ;;
  tf_apply)
      dojo "./tasks _tf_apply"
      ;;
  *)
      echo "Invalid command: '${command}'"
      exit 1
      ;;
esac
set +e