https://github.com/alphagov/pay-firebreak-go-cli
⚠️ This project was a firebreak proof of concept. It has some useful scripts but is not maintained by the Pay team.
https://github.com/alphagov/pay-firebreak-go-cli
govuk-pay
Last synced: 25 days ago
JSON representation
⚠️ This project was a firebreak proof of concept. It has some useful scripts but is not maintained by the Pay team.
- Host: GitHub
- URL: https://github.com/alphagov/pay-firebreak-go-cli
- Owner: alphagov
- Archived: true
- Created: 2020-03-27T19:32:17.000Z (about 5 years ago)
- Default Branch: master
- Last Pushed: 2024-04-22T09:44:05.000Z (about 1 year ago)
- Last Synced: 2025-05-08T22:52:55.787Z (25 days ago)
- Topics: govuk-pay
- Language: Go
- Homepage:
- Size: 122 KB
- Stars: 0
- Watchers: 18
- Forks: 2
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
# pay-cli
⚠️ This project was a firebreak proof of concept. It has some useful scripts but is not maintained by the Pay team.
## Deployer Command
This is a command help automate the rotation of the `ci.deployer` AWS API key and secret in each of our environments.
As the process requires us to rotate the keys in one environment and then store the new ones using credstash in either of the CI or Deploy AWS Environments, the best way to do this is with a script to safely rotate the keys whilst minimising any opportunity for expired or invalid keys to be used.
### Requirements
Before using this script, you will need the following things to be installed:
* aws-vault
* credstash
* ykman
You will also need access to the necessary AWS accounts for the credentials you are rotating, e.g. `govuk-pay-dev` and `govuk-pay-test` require access to `govuk-pay-ci`, and `govuk-pay-staging` and `govuk-pay-prod` require access to `govuk-pay-deploy`.
### Usage
At the current time of writing, this is the usage of the script:
```sh
./pay deployer --environment [dev/test/staging/production] --management-profile [ci/deploy]
```
The `--environment` is the target AWS environment you wish to rotate the IAM Access Keys for. The `--management-profile` is the AWS environment used to store the secrets using credstash.
There are some other options too:
* `--user [user.name]` - Defaults to "ci.deployer". Use this to rotate the keys for a different IAM user.
* `--dry-run` - Optional. Allows you to do read-only stuff to simulate most of the tool without making changes.
* `--verbose` - Optional. Sets logging to Debug output. Useful if you're having problems.
For a help printout, simply run:
```
./pay deployer --help
```
By default, the script will look for a Yubikey credential following the naming convention of `govuk-pay-[env]`, with `[env]` taking the form of dev, test, staging or production. You can override this bu using `--yubikey-profile` and `--yubikey-management-profile` if needed.
## Building
If you want to build this app yourself, run:
```sh
make build
```
This is controlled by the `Makefile` in the root of the project.
## Testing
Right now, there are only some basic tests for the common package, but if you'd like to run all available tests, you can run:
```sh
go test ./... -v
```
You should get output that looks like this:
```sh
? github.com/alphagov/pay-cli/cmd/pay [no test files]
? github.com/alphagov/pay-cli/pkg/api [no test files]
? github.com/alphagov/pay-cli/pkg/card [no test files]
? github.com/alphagov/pay-cli/pkg/ci [no test files]
? github.com/alphagov/pay-cli/pkg/cmd [no test files]
=== RUN TestHelpers
Running Suite: Helper Test Suite
================================
Random Seed: 1605878108
Will run 2 of 2 specs
••
Ran 2 of 2 Specs in 0.015 seconds
SUCCESS! -- 2 Passed | 0 Failed | 0 Pending | 0 Skipped
--- PASS: TestHelpers (0.03s)
PASS
ok github.com/alphagov/pay-cli/pkg/common (cached)
? github.com/alphagov/pay-cli/pkg/config [no test files]
? github.com/alphagov/pay-cli/pkg/link [no test files]
? github.com/alphagov/pay-cli/pkg/toolbox [no test files]
```