This project provides CLI for Pay developers to interact with GOV.UK Pay's API, CI/CD platform and internal tooling.
This is a command help automate the rotation of the ci.deployer
AWS API key and secret in each of our environments.
As the process requires us to rotate the keys in one environment and then store the new ones using credstash in either of the CI or Deploy AWS Environments, the best way to do this is with a script to safely rotate the keys whilst minimising any opportunity for expired or invalid keys to be used.
Before using this script, you will need the following things to be installed:
- aws-vault
- credstash
- ykman
You will also need access to the necessary AWS accounts for the credentials you are rotating, e.g. govuk-pay-dev
and govuk-pay-test
require access to govuk-pay-ci
, and govuk-pay-staging
and govuk-pay-prod
require access to govuk-pay-deploy
.
At the current time of writing, this is the usage of the script:
./pay deployer --environment [dev/test/staging/production] --management-profile [ci/deploy]
The --environment
is the target AWS environment you wish to rotate the IAM Access Keys for. The --management-profile
is the AWS environment used to store the secrets using credstash.
There are some other options too:
--user [user.name]
- Defaults to "ci.deployer". Use this to rotate the keys for a different IAM user.--dry-run
- Optional. Allows you to do read-only stuff to simulate most of the tool without making changes.--verbose
- Optional. Sets logging to Debug output. Useful if you're having problems.
For a help printout, simply run:
./pay deployer --help
By default, the script will look for a Yubikey credential following the naming convention of govuk-pay-[env]
, with [env]
taking the form of dev, test, staging or production. You can override this bu using --yubikey-profile
and --yubikey-management-profile
if needed.
If you want to build this app yourself, run:
make build
This is controlled by the Makefile
in the root of the project.
Right now, there are only some basic tests for the common package, but if you'd like to run all available tests, you can run:
go test ./... -v
You should get output that looks like this:
? github.com/alphagov/pay-cli/cmd/pay [no test files]
? github.com/alphagov/pay-cli/pkg/api [no test files]
? github.com/alphagov/pay-cli/pkg/card [no test files]
? github.com/alphagov/pay-cli/pkg/ci [no test files]
? github.com/alphagov/pay-cli/pkg/cmd [no test files]
=== RUN TestHelpers
Running Suite: Helper Test Suite
================================
Random Seed: 1605878108
Will run 2 of 2 specs
••
Ran 2 of 2 Specs in 0.015 seconds
SUCCESS! -- 2 Passed | 0 Failed | 0 Pending | 0 Skipped
--- PASS: TestHelpers (0.03s)
PASS
ok github.com/alphagov/pay-cli/pkg/common (cached)
? github.com/alphagov/pay-cli/pkg/config [no test files]
? github.com/alphagov/pay-cli/pkg/link [no test files]
? github.com/alphagov/pay-cli/pkg/toolbox [no test files]