add API_KEYS_FILE and STORAGE_PROFILE_FILE to migration

Author: skandragon

generated-templates/lakerunner-migration.yaml

@@ -93,6 +93,10 @@ Resources:
               Value: lakerunner
             - Name: CONFIGDB_SSLMODE
               Value: require
+            - Name: API_KEYS_FILE
+              Value: env:API_KEYS_ENV
+            - Name: STORAGE_PROFILE_FILE
+              Value: env:STORAGE_PROFILES_ENV
           Image: !Ref 'ContainerImage'
           LogConfiguration:
             LogDriver: awslogs
@@ -112,6 +116,10 @@ Resources:
                 - '${S}:password::'
                 - S: !ImportValue
                     Fn::Sub: ${CommonInfraStackName}-DbSecretArn
+            - Name: API_KEYS_ENV
+              ValueFrom: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/lakerunner/api_keys'
+            - Name: STORAGE_PROFILES_ENV
+              ValueFrom: !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/lakerunner/storage_profiles'
       Cpu: !Ref 'Cpu'
       ExecutionRoleArn: !GetAtt 'TaskExecutionRole.Arn'
       Family: lakerunner-migration
@@ -323,6 +331,12 @@ Resources:
                     - ${SecretArn}*
                     - SecretArn: !ImportValue
                         Fn::Sub: ${CommonInfraStackName}-DbSecretArn
+              - Action:
+                  - ssm:GetParameter
+                Effect: Allow
+                Resource:
+                  - !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/lakerunner/api_keys'
+                  - !Sub 'arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/lakerunner/storage_profiles'
             Version: '2012-10-17'
           PolicyName: TaskExecutionSecretsPolicy
     Type: AWS::IAM::Role

src/lakerunner_migration.py

@@ -181,6 +181,14 @@ def ci_export(suffix):
                         "Effect": "Allow",
                         "Action": ["secretsmanager:GetSecretValue"],
                         "Resource": [Sub("${SecretArn}*", SecretArn=DbSecretArnValue)]
+                    },
+                    {
+                        "Effect": "Allow",
+                        "Action": ["ssm:GetParameter"],
+                        "Resource": [
+                            Sub("arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/lakerunner/api_keys"),
+                            Sub("arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/lakerunner/storage_profiles")
+                        ]
                     }
                 ]
             }
@@ -224,10 +232,14 @@ def ci_export(suffix):
                 Environment(Name="CONFIGDB_DBNAME", Value="lakerunner"),
                 Environment(Name="CONFIGDB_USER", Value="lakerunner"),
                 Environment(Name="CONFIGDB_SSLMODE", Value="require"),
+                Environment(Name="API_KEYS_FILE", Value="env:API_KEYS_ENV"),
+                Environment(Name="STORAGE_PROFILE_FILE", Value="env:STORAGE_PROFILES_ENV"),
             ],
             Secrets=[
                 EcsSecret(Name="LRDB_PASSWORD", ValueFrom=Sub("${S}:password::", S=DbSecretArnValue)),
-                EcsSecret(Name="CONFIGDB_PASSWORD", ValueFrom=Sub("${S}:password::", S=DbSecretArnValue))
+                EcsSecret(Name="CONFIGDB_PASSWORD", ValueFrom=Sub("${S}:password::", S=DbSecretArnValue)),
+                EcsSecret(Name="API_KEYS_ENV", ValueFrom=Sub("arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/lakerunner/api_keys")),
+                EcsSecret(Name="STORAGE_PROFILES_ENV", ValueFrom=Sub("arn:aws:ssm:${AWS::Region}:${AWS::AccountId}:parameter/lakerunner/storage_profiles"))
             ]
         )
     ]