Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement executive order M-21-31 (#6070) #6900

Draft
wants to merge 7 commits into
base: develop
Choose a base branch
from

Conversation

dsotirho-ucsc
Copy link
Contributor

@dsotirho-ucsc dsotirho-ucsc commented Feb 12, 2025

Connected issues: #6070

Checklist

Author

  • PR is a draft
  • Target branch is develop
  • Name of PR branch matches issues/<GitHub handle of author>/<issue#>-<slug>
  • On ZenHub, PR is connected to all issues it (partially) resolves
  • PR description links to connected issues
  • PR title matches1 that of a connected issue or comment in PR explains why they're different
  • PR title references all connected issues
  • For each connected issue, there is at least one commit whose title references that issue

1 when the issue title describes a problem, the corresponding PR
title is Fix: followed by the issue title

Author (partiality)

  • Added p tag to titles of partial commits
  • This PR is labeled partial or completely resolves all connected issues
  • This PR partially resolves each of the connected issues or does not have the partial label

Author (chains)

  • This PR is blocked by previous PR in the chain or is not chained to another PR
  • The blocking PR is labeled base or this PR is not chained to another PR
  • This PR is labeled chained or is not chained to another PR

Author (reindex, API changes)

  • Added r tag to commit title or the changes introduced by this PR will not require reindexing of any deployment
  • This PR is labeled reindex:dev or the changes introduced by it will not require reindexing of dev
  • This PR is labeled reindex:anvildev or the changes introduced by it will not require reindexing of anvildev
  • This PR is labeled reindex:anvilprod or the changes introduced by it will not require reindexing of anvilprod
  • This PR is labeled reindex:prod or the changes introduced by it will not require reindexing of prod
  • This PR is labeled reindex:partial and its description documents the specific reindexing procedure for dev, anvildev, anvilprod and prod or requires a full reindex or carries none of the labels reindex:dev, reindex:anvildev, reindex:anvilprod and reindex:prod
  • This PR and its connected issues are labeled API or this PR does not modify a REST API
  • Added a (A) tag to commit title for backwards (in)compatible changes or this PR does not modify a REST API
  • Updated REST API version number in app.py or this PR does not modify a REST API

Author (upgrading deployments)

  • Ran make docker_images.json and committed the resulting changes or this PR does not modify azul_docker_images, or any other variables referenced in the definition of that variable
  • Documented upgrading of deployments in UPGRADING.rst or this PR does not require upgrading deployments
  • Added u tag to commit title or this PR does not require upgrading deployments
  • This PR is labeled upgrade or does not require upgrading deployments
  • This PR is labeled deploy:shared or does not modify docker_images.json, and does not require deploying the shared component for any other reason
  • This PR is labeled deploy:gitlab or does not require deploying the gitlab component
  • This PR is labeled deploy:runner or does not require deploying the runner image

Author (hotfixes)

  • Added F tag to main commit title or this PR does not include permanent fix for a temporary hotfix
  • Reverted the temporary hotfixes for any connected issues or the none of the stable branches (anvilprod and prod) have temporary hotfixes for any of the issues connected to this PR

Author (before every review)

  • Rebased PR branch on develop, squashed old fixups
  • Ran make requirements_update or this PR does not modify requirements*.txt, common.mk, Makefile and Dockerfile
  • Added R tag to commit title or this PR does not modify requirements*.txt
  • This PR is labeled reqs or does not modify requirements*.txt
  • make integration_test passes in personal deployment or this PR does not modify functionality that could affect the IT outcome

Peer reviewer (after approval)

  • PR is not a draft
  • Ticket is in Review requested column
  • PR is awaiting requested review from system administrator
  • PR is assigned to only the system administrator

System administrator (after approval)

  • Actually approved the PR
  • Labeled connected issues as demo or no demo
  • Commented on connected issues about demo expectations or all connected issues are labeled no demo
  • Decided if PR can be labeled no sandbox
  • A comment to this PR details the completed security design review
  • PR title is appropriate as title of merge commit
  • N reviews label is accurate
  • Moved connected issues to Approved column
  • PR is assigned to only the operator

Operator (before pushing merge the commit)

  • Checked reindex:… labels and r commit title tag
  • Checked that demo expectations are clear or all connected issues are labeled no demo
  • Squashed PR branch and rebased onto develop
  • Sanity-checked history
  • Pushed PR branch to GitHub
  • Ran _select dev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unused or this PR is not labeled deploy:shared
  • Ran _select dev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab apply or this PR is not labeled deploy:gitlab
  • Ran _select anvildev.shared && CI_COMMIT_REF_NAME=develop make -C terraform/shared apply_keep_unused or this PR is not labeled deploy:shared
  • Ran _select anvildev.gitlab && CI_COMMIT_REF_NAME=develop make -C terraform/gitlab apply or this PR is not labeled deploy:gitlab
  • Checked the items in the next section or this PR is labeled deploy:gitlab
  • PR is assigned to only the system administrator or this PR is not labeled deploy:gitlab

System administrator

  • Background migrations for dev.gitlab are complete or this PR is not labeled deploy:gitlab
  • Background migrations for anvildev.gitlab are complete or this PR is not labeled deploy:gitlab
  • PR is assigned to only the operator

Operator (before pushing merge the commit)

  • Ran _select dev.gitlab && make -C terraform/gitlab/runner or this PR is not labeled deploy:runner
  • Ran _select anvildev.gitlab && make -C terraform/gitlab/runner or this PR is not labeled deploy:runner
  • Added sandbox label or PR is labeled no sandbox
  • Pushed PR branch to GitLab dev or PR is labeled no sandbox
  • Pushed PR branch to GitLab anvildev or PR is labeled no sandbox
  • Build passes in sandbox deployment or PR is labeled no sandbox
  • Build passes in anvilbox deployment or PR is labeled no sandbox
  • Reviewed build logs for anomalies in sandbox deployment or PR is labeled no sandbox
  • Reviewed build logs for anomalies in anvilbox deployment or PR is labeled no sandbox
  • Deleted unreferenced indices in sandbox or this PR does not remove catalogs or otherwise causes unreferenced indices in dev
  • Deleted unreferenced indices in anvilbox or this PR does not remove catalogs or otherwise causes unreferenced indices in anvildev
  • Started reindex in sandbox or this PR is not labeled reindex:dev
  • Started reindex in anvilbox or this PR is not labeled reindex:anvildev
  • Checked for failures in sandbox or this PR is not labeled reindex:dev
  • Checked for failures in anvilbox or this PR is not labeled reindex:anvildev
  • The title of the merge commit starts with the title of this PR
  • Added PR # reference to merge commit title
  • Collected commit title tags in merge commit title but only included p if the PR is also labeled partial
  • Moved connected issues to Merged lower column in ZenHub
  • Moved blocked issues to Triage or no issues are blocked on the connected issues
  • Pushed merge commit to GitHub

Operator (chain shortening)

  • Changed the target branch of the blocked PR to develop or this PR is not labeled base
  • Removed the chained label from the blocked PR or this PR is not labeled base
  • Removed the blocking relationship from the blocked PR or this PR is not labeled base
  • Removed the base label from this PR or this PR is not labeled base

Operator (after pushing the merge commit)

  • Pushed merge commit to GitLab dev
  • Pushed merge commit to GitLab anvildev
  • Build passes on GitLab dev
  • Reviewed build logs for anomalies on GitLab dev
  • Build passes on GitLab anvildev
  • Reviewed build logs for anomalies on GitLab anvildev
  • Ran _select dev.shared && make -C terraform/shared apply or this PR is not labeled deploy:shared
  • Ran _select anvildev.shared && make -C terraform/shared apply or this PR is not labeled deploy:shared
  • Deleted PR branch from GitHub
  • Deleted PR branch from GitLab dev
  • Deleted PR branch from GitLab anvildev

Operator (reindex)

  • Deindexed all unreferenced catalogs in dev or this PR is neither labeled reindex:partial nor reindex:dev
  • Deindexed all unreferenced catalogs in anvildev or this PR is neither labeled reindex:partial nor reindex:anvildev
  • Deindexed specific sources in dev or this PR is neither labeled reindex:partial nor reindex:dev
  • Deindexed specific sources in anvildev or this PR is neither labeled reindex:partial nor reindex:anvildev
  • Indexed specific sources in dev or this PR is neither labeled reindex:partial nor reindex:dev
  • Indexed specific sources in anvildev or this PR is neither labeled reindex:partial nor reindex:anvildev
  • Started reindex in dev or this PR does not require reindexing dev
  • Started reindex in anvildev or this PR does not require reindexing anvildev
  • Checked for, triaged and possibly requeued messages in both fail queues in dev or this PR does not require reindexing dev
  • Checked for, triaged and possibly requeued messages in both fail queues in anvildev or this PR does not require reindexing anvildev
  • Emptied fail queues in dev or this PR does not require reindexing dev
  • Emptied fail queues in anvildev or this PR does not require reindexing anvildev
  • Restarted the Data Browser pipeline for the ucsc/hca/dev branch on GitLab in dev or this PR does not require reindexing dev
  • Restarted the Data Browser pipeline for the ucsc/lungmap/dev branch on GitLab in dev or this PR does not require reindexing dev
  • Restarted deploy_browser job in the GitLab pipeline for this PR in dev or this PR does not require reindexing dev
  • Restarted the Data Browser pipeline for the ucsc/anvil/anvildev branch on GitLab in anvildev or this PR does not require reindexing anvildev
  • Restarted deploy_browser job in the GitLab pipeline for this PR in anvildev or this PR does not require reindexing anvildev

Operator

  • Propagated the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels to the next promotion PRs or this PR carries none of these labels
  • Propagated any specific instructions related to the deploy:shared, deploy:gitlab, deploy:runner, API, reindex:partial, reindex:anvilprod and reindex:prod labels, from the description of this PR to that of the next promotion PRs or this PR carries none of these labels
  • PR is assigned to no one

Shorthand for review comments

  • L line is too long
  • W line wrapping is wrong
  • Q bad quotes
  • F other formatting problem

@dsotirho-ucsc dsotirho-ucsc added the deploy:shared [process] PR requires deploying `shared` component label Feb 12, 2025
@github-actions github-actions bot added the orange [process] Done by the Azul team label Feb 12, 2025
@dsotirho-ucsc dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/6070-log-durations-3 branch 3 times, most recently from c8ae3d0 to da38dea Compare February 13, 2025 17:49
Copy link

codecov bot commented Feb 13, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.60%. Comparing base (3f8d8d9) to head (2fa8f70).

Additional details and impacted files
@@             Coverage Diff              @@
##           develop    #6900       +/-   ##
============================================
+ Coverage         0   85.60%   +85.60%     
============================================
  Files            0      148      +148     
  Lines            0    21456    +21456     
============================================
+ Hits             0    18367    +18367     
- Misses           0     3089     +3089     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@coveralls
Copy link

coveralls commented Feb 13, 2025

Coverage Status

coverage: 85.62%. remained the same
when pulling 2fa8f70 on issues/dsotirho-ucsc/6070-log-durations-3
into 3f8d8d9 on develop.

@dsotirho-ucsc dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/6070-log-durations-3 branch 2 times, most recently from 0fcfb0d to cb3f959 Compare February 19, 2025 02:29
@dsotirho-ucsc dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/6070-log-durations-3 branch 8 times, most recently from 59b5f49 to 3f0dfeb Compare February 21, 2025 01:38
@dsotirho-ucsc dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/6070-log-durations-3 branch from 3f0dfeb to 4dddcfa Compare February 21, 2025 17:25
@dsotirho-ucsc
Copy link
Contributor Author

Deploy of tempdev.shared

Note import of aws_cloudwatch_log_group.chatbot

...
Creating shared.tf.json
terraform validate
Success! The configuration is valid.

python /Users/daniel/repo/azul3/scripts/rename_resources.py
2025-02-21 09:27:53,736    INFO MainThread azul.terraform: Running ['terraform', 'state', 'list']
2025-02-21 09:27:55,461    INFO MainThread __main__: Found 'aws_securityhub_standards_control.nist_control_macie_1', already renamed
2025-02-21 09:27:55,461    INFO MainThread __main__: Found 'aws_securityhub_standards_control.nist_control_macie_2', already renamed
python /Users/daniel/repo/azul3/scripts/import_default_vpc.py
2025-02-21 09:27:55,621    INFO MainThread azul.terraform: Running ['terraform', 'state', 'list']
2025-02-21 09:27:57,188    INFO MainThread __main__: The default VPC has already been imported.
2025-02-21 09:27:57,188    INFO MainThread __main__: The default VPC's default security group has already been imported.
python /Users/daniel/repo/azul3/scripts/import_cloudwatch_log_groups.py
2025-02-21 09:27:57,373    INFO MainThread botocore.credentials: Found credentials in environment variables.
2025-02-21 09:27:57,932    INFO MainThread azul.terraform: Running ['terraform', 'state', 'list']
2025-02-21 09:27:59,598    INFO MainThread __main__: Importing resource 'aws_cloudwatch_log_group.chatbot'.
2025-02-21 09:27:59,598    INFO MainThread azul.terraform: Running ['terraform', 'import', 'aws_cloudwatch_log_group.chatbot', '/aws/chatbot/azul-chatbot-tempdev']
terraform apply
aws_iam_role.chatbot: Refreshing state... [id=azul-chatbot-tempdev]

...

Terraform will perform the following actions:

  # aws_cloudwatch_log_group.chatbot will be updated in-place
  ~ resource "aws_cloudwatch_log_group" "chatbot" {
        id                = "/aws/chatbot/azul-chatbot-tempdev"
        name              = "/aws/chatbot/azul-chatbot-tempdev"
      ~ retention_in_days = 0 -> 365
      ~ tags              = {
          + "Name"                = "azul-chatbot"
          + "billing"             = "anvil"
          + "component"           = "azul-chatbot"
          + "deployment"          = "tempdev"
          + "owner"               = "hannes@ucsc.edu"
          + "service"             = "azul"
          + "terraform_component" = "shared"
        }
      ~ tags_all          = {
          + "Name"                = "azul-chatbot"
          + "billing"             = "anvil"
          + "component"           = "azul-chatbot"
          + "deployment"          = "tempdev"
          + "owner"               = "hannes@ucsc.edu"
          + "service"             = "azul"
          + "terraform_component" = "shared"
        }
        # (5 unchanged attributes hidden)
    }

  # aws_s3_bucket_lifecycle_configuration.aws_config will be created
  + resource "aws_s3_bucket_lifecycle_configuration" "aws_config" {
      + bucket                                 = "edu-ucsc-gi-platform-temp-dev-awsconfig.us-east-1"
      + id                                     = (known after apply)
      + transition_default_minimum_object_size = (known after apply)

      + rule {
          + id     = "expire"
          + status = "Enabled"

          + expiration {
              + days                         = 365
              + expired_object_delete_marker = (known after apply)
            }

          + filter {
            }
        }
    }

  # null_resource.image_2uFW_Y3KhG1_fxcxU05r03sqN2E must be replaced
-/+ resource "null_resource" "image_2uFW_Y3KhG1_fxcxU05r03sqN2E" {
      ~ id       = "6334824724549167320" -> (known after apply)
      ~ triggers = { # forces replacement
          ~ "always" = "2025-02-21T17:02:30Z" -> (known after apply)
        }
    }

...

  # null_resource.repository_zWG8IIspasm7Xd9EUMjU6ACUZec must be replaced
-/+ resource "null_resource" "repository_zWG8IIspasm7Xd9EUMjU6ACUZec" {
      ~ id       = "1874068156324778273" -> (known after apply)
      ~ triggers = { # forces replacement
          ~ "always" = "2025-02-21T17:03:30Z" -> (known after apply)
        }
    }

Plan: 24 to add, 1 to change, 23 to destroy.

Do you want to perform these actions?
  Terraform will perform the actions described above.
  Only 'yes' will be accepted to approve.

  Enter a value: yes

...
Apply complete! Resources: 24 added, 1 changed, 23 destroyed.

Redeploy of tempdev.shared

Note skipped import of aws_cloudwatch_log_group.chatbot

...
Creating shared.tf.json
terraform validate
Success! The configuration is valid.

python /Users/daniel/repo/azul3/scripts/rename_resources.py
2025-02-21 09:31:46,878    INFO MainThread azul.terraform: Running ['terraform', 'state', 'list']
2025-02-21 09:31:48,498    INFO MainThread __main__: Found 'aws_securityhub_standards_control.nist_control_macie_1', already renamed
2025-02-21 09:31:48,498    INFO MainThread __main__: Found 'aws_securityhub_standards_control.nist_control_macie_2', already renamed
python /Users/daniel/repo/azul3/scripts/import_default_vpc.py
2025-02-21 09:31:48,678    INFO MainThread azul.terraform: Running ['terraform', 'state', 'list']
2025-02-21 09:31:50,285    INFO MainThread __main__: The default VPC has already been imported.
2025-02-21 09:31:50,285    INFO MainThread __main__: The default VPC's default security group has already been imported.
python /Users/daniel/repo/azul3/scripts/import_cloudwatch_log_groups.py
2025-02-21 09:31:50,475    INFO MainThread botocore.credentials: Found credentials in environment variables.
2025-02-21 09:31:50,919    INFO MainThread azul.terraform: Running ['terraform', 'state', 'list']
2025-02-21 09:31:52,557    INFO MainThread __main__: Skipping import of 'aws_cloudwatch_log_group.chatbot'.
terraform apply
data.google_client_config.current: Reading...

...

Terraform will perform the following actions:

  # null_resource.image_2uFW_Y3KhG1_fxcxU05r03sqN2E must be replaced
-/+ resource "null_resource" "image_2uFW_Y3KhG1_fxcxU05r03sqN2E" {
      ~ id       = "6334824724549167320" -> (known after apply)
      ~ triggers = { # forces replacement
          ~ "always" = "2025-02-21T17:29:25Z" -> (known after apply)
        }
    }

...

  # null_resource.repository_zWG8IIspasm7Xd9EUMjU6ACUZec must be replaced
-/+ resource "null_resource" "repository_zWG8IIspasm7Xd9EUMjU6ACUZec" {
      ~ id       = "2610529275472644968" -> (known after apply)
      ~ triggers = { # forces replacement
          ~ "always" = "2025-02-21T17:30:22Z" -> (known after apply)
        }
    }

Plan: 23 to add, 0 to change, 23 to destroy.

...

Apply complete! Resources: 23 added, 0 changed, 23 destroyed.

Deploy of tempdev

Note rename and import of aws_cloudwatch_log_group resources

...
Creating step_function.tf.json
terraform validate
Success! The configuration is valid.

python /Users/daniel/repo/azul3/scripts/rename_resources.py
2025-02-21 09:37:16,969    INFO MainThread azul.terraform: Running ['terraform', 'state', 'list']
2025-02-21 09:37:18,688    INFO MainThread __main__: Found 'aws_cloudwatch_log_group.indexer', renaming it to 'aws_cloudwatch_log_group.indexer_api_gateway'
2025-02-21 09:37:18,689    INFO MainThread azul.terraform: Running ['terraform', 'state', 'mv', 'aws_cloudwatch_log_group.indexer', 'aws_cloudwatch_log_group.indexer_api_gateway']
2025-02-21 09:37:23,668    INFO MainThread __main__: Found 'aws_cloudwatch_log_group.service', renaming it to 'aws_cloudwatch_log_group.service_api_gateway'
2025-02-21 09:37:23,669    INFO MainThread azul.terraform: Running ['terraform', 'state', 'mv', 'aws_cloudwatch_log_group.service', 'aws_cloudwatch_log_group.service_api_gateway']
python /Users/daniel/repo/azul3/scripts/import_cloudwatch_log_groups.py
2025-02-21 09:37:27,306    INFO MainThread botocore.credentials: Found credentials in environment variables.
2025-02-21 09:37:28,185    INFO MainThread azul.terraform: Running ['terraform', 'state', 'list']
2025-02-21 09:37:29,952    INFO MainThread __main__: Importing resource 'aws_cloudwatch_log_group.indexer_lambda'.
2025-02-21 09:37:29,953    INFO MainThread azul.terraform: Running ['terraform', 'import', 'aws_cloudwatch_log_group.indexer_lambda', '/aws/lambda/azul-indexer-tempdev']
2025-02-21 09:37:37,791    INFO MainThread __main__: Importing resource 'aws_cloudwatch_log_group.indexer_forward_alb_logs_lambda'.
2025-02-21 09:37:37,791    INFO MainThread azul.terraform: Running ['terraform', 'import', 'aws_cloudwatch_log_group.indexer_forward_alb_logs_lambda', '/aws/lambda/azul-indexer-tempdev-forward_alb_logs']
2025-02-21 09:37:45,324    INFO MainThread __main__: Importing resource 'aws_cloudwatch_log_group.indexer_forward_s3_logs_lambda'.
2025-02-21 09:37:45,325    INFO MainThread azul.terraform: Running ['terraform', 'import', 'aws_cloudwatch_log_group.indexer_forward_s3_logs_lambda', '/aws/lambda/azul-indexer-tempdev-forward_s3_logs']
2025-02-21 09:37:52,092    INFO MainThread __main__: Importing resource 'aws_cloudwatch_log_group.indexer_indexercachehealth_lambda'.
2025-02-21 09:37:52,092    INFO MainThread azul.terraform: Running ['terraform', 'import', 'aws_cloudwatch_log_group.indexer_indexercachehealth_lambda', '/aws/lambda/azul-indexer-tempdev-indexercachehealth']
2025-02-21 09:37:58,922    INFO MainThread __main__: Importing resource 'aws_cloudwatch_log_group.service_lambda'.
2025-02-21 09:37:58,923    INFO MainThread azul.terraform: Running ['terraform', 'import', 'aws_cloudwatch_log_group.service_lambda', '/aws/lambda/azul-service-tempdev']
2025-02-21 09:38:05,791    INFO MainThread __main__: Importing resource 'aws_cloudwatch_log_group.service_servicecachehealth_lambda'.
2025-02-21 09:38:05,791    INFO MainThread azul.terraform: Running ['terraform', 'import', 'aws_cloudwatch_log_group.service_servicecachehealth_lambda', '/aws/lambda/azul-service-tempdev-servicecachehealth']
2025-02-21 09:38:12,597    INFO MainThread __main__: Importing resource 'aws_cloudwatch_log_group.indexer_api_execution'.
2025-02-21 09:38:12,598    INFO MainThread azul.terraform: Running ['terraform', 'import', 'aws_cloudwatch_log_group.indexer_api_execution', 'API-Gateway-Execution-Logs_d9xt10gjh8/tempdev']
2025-02-21 09:38:20,106    INFO MainThread __main__: Importing resource 'aws_cloudwatch_log_group.service_api_execution'.
2025-02-21 09:38:20,106    INFO MainThread azul.terraform: Running ['terraform', 'import', 'aws_cloudwatch_log_group.service_api_execution', 'API-Gateway-Execution-Logs_en4r0jtgri/tempdev']
terraform apply
null_resource.hmac_secret: Refreshing state... [id=5577006791947779410]

...

Terraform will perform the following actions:

  # aws_cloudwatch_log_group.indexer_aggregate_lambda will be created
  + resource "aws_cloudwatch_log_group" "indexer_aggregate_lambda" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "/aws/lambda/azul-indexer-tempdev-aggregate"
      + name_prefix       = (known after apply)
      + retention_in_days = 365
      + skip_destroy      = false
      + tags              = {
          + "Name"       = "azul-indexer_aggregate_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_aggregate_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
      + tags_all          = {
          + "Name"       = "azul-indexer_aggregate_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_aggregate_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
    }

  # aws_cloudwatch_log_group.indexer_aggregate_retry_lambda will be created
  + resource "aws_cloudwatch_log_group" "indexer_aggregate_retry_lambda" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "/aws/lambda/azul-indexer-tempdev-aggregate_retry"
      + name_prefix       = (known after apply)
      + retention_in_days = 365
      + skip_destroy      = false
      + tags              = {
          + "Name"       = "azul-indexer_aggregate_retry_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_aggregate_retry_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
      + tags_all          = {
          + "Name"       = "azul-indexer_aggregate_retry_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_aggregate_retry_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
    }

  # aws_cloudwatch_log_group.indexer_api_execution will be updated in-place
  ~ resource "aws_cloudwatch_log_group" "indexer_api_execution" {
        id                = "API-Gateway-Execution-Logs_d9xt10gjh8/tempdev"
        name              = "API-Gateway-Execution-Logs_d9xt10gjh8/tempdev"
      ~ retention_in_days = 0 -> 365
      ~ tags              = {
          + "Name"       = "azul-indexer_api_execution-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_api_execution"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
      ~ tags_all          = {
          + "Name"       = "azul-indexer_api_execution-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_api_execution"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
        # (5 unchanged attributes hidden)
    }

  # aws_cloudwatch_log_group.indexer_api_gateway will be updated in-place
  ~ resource "aws_cloudwatch_log_group" "indexer_api_gateway" {
        id                = "/aws/apigateway/azul-indexer-tempdev"
        name              = "/aws/apigateway/azul-indexer-tempdev"
      ~ tags              = {
          ~ "Name"       = "azul-indexer-tempdev" -> "azul-indexer_api_gateway-tempdev"
            "billing"    = "anvil"
          ~ "component"  = "azul-indexer" -> "azul-indexer_api_gateway"
            "deployment" = "tempdev"
            "owner"      = "hannes@ucsc.edu"
            "service"    = "azul"
        }
      ~ tags_all          = {
          ~ "Name"       = "azul-indexer-tempdev" -> "azul-indexer_api_gateway-tempdev"
          ~ "component"  = "azul-indexer" -> "azul-indexer_api_gateway"
            # (4 unchanged elements hidden)
        }
        # (6 unchanged attributes hidden)
    }

  # aws_cloudwatch_log_group.indexer_contribute_lambda will be created
  + resource "aws_cloudwatch_log_group" "indexer_contribute_lambda" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "/aws/lambda/azul-indexer-tempdev-contribute"
      + name_prefix       = (known after apply)
      + retention_in_days = 365
      + skip_destroy      = false
      + tags              = {
          + "Name"       = "azul-indexer_contribute_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_contribute_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
      + tags_all          = {
          + "Name"       = "azul-indexer_contribute_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_contribute_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
    }

  # aws_cloudwatch_log_group.indexer_contribute_retry_lambda will be created
  + resource "aws_cloudwatch_log_group" "indexer_contribute_retry_lambda" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "/aws/lambda/azul-indexer-tempdev-contribute_retry"
      + name_prefix       = (known after apply)
      + retention_in_days = 365
      + skip_destroy      = false
      + tags              = {
          + "Name"       = "azul-indexer_contribute_retry_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_contribute_retry_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
      + tags_all          = {
          + "Name"       = "azul-indexer_contribute_retry_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_contribute_retry_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
    }

  # aws_cloudwatch_log_group.indexer_forward_alb_logs_lambda will be updated in-place
  ~ resource "aws_cloudwatch_log_group" "indexer_forward_alb_logs_lambda" {
        id                = "/aws/lambda/azul-indexer-tempdev-forward_alb_logs"
        name              = "/aws/lambda/azul-indexer-tempdev-forward_alb_logs"
      ~ retention_in_days = 0 -> 365
      ~ tags              = {
          + "Name"       = "azul-indexer_forward_alb_logs_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_forward_alb_logs_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
      ~ tags_all          = {
          + "Name"       = "azul-indexer_forward_alb_logs_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_forward_alb_logs_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
        # (5 unchanged attributes hidden)
    }

  # aws_cloudwatch_log_group.indexer_forward_s3_logs_lambda will be updated in-place
  ~ resource "aws_cloudwatch_log_group" "indexer_forward_s3_logs_lambda" {
        id                = "/aws/lambda/azul-indexer-tempdev-forward_s3_logs"
        name              = "/aws/lambda/azul-indexer-tempdev-forward_s3_logs"
      ~ retention_in_days = 0 -> 365
      ~ tags              = {
          + "Name"       = "azul-indexer_forward_s3_logs_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_forward_s3_logs_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
      ~ tags_all          = {
          + "Name"       = "azul-indexer_forward_s3_logs_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_forward_s3_logs_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
        # (5 unchanged attributes hidden)
    }

  # aws_cloudwatch_log_group.indexer_indexercachehealth_lambda will be updated in-place
  ~ resource "aws_cloudwatch_log_group" "indexer_indexercachehealth_lambda" {
        id                = "/aws/lambda/azul-indexer-tempdev-indexercachehealth"
        name              = "/aws/lambda/azul-indexer-tempdev-indexercachehealth"
      ~ retention_in_days = 0 -> 365
      ~ tags              = {
          + "Name"       = "azul-indexer_indexercachehealth_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_indexercachehealth_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
      ~ tags_all          = {
          + "Name"       = "azul-indexer_indexercachehealth_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_indexercachehealth_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
        # (5 unchanged attributes hidden)
    }

  # aws_cloudwatch_log_group.indexer_lambda will be updated in-place
  ~ resource "aws_cloudwatch_log_group" "indexer_lambda" {
        id                = "/aws/lambda/azul-indexer-tempdev"
        name              = "/aws/lambda/azul-indexer-tempdev"
      ~ retention_in_days = 0 -> 365
      ~ tags              = {
          + "Name"       = "azul-indexer_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
      ~ tags_all          = {
          + "Name"       = "azul-indexer_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-indexer_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
        # (5 unchanged attributes hidden)
    }

  # aws_cloudwatch_log_group.service_api_execution will be updated in-place
  ~ resource "aws_cloudwatch_log_group" "service_api_execution" {
        id                = "API-Gateway-Execution-Logs_en4r0jtgri/tempdev"
        name              = "API-Gateway-Execution-Logs_en4r0jtgri/tempdev"
      ~ retention_in_days = 0 -> 365
      ~ tags              = {
          + "Name"       = "azul-service_api_execution-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-service_api_execution"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
      ~ tags_all          = {
          + "Name"       = "azul-service_api_execution-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-service_api_execution"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
        # (5 unchanged attributes hidden)
    }

  # aws_cloudwatch_log_group.service_api_gateway will be updated in-place
  ~ resource "aws_cloudwatch_log_group" "service_api_gateway" {
        id                = "/aws/apigateway/azul-service-tempdev"
        name              = "/aws/apigateway/azul-service-tempdev"
      ~ tags              = {
          ~ "Name"       = "azul-service-tempdev" -> "azul-service_api_gateway-tempdev"
            "billing"    = "anvil"
          ~ "component"  = "azul-service" -> "azul-service_api_gateway"
            "deployment" = "tempdev"
            "owner"      = "hannes@ucsc.edu"
            "service"    = "azul"
        }
      ~ tags_all          = {
          ~ "Name"       = "azul-service-tempdev" -> "azul-service_api_gateway-tempdev"
          ~ "component"  = "azul-service" -> "azul-service_api_gateway"
            # (4 unchanged elements hidden)
        }
        # (6 unchanged attributes hidden)
    }

  # aws_cloudwatch_log_group.service_lambda will be updated in-place
  ~ resource "aws_cloudwatch_log_group" "service_lambda" {
        id                = "/aws/lambda/azul-service-tempdev"
        name              = "/aws/lambda/azul-service-tempdev"
      ~ retention_in_days = 0 -> 365
      ~ tags              = {
          + "Name"       = "azul-service_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-service_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
      ~ tags_all          = {
          + "Name"       = "azul-service_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-service_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
        # (5 unchanged attributes hidden)
    }

  # aws_cloudwatch_log_group.service_manifest_lambda will be created
  + resource "aws_cloudwatch_log_group" "service_manifest_lambda" {
      + arn               = (known after apply)
      + id                = (known after apply)
      + log_group_class   = (known after apply)
      + name              = "/aws/lambda/azul-service-tempdev-manifest"
      + name_prefix       = (known after apply)
      + retention_in_days = 365
      + skip_destroy      = false
      + tags              = {
          + "Name"       = "azul-service_manifest_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-service_manifest_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
      + tags_all          = {
          + "Name"       = "azul-service_manifest_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-service_manifest_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
    }

  # aws_cloudwatch_log_group.service_servicecachehealth_lambda will be updated in-place
  ~ resource "aws_cloudwatch_log_group" "service_servicecachehealth_lambda" {
        id                = "/aws/lambda/azul-service-tempdev-servicecachehealth"
        name              = "/aws/lambda/azul-service-tempdev-servicecachehealth"
      ~ retention_in_days = 0 -> 365
      ~ tags              = {
          + "Name"       = "azul-service_servicecachehealth_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-service_servicecachehealth_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
      ~ tags_all          = {
          + "Name"       = "azul-service_servicecachehealth_lambda-tempdev"
          + "billing"    = "anvil"
          + "component"  = "azul-service_servicecachehealth_lambda"
          + "deployment" = "tempdev"
          + "owner"      = "hannes@ucsc.edu"
          + "service"    = "azul"
        }
        # (5 unchanged attributes hidden)
    }

  # aws_lambda_function.indexer will be updated in-place
  ~ resource "aws_lambda_function" "indexer" {
        id                             = "azul-indexer-tempdev"
        tags                           = {
            "Name"        = "azul-indexer-tempdev"
            "aws-chalice" = "version=1.31.3:stage=tempdev:app=azul-indexer"
            "billing"     = "anvil"
            "component"   = "azul-indexer"
            "deployment"  = "tempdev"
            "owner"       = "hannes@ucsc.edu"
            "service"     = "azul"
        }
        # (29 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              ~ "azul_git_commit"                          = "3f8d8d9fb3441bbbfb05fa766ec8d97e82b8b59c" -> "4dddcfa6c2b5e42d584ede4f7650a022dbdcd3b1"
                # (43 unchanged elements hidden)
            }
        }

        # (4 unchanged blocks hidden)
    }

...

  # aws_lambda_function.service_servicecachehealth will be updated in-place
  ~ resource "aws_lambda_function" "service_servicecachehealth" {
        id                             = "azul-service-tempdev-servicecachehealth"
        tags                           = {
            "Name"        = "azul-service_servicecachehealth-tempdev"
            "aws-chalice" = "version=1.31.3:stage=tempdev:app=azul-service"
            "billing"     = "anvil"
            "component"   = "azul-service_servicecachehealth"
            "deployment"  = "tempdev"
            "owner"       = "hannes@ucsc.edu"
            "service"     = "azul"
        }
        # (29 unchanged attributes hidden)

      ~ environment {
          ~ variables = {
              ~ "azul_git_commit"                          = "3f8d8d9fb3441bbbfb05fa766ec8d97e82b8b59c" -> "4dddcfa6c2b5e42d584ede4f7650a022dbdcd3b1"
                # (43 unchanged elements hidden)
            }
        }

        # (4 unchanged blocks hidden)
    }

Plan: 5 to add, 21 to change, 0 to destroy.

...

Apply complete! Resources: 5 added, 21 changed, 0 destroyed.

Redeploy of tempdev

Note no rename nor import of aws_cloudwatch_log_group resources

...
Creating step_function.tf.json
terraform validate
Success! The configuration is valid.

python /Users/daniel/repo/azul3/scripts/rename_resources.py
2025-02-21 09:41:28,931    INFO MainThread azul.terraform: Running ['terraform', 'state', 'list']
2025-02-21 09:41:30,627    INFO MainThread __main__: Found 'aws_cloudwatch_log_group.indexer_api_gateway', already renamed
2025-02-21 09:41:30,627    INFO MainThread __main__: Found 'aws_cloudwatch_log_group.service_api_gateway', already renamed
python /Users/daniel/repo/azul3/scripts/import_cloudwatch_log_groups.py
2025-02-21 09:41:30,836    INFO MainThread botocore.credentials: Found credentials in environment variables.
2025-02-21 09:41:31,669    INFO MainThread azul.terraform: Running ['terraform', 'state', 'list']
2025-02-21 09:41:33,783    INFO MainThread __main__: Skipping import of 'aws_cloudwatch_log_group.indexer_lambda'.
2025-02-21 09:41:33,784    INFO MainThread __main__: Skipping import of 'aws_cloudwatch_log_group.indexer_aggregate_lambda'.
2025-02-21 09:41:33,784    INFO MainThread __main__: Skipping import of 'aws_cloudwatch_log_group.indexer_aggregate_retry_lambda'.
2025-02-21 09:41:33,784    INFO MainThread __main__: Skipping import of 'aws_cloudwatch_log_group.indexer_contribute_lambda'.
2025-02-21 09:41:33,784    INFO MainThread __main__: Skipping import of 'aws_cloudwatch_log_group.indexer_contribute_retry_lambda'.
2025-02-21 09:41:33,784    INFO MainThread __main__: Skipping import of 'aws_cloudwatch_log_group.indexer_forward_alb_logs_lambda'.
2025-02-21 09:41:33,784    INFO MainThread __main__: Skipping import of 'aws_cloudwatch_log_group.indexer_forward_s3_logs_lambda'.
2025-02-21 09:41:33,784    INFO MainThread __main__: Skipping import of 'aws_cloudwatch_log_group.indexer_indexercachehealth_lambda'.
2025-02-21 09:41:33,784    INFO MainThread __main__: Skipping import of 'aws_cloudwatch_log_group.service_lambda'.
2025-02-21 09:41:33,784    INFO MainThread __main__: Skipping import of 'aws_cloudwatch_log_group.service_manifest_lambda'.
2025-02-21 09:41:33,784    INFO MainThread __main__: Skipping import of 'aws_cloudwatch_log_group.service_servicecachehealth_lambda'.
2025-02-21 09:41:33,784    INFO MainThread __main__: Skipping import of 'aws_cloudwatch_log_group.indexer_api_execution'.
2025-02-21 09:41:33,784    INFO MainThread __main__: Skipping import of 'aws_cloudwatch_log_group.service_api_execution'.
terraform apply
data.google_client_config.current: Reading...

...

No changes. Your infrastructure matches the configuration.

Terraform has compared your real infrastructure against your configuration and found no differences, so no changes are needed.

Apply complete! Resources: 0 added, 0 changed, 0 destroyed.

@dsotirho-ucsc
Copy link
Contributor Author

Screenshot 2025-02-21 at 9 42 12 AM

@dsotirho-ucsc
Copy link
Contributor Author

6900_IT_2025-02-21.txt

Copy link
Member

@achave11-ucsc achave11-ucsc left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes look good, a pair of considerations + CL item unchecked.

  • The FIXMEs might be more distinguishable if they stand alone as commits, your call.
  • Something in the import script indiscriminately tries to run the Terraform import command on a log group that exists (for an old and now non-existent Lambda) but isn't managed by Terraform. Perhaps as intended?
    2025-02-21 15:36:11,921    INFO MainThread azul.terraform: Running ['terraform', 'import', 'aws_cloudwatch_log_group.indexer_contribute_redrive_lambda', '/aws/lambda/azul-indexer-abrahamsc-contribute_redrive']
    Error: resource address "aws_cloudwatch_log_group.indexer_contribute_redrive_lambda" does not exist in the configuration.
    
    Before importing this resource, please create its configuration in the root module. For example:
    
    resource "aws_cloudwatch_log_group" "indexer_contribute_redrive_lambda" {
      # (resource arguments)
    }
    
    Traceback (most recent call last):
      File "/Users/achave11/Pycharm/Azul/azul.sc/scripts/import_cloudwatch_log_groups.py", line 78, in <module>
        main()
      File "/Users/achave11/Pycharm/Azul/azul.sc/scripts/import_cloudwatch_log_groups.py", line 73, in main
        terraform.run('import', resource_name, log_group)
      File "/Users/achave11/Pycharm/Azul/azul.sc/src/azul/terraform.py", line 101, in run
        cmd = subprocess.run(args,
              ^^^^^^^^^^^^^^^^^^^^
      File "/Users/achave11/.pyenv/versions/3.12.8/lib/python3.12/subprocess.py", line 571, in run
        raise CalledProcessError(retcode, process.args,
    subprocess.CalledProcessError: Command '['terraform', 'import', 'aws_cloudwatch_log_group.indexer_contribute_redrive_lambda', '/aws/lambda/azul-indexer-abrahamsc-contribute_redrive']' returned non-zero exit status 1.
    make: *** [import_resources] Error 1
    
  • I noticed the changes and IT (from provided logs) were tested on the tempdev deployment, was this also tested in a personal deployment?

@achave11-ucsc achave11-ucsc removed their assignment Feb 22, 2025
@dsotirho-ucsc dsotirho-ucsc force-pushed the issues/dsotirho-ucsc/6070-log-durations-3 branch from 4dddcfa to 2fa8f70 Compare February 24, 2025 23:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
deploy:shared [process] PR requires deploying `shared` component orange [process] Done by the Azul team
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants