gc3-vuln-reporting-iac

Government Cyber Coordination Centre - Vulnerability Reporting - Infrastructure as Code

Infrastructure as code (Terraform) for VRS running on AWS.

• Pre-production/staging: https://vulnerability-reporting.nonprod-service.security.gov.uk
• Production: https://vulnerability-reporting.service.security.gov.uk

security.txt

The security.txt file is generated from security.txt.tmpl and takes variables from cdn/s3.tf - it is updated on every change and deploy or every Wednesday at 9am.

Acknowledgements

Acknowledgements can be added in the cdn/variables.tf file.

Infrastructure

CloudFront CDN

cdn is for CloudFront where S3 is the backend origin, Functions are used to handle traffic dynamically and in a scalable way.

The router JavaScript function has several endpoints.

The router function has a test suite that can be ran by doing:

cd cdn/functions/router/
npm install
npm test

cd

Deployment

In order to make changes to the CDN contents, for instance front-end changes to the VRS service, you need to:

• make changes locally

• push them to the nonprod environment using terraform. The nonprod environment is behind http basic auth, and you need to set up credentials as part of the deployment. Choose a username and a password and deploy:

  If you're on MacOS:

  export BASICAUTHSTRING = printf '%s:%s' "USERNAME" "PASSWORD" | base64 | tr -d '\n'

  on Linux:

  export BASICAUTHSTRING = printf '%s:%s' "user" "pass" | base64 -w 0

  then, change to the cdn directory then:

  terraform apply -var="basicauthstring=$BASICAUTGHSTRING

Deployment to the live environment is done manually in Github Actions.

Route53 DNS

dns is the management of the Route53 zone and records.

Utilises the aws-route53-parked-govuk-domain Terraform module for parking the email records.