Add pen tester access to staging

.github/workflows/guardrail_matching_pentester_cidr_blocks.yml

@@ -5,7 +5,7 @@ on:
     branches: [main]
     paths:
       - "infra/deployments/forms/tfvars/staging.tfvars"
-      - "infra/deployments/forms/account/staging.tfvars"
+      - "infra/deployments/forms/account/tfvars/staging.tfvars"
       - "infra/deployments/deploy/engineer-access/roles.tf"
       - ".github/workflows/guardrail_matching_pentester_cidr_blocks.yml"
 env:

infra/deployments/deploy/engineer-access/roles.tf

@@ -16,6 +16,20 @@ module "engineer_access" {
 
   # Pentesters may not have GDS domains so our pattern using the 'users' module
   # doesn't necessarily work.
-  pentesters      = []
-  pentester_cidrs = []
+  pentesters = [
+    "matus.mihok@accenture.com",
+    "caleb.herbert@accenture.com",
+    "cameron.steel@accenture.com"
+  ]
+  pentester_cidrs = [
+    "88.98.40.224/27",
+    "172.167.216.147/32",
+    "3.10.36.101/32",
+    "35.178.26.242/32",
+    "18.168.92.160/32",
+    "18.134.34.111/32",
+    "13.41.39.172/32",
+    "20.123.237.233/32",
+    "88.208.100.190/32"
+  ]
 }

infra/deployments/forms/account/inputs.tf

@@ -101,8 +101,8 @@ variable "pentester_cidr_ranges" {
   type        = list(string)
 
   validation {
-    condition     = can([for cidr in var.pentester_cidr_ranges : cidrhost(cidr, 32)])
-    error_message = "Each entry in the last must be a valid IPv4 CIDR range"
+    condition     = can([for cidr in var.pentester_cidr_ranges : cidrhost(cidr, 0)])
+    error_message = "Each entry in the list must be a valid CIDR range"
   }
 
   validation {

infra/deployments/forms/account/tfvars/staging.tfvars

@@ -1,11 +1,25 @@
-account_name              = "staging"
-aws_account_id            = "972536609845"
-environment_name          = "staging"
-environment_type          = "staging"
-require_vpn_to_access     = true
-apex_domain               = "staging.forms.service.gov.uk"
-dns_delegation_records    = {}
-codestar_connection_arn   = "arn:aws:codeconnections:eu-west-2:972536609845:connection/065d6101-9c43-4336-8fd4-777f3d6fc791"
-deploy_account_id         = "711966560482"
-pentester_email_addresses = []
-pentester_cidr_ranges     = []
+account_name            = "staging"
+aws_account_id          = "972536609845"
+environment_name        = "staging"
+environment_type        = "staging"
+require_vpn_to_access   = true
+apex_domain             = "staging.forms.service.gov.uk"
+dns_delegation_records  = {}
+codestar_connection_arn = "arn:aws:codeconnections:eu-west-2:972536609845:connection/065d6101-9c43-4336-8fd4-777f3d6fc791"
+deploy_account_id       = "711966560482"
+pentester_email_addresses = [
+  "matus.mihok@accenture.com",
+  "caleb.herbert@accenture.com",
+  "cameron.steel@accenture.com"
+]
+pentester_cidr_ranges = [
+  "88.98.40.224/27",
+  "172.167.216.147/32",
+  "3.10.36.101/32",
+  "35.178.26.242/32",
+  "18.168.92.160/32",
+  "18.134.34.111/32",
+  "13.41.39.172/32",
+  "20.123.237.233/32",
+  "88.208.100.190/32"
+]

infra/deployments/forms/tfvars/staging.tfvars

@@ -15,15 +15,26 @@ environmental_settings = {
   database_backup_retention_period_days    = 30
   allow_authentication_from_email_domains = [
     ".gov.uk",
+    "@accenture.com",
+  ]
+  enable_alert_actions               = true
+  enable_slo_burn_rate_alert_actions = false
+  forms_product_page_support_url     = "https://www.staging.forms.service.gov.uk/support"
+  rds_maintenance_window             = "wed:04:00-wed:04:30"
+  rds_minimum_capacity_acus          = 1
+  rds_maxium_capacity_acus           = 2
+  ips_to_block                       = []
+  rate_limit_bypass_cidrs = [
+    "88.98.40.224/27",
+    "172.167.216.147/32",
+    "3.10.36.101/32",
+    "35.178.26.242/32",
+    "18.168.92.160/32",
+    "18.134.34.111/32",
+    "13.41.39.172/32",
+    "20.123.237.233/32",
+    "88.208.100.190/32"
   ]
-  enable_alert_actions                = true
-  enable_slo_burn_rate_alert_actions  = false
-  forms_product_page_support_url      = "https://www.staging.forms.service.gov.uk/support"
-  rds_maintenance_window              = "wed:04:00-wed:04:30"
-  rds_minimum_capacity_acus           = 1
-  rds_maxium_capacity_acus            = 2
-  ips_to_block                        = []
-  rate_limit_bypass_cidrs             = []
   enable_shield_advanced_healthchecks = false
   allow_pagerduty_alerts              = false
   redis_multi_az_enabled              = false

infra/deployments/integration/inputs.tf

@@ -52,8 +52,8 @@ variable "pentester_cidr_ranges" {
   type        = list(string)
 
   validation {
-    condition     = can([for cidr in var.pentester_cidr_ranges : cidrhost(cidr, 32)])
-    error_message = "Each entry in the list must be a valid IPv4 CIDR range"
+    condition     = can([for cidr in var.pentester_cidr_ranges : cidrhost(cidr, 0)])
+    error_message = "Each entry in the list must be a valid CIDR range"
   }
 }