PLT-1666 : Update lambda function module to support deployment and testing via Tofu by mianava · Pull Request #456 · CMSgov/cdap

mianava · 2026-04-25T05:42:59Z

🎫 Ticket

🛠 Changes

Alarm-to-slack function changes:

updates tags in alignment with standards module
builds function from source directory
turns on testing

Lambda function changes:

The function module no longer includes SQS or broad SSM permissions in its default policy. Callers must now pass these in explicitly via:

ssm_parameter_paths — for SSM parameter access
function_role_inline_policies — for SQS, S3, or other runtime permissions

Logging: IAM restricted to cloudwatch log group for function, which is now managed to support common retention requirements:
** Callers must now import existing cloudwatch log groups for management by the function module **

Lambda function testing:

creates a tftesting/function path that can be leveraged for local testing of Tofu changes to the function modules
creates a git workflow to evaluate the successful creation and destruction of a lambda function in the cdap test environment upon PR to the function module, allowing validation of CICD flows through Tofu for functions

Security group modifications were not made as part of these changes.

ℹ️ Context

These changes were motivated by updating the alarm-to-slack lambda predictably from source code in the CDAP repository. Additional enhancements were made to ensure IAM is refined for this function, which uplifted needs to refine the IAM broadly, enhance testablity, and ensure delivery pipeline predictability.

🧪 Validation

After initial review, these changes will be deployed to cdap-test and a test alarm will be sent via SNS topic for evaluation.

bcda-test

Details

Changes will be applied to bcda-test as in the git workflow plan output. 1. A test alarm will be sent via AB2D's sns topic 2. A test alarm will be sent via DPC's sns topic

cdap-test

Details

Changes will be applied to cdap-test as in the git workflow plan output.

A test alarm will be sent via DPC's sns topic.

…ags.

mianava · 2026-04-25T06:30:07Z

+
+  permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/cms-cloud-admin/developer-boundary-policy"
+
+  assume_role_policy = data.aws_iam_policy_document.function_assume_role.json


I need to dig into if this is still relevant in our permissions setup.

mianava · 2026-04-25T06:30:57Z

-  repos = {
-    bcda = [
-      "repo:CMSgov/bcda-app:*",
-    ]
-    cdap = [
-      "repo:CMSgov/cdap:*",
-    ]
-    dpc = [
-      "repo:CMSgov/dpc-app:*",
-    ]
-  }


These are moved into a variable in the case that repositories are managing deployment. See variable github_actions_repos

mianava · 2026-04-25T06:32:44Z

-data "aws_ssm_parameter" "prod_account_id" {
-  count = var.env == "test" ? 1 : 0
-  name  = "/prod/account-id"
-}


cdap-mgmt is being deprecated in favor of a cdap- vpc managing lambdas in a dedicated fashion within accounts: cross-account access is no longer relevant.

mianava · 2026-04-25T06:44:29Z

  description = "Optional list of additional KMS key ARNs the Lambda can use"
+  type        = list(string)
+  default     = []
 }


Is this used anywhere? Do we have a use case for this?

… be easily used elsewhere.

lukey-luke · 2026-04-28T17:35:08Z

+  source_dir_excludes = [
+    "__pycache__",
+    "test_*.py",
+    "*.pyc",


lukey-luke · 2026-04-28T17:40:56Z

+  }
+
+  # Allow access from GitHub-hosted runners via OIDC for integration tests
+  dynamic "statement" {


Are these changes covered in tests somewhere in the cdap repo? Any additional workflow changes required?

I reckon this might be a larger effort and should be moved to a separate PR, but please let me know where I can review

I updated this PR with a test function that will also come up and down on apply.

lukey-luke · 2026-04-28T17:46:31Z

+variable "log_retention_days" {
+  description = "Number of days to retain Lambda function logs in CloudWatch. If null, no retention policy is set and retention is managed externally (e.g., via cdap/scripts/set_log_retention/)."
+  type        = number
+  default     = 180


If we already have a mechanism to manage logs and there's a program-wide standard for retention period, it might be easier to make this optional/default to null.

Then default log retention period for CW logs only lives in one place. This way, if default needs to change from 180 days to 90 days for example, there are less moving pieces.

lukey-luke · 2026-04-28T17:50:50Z

I verified the webhook_urls already exist for DPC on parameter store ✅
File structure for alarm-to-slack/ makes sense and follow existing conventions ✅
Python code is up-to-date w/ arm64 updates ✅
Active thread on CW logs 🔁

Changes in function module for CI/CD enablement are not clear to me ❌

Consider moving to a separate ticket or PR
Please include additional links or info on how to make use of github_actions_repos

## 🎫 Ticket https://jira.cms.gov/browse/AB2D-7227 ## 🛠 Changes Bumps the version of the aws provider to v6, and alters one field deprecated in the new version. ## ℹ️ Context AB2D is upgrading Java to version 25, and the aws provider v5 only supports up to version 21. This change keeps the version of the aws provider aligned and prevents mismatch errors on AB2Ds side. This change will support upgrades to java in this PR: CMSgov/ab2d#1769 ## 🧪 Validation Updated platform ref used in the AB2D lambdas, works as expected and can find Java25.

@SJWalter11

## 🎫 Ticket DPC-5387 ## 🛠 Changes  - define new _optional_ input variable for bucket module's encryption key - default behavior remains exactly the same ## ℹ️ Context   - For DPC's we have a use case where we want to explicitly specify a key for s3 to use for encrypting files. - For quicksight reporting, the same bucket is used by - 1. postgres extension(s) to output data - Example query `create_job()` query [HERE](https://github.com/CMSgov/dpc-app/blob/main/scripts/schedule_view_exports.sql#L43) - 2. python lambda to process data into a report - Previous dpc-ops changes relied on a free-floating feature branch from this repository specified [HERE](https://github.com/CMSgov/dpc-ops/blob/f19985817a3165bd2e227914b2c557ef7575849d/terraform/lambda/quicksight-reports/main.tf#L79) - This PR is intended to be merged before further dpc-ops changes to avoid code becoming brittle based on a separate branch ## 🧪 Validation  Tested in dpc `test` environment. See Validation section in dpc-ops PR: CMSgov/dpc-ops#947 --------- Co-authored-by: Julian Scott <julianscott@navapbc.com>

## 🎫 Ticket https://jira.cms.gov/browse/BCDA-9967 ## 🛠 Changes Adding `model_name` to the production and sandbox jobs view ## ℹ️ Context We want to have the Alternative Payment Model included in job request data so that it can be easily aggregated, without having to derive the model from each entity's CMS ID ## 🧪 Validation Executed queries against prod/sandbox locally

## 🎫 Ticket https://jira.cms.gov/browse/BCDA-9967 ## 🛠 Changes Updated column order to match the existing view ## ℹ️ Context Postgres rigidly maintains the existing column order for the existing view unless we drop and recreate the view. The earlier PR merged (#461) yields error: ``` SQL Error [42P16]: ERROR: cannot change name of view column "cms_id" to "benes_attributed_to_aco" Hint: Use ALTER VIEW ... RENAME COLUMN ... to change name of view column instead. ``` ## 🧪 Validation Executed/Updated views (without errors) and checked retrieved data

@SJWalter11

## 🎫 Ticket PLT-1661 ## 🛠 Changes  Migrates python checks to leverage sonarqube and snyk for linting and security validation. Enables a common workflow that is then called by relevant python check workflows on python paths in scripts/ or in terraform paths with /lambda_src/. Sets up a snyk token for usage in a CDAP specific organization in CMS snyk. ## ℹ️ Context  These changes were made to use standard code scanning tools provided by CMS.  ## 🧪 Validation The workflow can be validated once merged. The python-checks script was run locally which works for snyk scanning and configuring sonar, but does not test full evaluation for sonar as the project cannot be created with the common user credentials.

mianava added 6 commits April 25, 2026 00:45

Build alarm to slack function from source code. Manage logs. Update t…

a9b8c67

…ags.

Enable source code updates via Tofu. Manage cloudwatch logs. Refine IAM.

9e2d3da

Manage sqs iam access

ca1aed8

Allow CICD only when source is not provided.

d24e52d

Remove unusable permission for an assumed role

1711714

Enable log tag management from github

0cdc775

mianava commented Apr 25, 2026

View reviewed changes

Create dummy function if no other configuration is available.

3bc9837

mianava commented Apr 25, 2026

View reviewed changes

mianava marked this pull request as ready for review April 27, 2026 12:50

mianava requested a review from a team as a code owner April 27, 2026 12:50

Use security group rule instead of inline so security gorup rules can…

b85fc09

… be easily used elsewhere.

juliareynolds-nava reviewed Apr 27, 2026

View reviewed changes

Comment thread terraform/modules/function/main.tf

mianava added 2 commits April 27, 2026 12:14

Ensure security groups can be refined

9dbe1b6

Only force log retention in prod

b25b0c7

lukey-luke reviewed Apr 28, 2026

View reviewed changes

mianava marked this pull request as draft April 29, 2026 15:00

mianava and others added 8 commits May 4, 2026 21:11

Add a liveness check

72fd839

Set up place for test function

ab0a1e4

Remove outdated documentation

7ef9737

mianava added 4 commits May 5, 2026 21:45

Add rollback support

4d6a342

Add lambda function for testing

8badb99

Add workflow to test lambda function and tear down upon success.

42e7ed7

Merge branch 'main' into PLT-1666/alarmtoslack

e42c677

mianava changed the title ~~PLT-1666 : Update lambda function to update alarm-to-slack via source code~~ PLT-1666 : Update lambda function module to support deployment and testing via Tofu May 6, 2026

mianava added 2 commits May 5, 2026 22:45

Updating testing for alarm to slack lambda

0bf3a7a

Configure testable lambda function that's ephemeral.

8743178

mianava force-pushed the PLT-1666/alarmtoslack branch from 4cdd4ab to 8743178 Compare May 6, 2026 02:46

mianava added 6 commits May 5, 2026 22:51

Lookup by id

db1bee0

Remove permissions boundary as no longer required

e2beccb

Set backend properly for destroy

ef94db1

Run tests only and wait for other PR for code scannign

01cc647

Ensure naming uniqueness

829c64e

Prevent redundant labeling

a013663

juliareynolds-nava previously approved these changes May 6, 2026

View reviewed changes

Remove unused actions

94ecab2

mianava dismissed juliareynolds-nava’s stale review via 94ecab2 May 6, 2026 14:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

PLT-1666 : Update lambda function module to support deployment and testing via Tofu#456

PLT-1666 : Update lambda function module to support deployment and testing via Tofu#456
mianava wants to merge 31 commits intomainfrom
PLT-1666/alarmtoslack

mianava commented Apr 25, 2026 •

edited

Loading

Uh oh!

mianava Apr 25, 2026

Uh oh!

mianava Apr 25, 2026 •

edited

Loading

Uh oh!

mianava Apr 25, 2026

Uh oh!

mianava Apr 25, 2026

Uh oh!

Uh oh!

lukey-luke Apr 28, 2026

Uh oh!

lukey-luke Apr 28, 2026

Uh oh!

mianava May 6, 2026

Uh oh!

lukey-luke Apr 28, 2026

Uh oh!

lukey-luke commented Apr 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants


		permissions_boundary = "arn:aws:iam::${data.aws_caller_identity.current.account_id}:policy/cms-cloud-admin/developer-boundary-policy"

		assume_role_policy = data.aws_iam_policy_document.function_assume_role.json

Conversation

mianava commented Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🎫 Ticket

🛠 Changes

Alarm-to-slack function changes:

Lambda function changes:

Lambda function testing:

ℹ️ Context

🧪 Validation

Uh oh!

mianava Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

mianava Apr 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

mianava Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

mianava Apr 25, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

lukey-luke Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

lukey-luke Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

mianava May 6, 2026

Choose a reason for hiding this comment

Uh oh!

lukey-luke Apr 28, 2026

Choose a reason for hiding this comment

Uh oh!

lukey-luke commented Apr 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

mianava commented Apr 25, 2026 •

edited

Loading

mianava Apr 25, 2026 •

edited

Loading