Ayr 446/flask app in lambda

[anthonyhashemi]

Changes in this PR

• Added zappa as poetry dependency
• Added zappa_settings.json.template and aws_attach_policy.json
• Add Deployment section in README.md so devs can run manual deployments to a Lambda-APIGateway set up on AWS, given a AWS profile of their choice, from their local machines.

JIRA ticket

https://national-archives.atlassian.net/jira/software/projects/AYR/boards/66?selectedIssue=AYR-446&text=poetry

[colinbowen]

PR looks clear to me with a great update to the README.

[ben-cerium]

This ok to get you started. The IAM policy we can slim down in the following days.
Note that the IP address restrictions have been handcranked on this currently live resource so we need make sure that stays in place. We have that policy in code but don't want to put that in a public repo so we need to chat about that also

[ben-cerium]

Might want to consider adding a lambda timeout. Think it's 30 seconds by default which is probably too high e.g.
"timeout_seconds": 7, happy if this this is put in later

[zaiziclebby]

Seems ok to me

[pgandhizaizi]

very detailed explanation in readme.md -looks good
Please check for default lambda timeout and may be reduce to a level where it has to set minimum value

[anthonyhashemi]

This ok to get you started. The IAM policy we can slim down in the following days. Note that the IP address restrictions have been handcranked on this currently live resource so we need make sure that stays in place. We have that policy in code but don't want to put that in a public repo so we need to chat about that also

So from when I have run this, it doesnt seem to overwright any of the ip stuff you have set manually. I believe that is because I am not attaching a policy for the API Gateway but just for the lambda. If we were to do that we would need to make sure the ips wereset appropriately and were filled in by env vars in github actions so they werent commited to the repo, but I think for now we can get away without it. Worth tidying it up in a follow up PR dedicated to the API Gateway policy if you agree?

And yes you are right, most of that policy is uneeded, we currently just need the Paramter store access so I will remove everything apart from that. And then once we sort the rds stuff I will add that in as needed.

[anthonyhashemi]

Might want to consider adding a lambda timeout. Think it's 30 seconds by default which is probably too high e.g. "timeout_seconds": 7, happy if this this is put in later

good shout, can do this here

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (c54e96f) 78.94% compared to head (78f2861) 78.94%.

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #71   +/-   ##
=======================================
  Coverage   78.94%   78.94%           
=======================================
  Files           7        7           
  Lines         266      266           
=======================================
  Hits          210      210           
  Misses         56       56           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[anthonyhashemi]

This ok to get you started. The IAM policy we can slim down in the following days. Note that the IP address restrictions have been handcranked on this currently live resource so we need make sure that stays in place. We have that policy in code but don't want to put that in a public repo so we need to chat about that also

So from when I have run this, it doesnt seem to overwright any of the ip stuff you have set manually. I believe that is because I am not attaching a policy for the API Gateway but just for the lambda. If we were to do that we would need to make sure the ips wereset appropriately and were filled in by env vars in github actions so they werent commited to the repo, but I think for now we can get away without it. Worth tidying it up in a follow up PR dedicated to the API Gateway policy if you agree?

And yes you are right, most of that policy is uneeded, we currently just need the Paramter store access so I will remove everything apart from that. And then once we sort the rds stuff I will add that in as needed.

have added apigateway policy with ip whitelisting being set by env vars