Repository: govuk-one-login/mobile-id-check-async
Pull request #607: DCMAW-13091: allow perf testers vpc access to proxy api
Author: login: kikidawson-gds
Created: 2025-04-30T15:44:43Z | Merged: 2025-05-01T11:15:50Z

## Jira Ticket
<!-- Add your Jira ticket link here. -->
DCMAW-13091

## Description of changes
<!-- 
- Describe what changed and why
- Call out specific areas that need focus in the review
- Call out new patterns and articulate why they're being proposed
- For larger PRs, provide guidance on how best to start the review/understand the change
-->
Changes resource policy to allow perf testers IAM role access to our proxy api.

## Review guidance
<details>
<summary>Review checklist</summary>

### Functional Review
- **Functionality**: Does it meet the acceptance criteria on the ticket and work as expected?
- **Requirements**: Does the code meet functional and non-functional requirements including compliance with programme standards and security gates?

### Security & Compliance
- **Personally Identifiable Information**: Is it possible for PII to be logged?
- **Security Considerations**: Are there any security implications that need to be addressed?

### Quality Assurance
- **Testing**: Is the code well-tested with sufficient coverage to provide confidence in correctness?
- **Edge Cases**: Have edge cases been considered and handled appropriately?

### Code Quality
- **Readability**: Is the code easy to understand for all team members, with clear naming and appropriate documentation?
- **Maintainability**: Is the code easy to change, reuse, and extend?
- **Code Style**: Does it follow our coding conventions and best practices?
- **Code Quality**: Is the code maintainable and following best practices? See [Values, Principles & Practices](https://govukverify.atlassian.net/wiki/spaces/DCMAW/pages/4955865126/ID+Check+Web+-+Values+Principles+and+Practices)

### Observability & Operations
- **Observability**: Are there appropriate logs/metrics that would help debug and monitor the service?
- **Performance**: Are there any performance considerations or potential bottlenecks?

### Documentation
- **Documentation**: Is the code well documented? Is there any existing documentation that needs updating?
- **Comments**: Are complex sections of code adequately commented if the intent is not clear?

### Review PR:
- **Title**: Contains ticket number and clear summary of change
- **Description**: Has clear description of change
</details>

## Evidence
<!-- 
- Provide evidence that changes work as expected
- For UI changes, include screenshots or recordings
- For API changes, include example requests/responses
- For infrastructure changes, include relevant logs or screenshots

Note: Leave this blank if no testing additional to the pull request workflows has been executed

When you should run the test container:
- If you've touched Docker configuration
- If you've added new environment variables
- For UI changes
-->

## Documentation
<!-- 
- Call out if key repository documentation has been updated
- Link to external documentation that has been updated

Note: Leave this blank if no documentation changes have been made
-->


Diff:
diff --git a/backend-api/infra/api/proxy.yaml b/backend-api/infra/api/proxy.yaml
index b7114fdce..33e69d64c 100644
--- a/backend-api/infra/api/proxy.yaml
+++ b/backend-api/infra/api/proxy.yaml
@@ -32,7 +32,24 @@ Resources:
         DefaultAuthorizer: AWS_IAM
         ApiKeyRequired: false
         ResourcePolicy:
-          AwsAccountWhitelist: !Sub ${AWS::AccountId}
+          CustomStatements:
+            - Sid: AllowAccountAccessToAllEndpoints
+              Effect: Allow
+              Principal:
+                AWS: !Sub "arn:aws:iam::${AWS::AccountId}:root"
+              Action:
+                - "execute-api:Invoke"
+              Resource: !Sub "execute-api:/*"
+            - Sid: AllowPerfTesterRoleAccess
+              Effect: Allow
+              Principal:
+                AWS: !FindInMap
+                  - ProxyApigw
+                  - !Ref Environment
+                  - perfTesterRoleArn
+              Action:
+                - "execute-api:Invoke"
+              Resource: !Sub "execute-api:/*"
     Condition: ProxyApiDeployment
 
   ProxyApiAccessLogs:
diff --git a/backend-api/infra/parent.yaml b/backend-api/infra/parent.yaml
index 70d3a43c0..735ebfe5b 100644
--- a/backend-api/infra/parent.yaml
+++ b/backend-api/infra/parent.yaml
@@ -121,18 +121,25 @@ Mappings:
     dev:
       ApiBurstLimit: 10
       ApiRateLimit: 10
+      # Perf test prod account - di-performance-test-prod
+      perfTesterRoleArn: arn:aws:iam::330163506186:role/perftest-PerformanceTesterRole
     build:
       ApiBurstLimit: 10
       ApiRateLimit: 10
+      # Perf test prod account - di-performance-test-prod
+      perfTesterRoleArn: arn:aws:iam::330163506186:role/perftest-PerformanceTesterRole
     staging:
       ApiBurstLimit: 10
       ApiRateLimit: 10
+      perfTesterRoleArn: ""
     integration:
       ApiBurstLimit: 0
       ApiRateLimit: 0
+      perfTesterRoleArn: ""
     production:
       ApiBurstLimit: 0
       ApiRateLimit: 0
+      perfTesterRoleArn: ""
 
   Lambda:
     dev:
diff --git a/backend-api/template.yaml b/backend-api/template.yaml
index ae749a270..162f090ae 100644
--- a/backend-api/template.yaml
+++ b/backend-api/template.yaml
@@ -251,18 +251,23 @@ Mappings:
     build:
       ApiBurstLimit: 10
       ApiRateLimit: 10
+      perfTesterRoleArn: arn:aws:iam::330163506186:role/perftest-PerformanceTesterRole
     dev:
       ApiBurstLimit: 10
       ApiRateLimit: 10
+      perfTesterRoleArn: arn:aws:iam::330163506186:role/perftest-PerformanceTesterRole
     integration:
       ApiBurstLimit: 0
       ApiRateLimit: 0
+      perfTesterRoleArn: ""
     production:
       ApiBurstLimit: 0
       ApiRateLimit: 0
+      perfTesterRoleArn: ""
     staging:
       ApiBurstLimit: 10
       ApiRateLimit: 10
+      perfTesterRoleArn: ""
 
   SessionsApigw:
     build:
@@ -5096,7 +5101,24 @@ Resources:
         ApiKeyRequired: false
         DefaultAuthorizer: AWS_IAM
         ResourcePolicy:
-          AwsAccountWhitelist: !Sub ${AWS::AccountId}
+          CustomStatements:
+            - Action:
+                - execute-api:Invoke
+              Effect: Allow
+              Principal:
+                AWS: !Sub arn:aws:iam::${AWS::AccountId}:root
+              Resource: !Sub execute-api:/*
+              Sid: AllowAccountAccessToAllEndpoints
+            - Action:
+                - execute-api:Invoke
+              Effect: Allow
+              Principal:
+                AWS: !FindInMap
+                  - ProxyApigw
+                  - !Ref Environment
+                  - perfTesterRoleArn
+              Resource: !Sub execute-api:/*
+              Sid: AllowPerfTesterRoleAccess
       DefinitionBody:
         Fn::Transform:
           Name: AWS::Include


Reviews:
user: login: sandymay-dd
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-01T10:47:18Z
user: login: kikidawson-gds
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-01T10:57:14Z
user: login: kikidawson-gds
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-01T11:06:39Z
user: login: sandymay-dd
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-05-01T11:14:08Z

Review comments:
diff_hunk: @@ -121,18 +121,23 @@ Mappings:
     dev:
       ApiBurstLimit: 10
       ApiRateLimit: 10
+      perfTesterRoleArn: arn:aws:iam::289507413710:role/perftest-PerformanceTesterRole
path: backend-api/infra/parent.yaml
user: login: sandymay-dd
body: are we ok to use their prod role here? It's very rare we run anything from their dev account. 

It's much more common to run tests from their prod account targeting our dev account, so it'd be easier to keep it that way round if possible.

i.e. have the same iam arn in our dev and build resource policy
created_at: 2025-05-01T10:47:18Z
author_association: CONTRIBUTOR
diff_hunk: @@ -121,18 +121,23 @@ Mappings:
     dev:
       ApiBurstLimit: 10
       ApiRateLimit: 10
+      perfTesterRoleArn: arn:aws:iam::289507413710:role/perftest-PerformanceTesterRole
path: backend-api/infra/parent.yaml
user: login: kikidawson-gds
body: I agree. The resource for the read ID mock allows their dev role for our dev proxy. Do you think it'll be confusing to have different set ups for each. Also happy to update the readid mock resource to use thier prod for both envs
created_at: 2025-05-01T10:56:29Z
author_association: CONTRIBUTOR
diff_hunk: @@ -121,18 +121,23 @@ Mappings:
     dev:
       ApiBurstLimit: 10
       ApiRateLimit: 10
+      perfTesterRoleArn: arn:aws:iam::289507413710:role/perftest-PerformanceTesterRole
path: backend-api/infra/parent.yaml
user: login: kikidawson-gds
body: done
created_at: 2025-05-01T11:06:39Z
author_association: CONTRIBUTOR

PR comments:
user: login: sonarqubecloud[bot]
created_at: 2025-05-01T11:09:20Z
body: ## [![Quality Gate Passed](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/checks/QualityGateBadge/qg-passed-20px.png 'Quality Gate Passed')](https://sonarcloud.io/dashboard?id=mobile-id-check-async&pullRequest=607) **Quality Gate passed**  
Issues  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 New issues](https://sonarcloud.io/project/issues?id=mobile-id-check-async&pullRequest=607&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/accepted-16px.png '') [0 Accepted issues](https://sonarcloud.io/project/issues?id=mobile-id-check-async&pullRequest=607&issueStatuses=ACCEPTED)

Measures  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0 Security Hotspots](https://sonarcloud.io/project/security_hotspots?id=mobile-id-check-async&pullRequest=607&issueStatuses=OPEN,CONFIRMED&sinceLeakPeriod=true)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Coverage on New Code](https://sonarcloud.io/component_measures?id=mobile-id-check-async&pullRequest=607&metric=new_coverage&view=list)  
![](https://sonarsource.github.io/sonarcloud-github-static-resources/v2/common/passed-16px.png '') [0.0% Duplication on New Code](https://sonarcloud.io/component_measures?id=mobile-id-check-async&pullRequest=607&metric=new_duplicated_lines_density&view=list)  
  
[See analysis details on SonarQube Cloud](https://sonarcloud.io/dashboard?id=mobile-id-check-async&pullRequest=607)


author_association: NONE