diff --git a/ansible/roles/nomis-misload/defaults/main.yml b/ansible/roles/nomis-misload/defaults/main.yml index fc44c29fc..81bcf6e59 100644 --- a/ansible/roles/nomis-misload/defaults/main.yml +++ b/ansible/roles/nomis-misload/defaults/main.yml @@ -11,12 +11,12 @@ misload_monitoring_cron: job: "su oracle -c '/home/oracle/admin/misload_scripts/{{ misload_monitoring_script }}' | logger -p local3.info -t misload" misload_dbname: "{{ ec2.tags['misload-dbname'] }}" -misload_secret_parameter: "/oracle/database/{{ misload_dbname }}/misload-config" +misload_secret_name: "/oracle/database/{{ misload_dbname }}/misload-config" use_ssm_params: false misload_secretsmanager_passwords: misload: - parameter: "{{ misload_secret_parameter }}" - secret: "{{ misload_secret_parameter }}" + parameter: "{{ misload_secret_name }}" + secret: "{{ misload_secret_name }}" users: - target: - username: diff --git a/ansible/roles/nomis-misload/tasks/main.yml b/ansible/roles/nomis-misload/tasks/main.yml index bf7a3ffa7..57f332837 100644 --- a/ansible/roles/nomis-misload/tasks/main.yml +++ b/ansible/roles/nomis-misload/tasks/main.yml @@ -1,5 +1,4 @@ --- -# needs testing # - name: Get secretsmanager passwords # block: # - name: secretsmanager passwords @@ -40,15 +39,6 @@ # when: use_ssm_params -- name: Get misload config - import_role: - name: ssm-passwords - vars: - ssm_passwords: "{{ misload_ssm_passwords }}" - tags: - - always - when: ec2.tags['misload-dbname'] is defined and ansible_facts['distribution'] == "RedHat" - # included to prevent having to debug connections in the actual task if the target is not reachable - import_tasks: "misload-connection-check.yml" tags: diff --git a/ansible/roles/nomis-misload/templates/connection_check.sh.j2 b/ansible/roles/nomis-misload/templates/connection_check.sh.j2 index 88298f7ed..98175bbd4 100644 --- a/ansible/roles/nomis-misload/templates/connection_check.sh.j2 +++ b/ansible/roles/nomis-misload/templates/connection_check.sh.j2 @@ -2,8 +2,9 @@ export PATH=$PATH:/usr/local/bin -target=$(aws ssm get-parameter --name "{{ misload_secret_parameter }}" --query Parameter.Value --with-decryption --output text | jq -r .target) -username=$(aws ssm get-parameter --name "{{ misload_secret_parameter }}" --query Parameter.Value --with-decryption --output text | jq -r .username) -password=$(aws ssm get-parameter --name "{{ misload_secret_parameter }}" --query Parameter.Value --with-decryption --output text | jq -r .password) +secret_data=$(aws secretsmanager get-secret-value --secret-id "{{ misload_secret_name }}" --query SecretString --output text) +target=$(echo $secret_data | jq -r .target) +username=$(echo $secret_data | jq -r .username) +password=$(echo $secret_data | jq -r .password) {{ ansible_python_interpreter }} /usr/local/share/winrm_connection_check.py -u "$username" -p "$password" -t "$target" diff --git a/ansible/roles/nomis-misload/templates/trigger_mis_load.sh.j2 b/ansible/roles/nomis-misload/templates/trigger_mis_load.sh.j2 index 603bde59e..d7a22a8cc 100644 --- a/ansible/roles/nomis-misload/templates/trigger_mis_load.sh.j2 +++ b/ansible/roles/nomis-misload/templates/trigger_mis_load.sh.j2 @@ -2,14 +2,16 @@ export PATH=$PATH:/usr/local/bin -target=$(aws ssm get-parameter --name "{{ misload_secret_parameter }}" --query Parameter.Value --with-decryption --output text | jq -r .target) -username=$(aws ssm get-parameter --name "{{ misload_secret_parameter }}" --query Parameter.Value --with-decryption --output text | jq -r .username) -password=$(aws ssm get-parameter --name "{{ misload_secret_parameter }}" --query Parameter.Value --with-decryption --output text | jq -r .password) +secret_data=$(aws secretsmanager get-secret-value --secret-id "{{ misload_secret_name }}" --query SecretString --output text) +target=$(echo $secret_data | jq -r .target) +username=$(echo $secret_data | jq -r .username) +password=$(echo $secret_data | jq -r .password) + if [[ -z $target || $target == "null" || $target == "None" || -z $username || $username == "null" || $username == "None" || -z $password || $password == "null" || $password == "None" ]]; then - echo "Could not retrieve config from {{ misload_secret_parameter }}" + echo "Could not retrieve config from {{ misload_secret_name }}" echo "misload_status 1" > /opt/textfile_monitoring/misload_status.prom exit 1 fi