chore: GCForms release v3.29.0

[sre-read-write]

🤖 I have created a release beep boop

3.29.0 (2025-02-13)

Features

• Add cross acount policy for ECR in Staging only (#943) (f026963)
• add S3 replicate rule to Platform data lake (#944) (a0b34ef)
• ecr policy to allow cross acoutn sharing (#948) (b7a810b)
• replicate prod data to the Platform data lake (#950) (b4d0d95)

Bug Fixes

• add missing quotes in ecr policy (#947) (5e56fec)

Miscellaneous Chores

• Add submissionId to handler (#952) (9a8074a)
• revert failing ecr policy (#949) (734f2b6)
• temporarily disable data replication to data lake (#951) (58c666e)
• Use explicit accounts ids as org id does not work (#954) (fd29a08)

---

This PR was generated with Release Please. See documentation.

[github-actions]

Production: glue

✅   Terraform Init: success
✅   Terraform Validate: success
✅   Terraform Format: success
✅   Terraform Plan: success
✅   Conftest: success

Plan: 4 to add, 0 to change, 0 to destroy

Show summary

CHANGE	NAME
add	aws_iam_policy.forms_s3_replicate
	aws_iam_role.forms_s3_replicate
	aws_iam_role_policy_attachment.forms_s3_replicate
	aws_s3_bucket_replication_configuration.forms_s3_replicate_to_platform_data_lake

Show plan

Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # aws_iam_policy.forms_s3_replicate will be created
  + resource "aws_iam_policy" "forms_s3_replicate" {
      + arn              = (known after apply)
      + attachment_count = (known after apply)
      + id               = (known after apply)
      + name             = "FormsS3ReplicatePlatformDataLake"
      + name_prefix      = (known after apply)
      + path             = "/"
      + policy           = jsonencode(
            {
              + Statement = [
                  + {
                      + Action   = [
                          + "s3:ListBucket",
                          + "s3:GetReplicationConfiguration",
                        ]
                      + Effect   = "Allow"
                      + Resource = "arn:aws:s3:::cds-forms-data-lake-bucket-production"
                    },
                  + {
                      + Action   = [
                          + "s3:GetObjectVersionAcl",
                          + "s3:GetObjectVersion",
                        ]
                      + Effect   = "Allow"
                      + Resource = "arn:aws:s3:::cds-forms-data-lake-bucket-production/*"
                    },
                  + {
                      + Action   = [
                          + "s3:ReplicateObject",
                          + "s3:ReplicateDelete",
                          + "s3:ObjectOwnerOverrideToBucketOwner",
                        ]
                      + Effect   = "Allow"
                      + Resource = "arn:aws:s3:::cds-data-lake-raw-production/*"
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + policy_id        = (known after apply)
      + tags_all         = {
          + "CostCentre" = "forms-platform-production"
          + "Terraform"  = "true"
        }
    }

  # aws_iam_role.forms_s3_replicate will be created
  + resource "aws_iam_role" "forms_s3_replicate" {
      + arn                   = (known after apply)
      + assume_role_policy    = jsonencode(
            {
              + Statement = [
                  + {
                      + Action    = "sts:AssumeRole"
                      + Effect    = "Allow"
                      + Principal = {
                          + Service = "s3.amazonaws.com"
                        }
                    },
                ]
              + Version   = "2012-10-17"
            }
        )
      + create_date           = (known after apply)
      + force_detach_policies = false
      + id                    = (known after apply)
      + managed_policy_arns   = (known after apply)
      + max_session_duration  = 3600
      + name                  = "FormsS3ReplicatePlatformDataLake"
      + name_prefix           = (known after apply)
      + path                  = "/"
      + tags_all              = {
          + "CostCentre" = "forms-platform-production"
          + "Terraform"  = "true"
        }
      + unique_id             = (known after apply)

      + inline_policy (known after apply)
    }

  # aws_iam_role_policy_attachment.forms_s3_replicate will be created
  + resource "aws_iam_role_policy_attachment" "forms_s3_replicate" {
      + id         = (known after apply)
      + policy_arn = (known after apply)
      + role       = "FormsS3ReplicatePlatformDataLake"
    }

  # aws_s3_bucket_replication_configuration.forms_s3_replicate_to_platform_data_lake will be created
  + resource "aws_s3_bucket_replication_configuration" "forms_s3_replicate_to_platform_data_lake" {
      + bucket = "cds-forms-data-lake-bucket-production"
      + id     = (known after apply)
      + role   = (known after apply)

      + rule {
          + id     = "send-to-platform-data-lake"
          + status = "Disabled"

          + destination {
              + bucket = "arn:aws:s3:::cds-data-lake-raw-production"
            }
        }
    }

Plan: 4 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: plan.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "plan.tfplan"

Show Conftest results

WARN - plan.json - main - Missing Common Tags: ["aws_cloudwatch_log_group.glue_log_group"]
WARN - plan.json - main - Missing Common Tags: ["aws_glue_catalog_database.rds_db_catalog"]
WARN - plan.json - main - Missing Common Tags: ["aws_glue_connection.forms_database"]
WARN - plan.json - main - Missing Common Tags: ["aws_glue_crawler.forms_historical_data"]
WARN - plan.json - main - Missing Common Tags: ["aws_glue_crawler.forms_rds_data"]
WARN - plan.json - main - Missing Common Tags: ["aws_glue_job.historical_glue_job"]
WARN - plan.json - main - Missing Common Tags: ["aws_glue_job.rds_glue_job"]
WARN - plan.json - main - Missing Common Tags: ["aws_glue_trigger.rds_glue_trigger"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.forms_s3_replicate"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.glue_crawler"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_policy.glue_etl"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.forms_s3_replicate"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.glue_crawler"]
WARN - plan.json - main - Missing Common Tags: ["aws_iam_role.glue_etl"]
WARN - plan.json - main - Missing Common Tags: ["aws_kms_key.aws_glue"]
WARN - plan.json - main - Missing Common Tags: ["aws_s3_object.glue_script"]
WARN - plan.json - main - Missing Common Tags: ["aws_s3_object.historical_csv"]
WARN - plan.json - main - Missing Common Tags: ["aws_s3_object.historical_glue_script"]

37 tests, 19 passed, 18 warnings, 0 failures, 0 exceptions