whyphi · jinyoungbang · Jan 24, 2024 · Oct 16, 2023 · Oct 16, 2023 · Oct 20, 2023
diff --git a/.chalice/policy-dev.json b/.chalice/policy-dev.json
@@ -5,15 +5,25 @@
 			"Sid": "GeneralPolicy",
 			"Effect": "Allow",
 			"Action": [
-				"dynamodb:BatchGetItem",
 				"s3:PutObject",
-				"dynamodb:PutItem",
-				"dynamodb:GetItem",
-				"dynamodb:Scan",
 				"dynamodb:Query",
+				"dynamodb:BatchGet*",
+				"dynamodb:DescribeStream",
+				"dynamodb:DescribeTable",
+				"dynamodb:Get*",
+				"dynamodb:Query",
+				"dynamodb:Scan",
+				"dynamodb:BatchWrite*",
+				"dynamodb:CreateTable",
+				"dynamodb:Delete*",
+				"dynamodb:Update*",
+				"dynamodb:PutItem",
 				"logs:CreateLogStream",
 				"logs:CreateLogGroup",
-				"logs:PutLogEvents"
+				"logs:PutLogEvents",
+				"ses:SendEmail",
+				"ses:SendRawEmail",
+				"ssm:GetParameter"
 			],
 			"Resource": [
 				"arn:aws:dynamodb:us-east-1::table/zap-applications-dev",
@@ -22,7 +32,10 @@
 				"arn:aws:dynamodb:us-east-1:280776660572:table/zap-listings-dev",
 				"arn:aws:dynamodb:us-east-1:280776660572:table/zap-applications-dev/index/listingId-index",
 				"arn:*:logs:*:*:*",
-				"arn:aws:s3:::whyphi-zap/dev/*"
+				"arn:aws:s3:::whyphi-zap/dev/*",
+				"arn:aws:ses:us-east-1:280776660572:identity/why-phi.com",
+				"arn:aws:ssm:us-east-1:280776660572:parameter/Zap/MONGO_ADMIN_USER",
+				"arn:aws:ssm:us-east-1:280776660572:parameter/Zap/MONGO_ADMIN_PASSWORD"
 			]
 		}
 	]

diff --git a/.chalice/policy-prod.json b/.chalice/policy-prod.json
@@ -5,15 +5,25 @@
 			"Sid": "GeneralPolicy",
 			"Effect": "Allow",
 			"Action": [
-				"dynamodb:BatchGetItem",
 				"s3:PutObject",
-				"dynamodb:PutItem",
-				"dynamodb:GetItem",
-				"dynamodb:Scan",
 				"dynamodb:Query",
+				"dynamodb:BatchGet*",
+				"dynamodb:DescribeStream",
+				"dynamodb:DescribeTable",
+				"dynamodb:Get*",
+				"dynamodb:Query",
+				"dynamodb:Scan",
+				"dynamodb:BatchWrite*",
+				"dynamodb:CreateTable",
+				"dynamodb:Delete*",
+				"dynamodb:Update*",
+				"dynamodb:PutItem",
 				"logs:CreateLogStream",
 				"logs:CreateLogGroup",
-				"logs:PutLogEvents"
+				"logs:PutLogEvents",
+				"ses:SendEmail",
+				"ses:SendRawEmail",
+				"ssm:GetParameter"
 			],
 			"Resource": [
 				"arn:aws:dynamodb:us-east-1::table/zap-applications-prod",
@@ -22,7 +32,10 @@
 				"arn:aws:dynamodb:us-east-1:280776660572:table/zap-listings-prod",
 				"arn:aws:dynamodb:us-east-1:280776660572:table/zap-applications-prod/index/listingId-index",
 				"arn:*:logs:*:*:*",
-				"arn:aws:s3:::whyphi-zap/prod/*"
+				"arn:aws:s3:::whyphi-zap/prod/*",
+				"arn:aws:ses:us-east-1:280776660572:identity/why-phi.com",
+				"arn:aws:ssm:us-east-1:280776660572:parameter/Zap/MONGO_ADMIN_USER",
+				"arn:aws:ssm:us-east-1:280776660572:parameter/Zap/MONGO_ADMIN_PASSWORD"
 			]
 		}
 	]

diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
@@ -10,6 +10,7 @@
 - [ ] Chore: technical debt, workflow improvements
 - [ ] Feature: New feature (non-breaking change which adds functionality)
 - [ ] Documentation: This change requires a documentation update
+- [ ] Merge: Pushing features to an upper envrironment
 
 ## Tests Performed
 

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -1,26 +1,38 @@
 name: Chalice Deployment
 
 on:
-  push
+  push:
+    branches:
+      - main
+      - staging
+      - dev
+
 
 jobs:
   deployment-prod:
     name: deploy-prod
     runs-on: ubuntu-latest
-    if: contains('
-        refs/heads/staging
-        refs/heads/main
-      ', github.ref)
+    # if: contains('
+    #     refs/heads/staging
+    #     refs/heads/main
+    #   ', github.ref)
+
+    if: (github.ref == 'refs/heads/main')
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-python@v4
+    - name: Checkout code
+      uses: actions/checkout@v3
+
+    - name: Setup Python
+      uses: actions/setup-python@v4
       with:
         python-version: '3.9'
         cache: 'pip' # caching pip dependencies
     - run: pip install pipenv
     - run: pipenv requirements > requirements.txt
     - run: pip install -r requirements.txt
-    - run: chalice deploy --stage prod
+
+    - name: Chalice deploy to prod
+      run: chalice deploy --stage prod
       env:
         AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
         AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
@@ -29,17 +41,24 @@ jobs:
   deployment-dev:
     name: deploy-dev
     runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/heads/dev')
+    # if: startsWith(github.ref, 'refs/heads/dev')
+    if: (github.ref == 'refs/heads/staging')
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-python@v4
+      - name: Checkout code
+        uses: actions/checkout@v3
+
+      - name: Setup Python
+        uses: actions/setup-python@v4
         with:
           python-version: '3.9'
           cache: 'pip' # caching pip dependencies
+
       - run: pip install pipenv
       - run: pipenv requirements > requirements.txt
       - run: pip install -r requirements.txt
-      - run: chalice deploy
+
+      - name: Chalice deploy to dev
+        run: chalice deploy
         env:
           AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
           AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}

diff --git a/Pipfile b/Pipfile
@@ -6,6 +6,8 @@ name = "pypi"
 [packages]
 chalice = "*"
 boto3 = "*"
+"pymongo[srv]" = "*"
+python-dotenv = "*"
 pydantic = "*"
 pytest = "*"
 coverage = "*"

diff --git a/Pipfile.lock b/Pipfile.lock