Shanice/upgrade terraform

[shanice-skylight]

DEVOPS PULL REQUEST

Related Issue

• Upgrade terraform from 1.3.3 to 1.9.5 Upgrade Terraform to the latest version #8104

Changes Proposed

• Update Terraform to the latest.

Additional Information

• I tested these upgrades locally and didn't run into any issues with the upgrade or state migration.
• I plan to merge this off hour

Testing

• Deployed the changes to the following environments [dev1, dev4, dev2, dev3 ] and completed smoke testing

• The following workflows have been tested on the environments mentioned above:

    - creating a new org
    - creating a new facility
    - adding a patient
    - bulk uploading patients
    - submitting a single entry test
    - submitting a bulk csv result upload
    - self registering a patient
  

[shanice-skylight]

Currently smoke testing dev2

[rin-skylight]

Unfortunately, if we want to push a full upgrade, there is still additional work to do. 1.9.6 was released yesterday.

[rin-skylight]

Heads up, applicable to all files: TF is now on version 1.9.6.

[shanice-skylight]

Changes made to 1.9.6

[rin-skylight]

Heads up, applicable to all files: setup-terraform is now on version 3.1.2.

[shanice-skylight]

Changes made to 3.1.2

[emyl3]

To clarify... are we removing this because it is deprecated? 🤔

And are we not replacing it with azurerm_storage_management_policy as suggested because it is being deprecated in v4? See also (https://learn.microsoft.com/en-us/azure/azure-monitor/essentials/migrate-to-azure-storage-lifecycle-policy?tabs=portal)

With this being removed, is there any way to configure this or are we relying on some defaults somewhere? 👀

[rin-skylight]

This is a good callout. We can't change retention policies for logs without threatening our ATO. Definitely need to make sure we're accounting for it somewhere.

[shanice-skylight]

Due to this PR only upgrading terraform and setup-terraform and not the azure provider, we're fine because we're still using hashicorp/azurerm 3.100.0. In the PR I'll push out after this one, I'll address all of the deprecated attributes. The attributes that come up as not supported would affect this PR

In the ticket for the azurerm provider upgrade, I added your comment in the details so I'll make sure its included and verify it stays within the requirements of the ATO. Thank you both for bringing this to my attention, good catch.

[rin-skylight]

I'm not so sure that logic makes sense. If you change the code here, you will change the retention policy, regardless of whether you are just intending to upgrade provider versions.

Take a look at your most recent deploy: https://github.com/CDCgov/prime-simplereport/actions/runs/10953277197/job/30413331322#step:3:1

The terraform apply phase shows multiple places where we can see retention adjustments. There are also places where OMHS-placed tags are getting blown away. I don't think these changes can be propagated up to Prod in their current state.

Can we figure out what's going on here before we proceed further?

[shanice-skylight]

I misunderstood, and agree with waiting to push this forward. The resource @emyl3 referenced has to be added and figure out why the OMHS-placed tags are being removed during terraform apply.

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud