APM-2348 Change how access token is set based on org

ansible/roles/create-api-deployment-pre-reqs/templates/terraform/iam.tf

@@ -245,16 +245,15 @@ data "aws_iam_policy_document" "deploy-user" {
   }
 
   statement {
-
     actions = [
       "ecs:TagResource",
       "ecs:UntagResource"
     ]
 
-    resources = [
-      local.ecs_cluster.arn
-    ]
-
+    resources = concat(
+      [local.ecs_cluster.arn],
+      [for ns in local.service_namespaces : "arn:aws:ecs:${local.region}:${local.account_id}:service/apis-${var.apigee_environment}/${ns}"]
+    )
   }
 
   statement {

azure/common/deploy-stage.yml

@@ -149,6 +149,7 @@ stages:
                       - ${{ each config_id in parameters.config_ids }}:
                           - ${{ config_id }}
                     aws_account: ${{ parameters.aws_account }}
+                    apigee_organization: ${{ parameters.apigee_organization }}
 
                 - ${{ if parameters.notify }}:
                   - bash: |

azure/components/get-access-token.yml

@@ -3,15 +3,31 @@ parameters:
     type: string
   - name: apigee_password
     type: string
+  - name: apigee_organization
+    type: string
+    default: nonprod
+  - name: _auth_server
+    type: object
+    default:
+      nonprod: login.apigee.com
+      prod: nhs-digital-prod.login.apigee.com
 
 steps:
   - bash: |
-      curl -X POST https://login.apigee.com/oauth/token \
+      set -euo pipefail
+      echo 'apigee_username: ${{ parameters.apigee_username }}'
+      echo 'apigee_organization: ${{ parameters.apigee_organization }}'
+      echo 'auth_url: ${{ parameters._auth_server[parameters.apigee_organization] }}'
+    displayName: 'Print access token debug info'
+
+  - bash: |
+      set -euo pipefail
+      curl -X POST https://${{ parameters._auth_server[parameters.apigee_organization] }}/oauth/token \
         -H "Content-Type: application/x-www-form-urlencoded" \
         -H "Accept: application/json;charset=utf-8" \
         -H "Authorization: Basic ZWRnZWNsaTplZGdlY2xpc2VjcmV0" \
         -d "username=${{ parameters.apigee_username }}&password=${{ parameters.apigee_password }}&mfa_token=$(secret.MFACode)&grant_type=password" | jq .access_token > .token
-      
+
       # Set token into variable
       echo "##vso[task.setvariable variable=secret.AccessToken;issecret=true]`cat .token`"
     displayName: 'Get Apigee Access Token'

azure/components/set-facts.yml

@@ -13,6 +13,8 @@ parameters:
   - name: aws_account
     type: string
     default: 'ptl'
+  - name: apigee_organization
+    type: string
 
 steps:
   - bash: |
@@ -57,3 +59,4 @@ steps:
     parameters:
       apigee_username: $(APIGEE_USERNAME)
       apigee_password: $(APIGEE_PASSWORD)
+      apigee_organization: ${{ parameters.apigee_organization }}