Migrate OWASP Nest to Zappa for serverless deployment (#2431)

* Install zappa and initial example configuration

* add temporary IaC code for testing

* Update code

* Remove IAM and let Zappa manage it

* add README

* add RDS proxy, pre-commit hooks, clean-up code

* feat: add ecs tasks

* refactor/clean cache module

* refactor/clean database module

* refactor/clean ecs module

* refactor/clean networking module

* address Sonar Qube bot suggestions

* keep some Sonar Qube bot suggestions but add #NOSONAR

* add terraform dictionary

* refactor/clean security module

* fix pre-commit hooks and add terraform_validate

* add SHA hash and remove terraform_validate

* refactor/clean storage module

* Update docs

* add S3 support for load-data task

* Update README and necessary examples

* coderabbit suggestions

* Update code: install awscli before invoking aws in task

* update README

* NOSONAR

* update README

* fix spell check

* Update README

* fix: typo

* remove immutable tagged images

* fix: load-data task fail due to no permissions

* fix spell check: add PYTHONPATH

* add AWS CLI

* add set -e

* Update code

---------

Co-authored-by: Arkadii Yakovets <arkadii.yakovets@owasp.org>

Author: rudransh-shrivastava

.github/workflows/run-ci-cd.yaml

@@ -52,6 +52,11 @@ jobs:
           restore-keys: |
             pre-commit-${{ runner.os }}-
 
+      - name: Setup TFLint
+        uses: terraform-linters/setup-tflint@dfcb455ed8d56b55edf6447a37379108181a6707
+        with:
+          tflint_version: v0.59.1
+
       - name: Run pre-commit
         uses: pre-commit/action@2c7b3805fd2a0fd8c1884dcaebf91fc102a13ecd
 

.gitignore

@@ -31,11 +31,19 @@ __pycache__
 *.log
 *.pdf
 *.pem
+*.tfstate
+*.tfstate.*
+**/.terraform/
 backend-sbom-local.cdx.json
+backend/*nest-backend-dev*.tar.gz
+backend/*nest-backend-dev*.zip
+backend/*nest-backend-staging*.tar.gz
+backend/*nest-backend-staging*.zip
 backend/data/backup*
 backend/fuzzing_results/
 backend/generated_videos/
 backend/staticfiles
+backend/zappa_settings.json
 design/
 frontend-sbom-local.cdx.json
 frontend/.next
@@ -50,7 +58,7 @@ frontend/pnpm-debug.log*
 frontend/test-results/
 frontend/yarn-debug.log*
 frontend/yarn-error.log*
-infrastructure/
+infrastructure/terraform.tfvars
 logs
 node_modules/
 semgrep-security-report.txt

.pre-commit-config.yaml

@@ -44,6 +44,14 @@ repos:
         language_version: python3
         pass_filenames: true
 
+  - repo: https://github.com/antonbabenko/pre-commit-terraform
+    rev: v1.104.0
+    hooks:
+      - id: terraform_fmt
+        files: ^infrastructure/.*\.tf$
+      - id: terraform_tflint
+        files: ^infrastructure/.*\.tf$
+
   - repo: https://github.com/astral-sh/ruff-pre-commit
     rev: v0.15.2
     hooks:

backend/poetry.lock

@@ -47,6 +47,7 @@ dependencies.strawberry-graphql = { extras = [ "django" ], version = "^0.291.0"
 dependencies.strawberry-graphql-django = "^0.75.0"
 dependencies.thefuzz = "^0.22.1"
 dependencies.pyparsing = "^3.2.3"
+dependencies.zappa = "^0.60.2"
 group.fuzz.dependencies.schemathesis = "^4.10.2"
 group.test.dependencies.pytest = "^9.0.1"
 group.test.dependencies.pytest-cov = "^7.0"