feat(deletion): revoke fxa tokens when deleting accounts

[kschelonka]

This data was deleted before on the Pocket side,
but now it will remove Pocket from integrations
so it no longer shows up on the Mozilla account page.

POCKET-9990

[github-actions]

Plan Result (account-data-deleter-cdk-production)

CI link

⚠️ Resource Deletion will happen ⚠️

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 1 to add, 0 to change, 1 to destroy.

• Replace
  • aws_ecs_task_definition.data-deleter-app_application_ecs_service_ecs-task_243DED07

Change Result (Click me)

  # aws_ecs_task_definition.data-deleter-app_application_ecs_service_ecs-task_243DED07 must be replaced
-/+ resource "aws_ecs_task_definition" "data-deleter-app_application_ecs_service_ecs-task_243DED07" {
      ~ arn                      = "arn:aws:ecs:us-east-1:996905175585:task-definition/AccountDataDeleter-Prod:842" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-east-1:996905175585:task-definition/AccountDataDeleter-Prod" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [
              ~ {
                    name                   = "app"
                  ~ secrets                = [
                        # (7 unchanged elements hidden)
                        {
                            name      = "EXPORT_SIGNEDURL_USER_SECRET_KEY"
                            valueFrom = "arn:aws:secretsmanager:us-east-1:996905175585:secret:AccountDataDeleter/Prod/EXPORT_USER_CREDS:secretAccessKey::"
                        },
                      + {
                          + name      = "FXA_CLIENT_ID"
                          + valueFrom = "arn:aws:ssm:us-east-1:996905175585:parameter/Web/Prod/FIREFOX_WEB_AUTH_CLIENT_ID"
                        },
                      + {
                          + name      = "FXA_CLIENT_SECRET"
                          + valueFrom = "arn:aws:ssm:us-east-1:996905175585:parameter/Web/Prod/FIREFOX_WEB_AUTH_CLIENT_SECRET"
                        },
                      + {
                          + name      = "FXA_OAUTH_URL"
                          + valueFrom = "arn:aws:ssm:us-east-1:996905175585:parameter/Web/Prod/FIREFOX_AUTH_OAUTH_URL"
                        },
                        {
                            name      = "SENTRY_DSN"
                            valueFrom = "arn:aws:ssm:us-east-1:996905175585:parameter/AccountDataDeleter/Prod/SENTRY_DSN"
                        },
                        # (3 unchanged elements hidden)
                    ]
                    # (10 unchanged attributes hidden)
                },
            ] # forces replacement
        )
      ~ id                       = "AccountDataDeleter-Prod" -> (known after apply)
      ~ revision                 = 842 -> (known after apply)
        tags                     = {
            "app_code"       = "pocket"
            "component_code" = "pocket-accountdatadeleter"
            "costCenter"     = "Pocket"
            "env_code"       = "prod"
            "environment"    = "Prod"
            "owner"          = "Pocket"
            "service"        = "AccountDataDeleter"
        }
        # (12 unchanged attributes hidden)
    }

Plan: 1 to add, 0 to change, 1 to destroy.

Changes to Outputs:
  ~ ecs-task-arn                                                                              = "arn:aws:ecs:us-east-1:996905175585:task-definition/AccountDataDeleter-Prod:842" -> (known after apply)

[github-actions]

Plan Result (@infrastructure/account-data-deleter-production)

CI link

⚠️ Resource Deletion will happen ⚠️

This plan contains resource delete operation. Please check the plan result very carefully!

Plan: 1 to add, 0 to change, 1 to destroy.

• Replace
  • aws_ecs_task_definition.data-deleter-app_application_ecs_service_ecs-task_243DED07

Change Result (Click me)

  # aws_ecs_task_definition.data-deleter-app_application_ecs_service_ecs-task_243DED07 must be replaced
-/+ resource "aws_ecs_task_definition" "data-deleter-app_application_ecs_service_ecs-task_243DED07" {
      ~ arn                      = "arn:aws:ecs:us-east-1:996905175585:task-definition/AccountDataDeleter-Prod:842" -> (known after apply)
      ~ arn_without_revision     = "arn:aws:ecs:us-east-1:996905175585:task-definition/AccountDataDeleter-Prod" -> (known after apply)
      ~ container_definitions    = jsonencode(
          ~ [
              ~ {
                    name                   = "app"
                  ~ secrets                = [
                        # (7 unchanged elements hidden)
                        {
                            name      = "EXPORT_SIGNEDURL_USER_SECRET_KEY"
                            valueFrom = "arn:aws:secretsmanager:us-east-1:996905175585:secret:AccountDataDeleter/Prod/EXPORT_USER_CREDS:secretAccessKey::"
                        },
                      + {
                          + name      = "FXA_CLIENT_ID"
                          + valueFrom = "arn:aws:ssm:us-east-1:996905175585:parameter/Web/Prod/FIREFOX_WEB_AUTH_CLIENT_ID"
                        },
                      + {
                          + name      = "FXA_CLIENT_SECRET"
                          + valueFrom = "arn:aws:ssm:us-east-1:996905175585:parameter/Web/Prod/FIREFOX_WEB_AUTH_CLIENT_SECRET"
                        },
                      + {
                          + name      = "FXA_OAUTH_URL"
                          + valueFrom = "arn:aws:ssm:us-east-1:996905175585:parameter/Web/Prod/FIREFOX_AUTH_OAUTH_URL"
                        },
                        {
                            name      = "SENTRY_DSN"
                            valueFrom = "arn:aws:ssm:us-east-1:996905175585:parameter/AccountDataDeleter/Prod/SENTRY_DSN"
                        },
                        # (3 unchanged elements hidden)
                    ]
                    # (10 unchanged attributes hidden)
                },
            ] # forces replacement
        )
      ~ id                       = "AccountDataDeleter-Prod" -> (known after apply)
      ~ revision                 = 842 -> (known after apply)
        tags                     = {
            "app_code"       = "pocket"
            "component_code" = "pocket-accountdatadeleter"
            "costCenter"     = "Pocket"
            "env_code"       = "prod"
            "environment"    = "Prod"
            "owner"          = "Pocket"
            "service"        = "AccountDataDeleter"
        }
        # (12 unchanged attributes hidden)
    }

Plan: 1 to add, 0 to change, 1 to destroy.

Changes to Outputs:
  ~ ecs-task-arn                                                                              = "arn:aws:ecs:us-east-1:996905175585:task-definition/AccountDataDeleter-Prod:842" -> (known after apply)

⚠️ Errors

• add a label @infrastructure/account-data-deleter-production/destroy: POST https://api.github.com/repos/Pocket/pocket-monorepo/issues/897/labels: 422 Validation Failed [{Resource:Label Field:name Code:invalid Message:}]