Terra Billing Profile Manager

Terra Billing Profile Manager provides an API to set up and control access to billing within Terra across cloud platforms.

Building the code

If you are a new member of the Broad, follow the getting started guide first.

Ensure you have Java 17 and that it is the default. To check this while in the terra-billing-profile-manager directory, type java --version.

Then, to build the code, run:

./gradlew build

Troubleshooting:

• If you run into an error about minney-kinney, execute:

./minnie-kenny.sh --force   

• The build also runs the tests, so the tests will fail unless postgres is running (see next step).

Running the tests

For tests, ensure you have a local Postgres instance running. While in the terra-billing-profile-manager directory, initialize the database:

./service/local-dev/run_postgres.sh start

After the database is initialized, run unit tests:

./gradlew test

To set up service account credentials and other configuration for running locally:

• Install yq brew install yq
• Run render_configs.sh

To run integration tests:

./gradlew bootRun &    # start up a local instance of the billing profile manager service
sleep 5                # wait until service comes up
./gradlew :integration:runTest --args="suites/FullIntegration.json /tmp/test"

To run smoke tests

See smoke_tests/README.md

Running Billing Profile Manager Locally

./gradlew :service:bootRun

Then navigate to the Swagger: http://localhost:8080/swagger-ui.html

Linter

Automatically fix linting issues:

./gradlew spotlessApply

Generate Java classes from Swagger documentation (.yml file definition)

./gradlew generateSwaggerCode

SourceClear

SourceClear is a static analysis tool that scans a project's Java dependencies for known vulnerabilities. If you are working on addressing dependency vulnerabilities in response to a SourceClear finding, you may want to run a scan off of a feature branch and/or local code.

Github Action

You can trigger BPM's SCA scan on demand via its Github Action, and optionally specify a Github ref (branch, tag, or SHA) to check out from the repo to scan. By default, the scan is run off of BPM's main branch.

High-level results are outputted in the Github Actions run.

Running Locally

You will need to get the API token from Vault before running the Gradle srcclr task.

export SRCCLR_API_TOKEN=$(vault read -field=api_token secret/secops/ci/srcclr/gradle-agent)
./gradlew srcclr

High-level results are outputted to the terminal.

Veracode

Full results including dependency graphs are uploaded to Veracode (if running off of a feature branch, navigate to Project Details > Selected Branch > Change to select your feature branch). You can request a Veracode account to view full results from #dsp-infosec-champions.

Tech Stack

BPM adheres to the Terra Tech Stack. See linked document for relevant technology choices and the rationale behind their inclusion in this service.