Replace Cloud.gov infrastructure with AWS

.ds.baseline

@@ -227,7 +227,7 @@
         "filename": "notifications-admin/app/config.py",
         "hashed_secret": "577a4c667e4af8682ca431857214b3a920883efc",
         "is_verified": false,
-        "line_number": 127,
+        "line_number": 125,
         "is_secret": false
       }
     ],
@@ -931,5 +931,5 @@
       }
     ]
   },
-  "generated_at": "2026-03-11T19:25:54Z"
+  "generated_at": "2026-03-24T15:18:53Z"
 }

notifications-admin/app/aws_config.py

@@ -0,0 +1,16 @@
+from os import getenv
+
+
+class AwsConfig:
+    @property
+    def redis_url(self):
+        return getenv("REDIS_URL")
+
+    def s3_credentials(self, bucket_name):
+        return {
+            "bucket": getenv(f"{bucket_name}_BUCKET_NAME", bucket_name),
+            "region": getenv(f"{bucket_name}_AWS_REGION", "us-east-1"),
+        }
+
+
+cloud_config = AwsConfig()

notifications-admin/app/config.py

@@ -3,7 +3,7 @@
 
 import newrelic.agent
 
-from app.cloudfoundry_config import cloud_config
+from app.aws_config import cloud_config
 from notifications_utils import DAILY_MESSAGE_LIMIT
 
 
@@ -98,8 +98,6 @@ def _s3_credentials_from_env(bucket_prefix):
         "bucket": getenv(
             f"{bucket_prefix}_BUCKET_NAME", f"{bucket_prefix}-test-bucket-name"
         ),
-        "access_key_id": getenv(f"{bucket_prefix}_AWS_ACCESS_KEY_ID"),
-        "secret_access_key": getenv(f"{bucket_prefix}_AWS_SECRET_ACCESS_KEY"),
         "region": getenv(f"{bucket_prefix}_AWS_REGION"),
     }
 
@@ -151,12 +149,8 @@ class Production(Config):
     DEBUG = False
 
     # buckets
-    CSV_UPLOAD_BUCKET = cloud_config.s3_credentials(
-        f"notify-api-csv-upload-bucket-{getenv('NOTIFY_ENVIRONMENT')}"
-    )
-    LOGO_UPLOAD_BUCKET = cloud_config.s3_credentials(
-        f"notify-admin-logo-upload-bucket-{getenv('NOTIFY_ENVIRONMENT')}"
-    )
+    CSV_UPLOAD_BUCKET = _s3_credentials_from_env("CSV")
+    LOGO_UPLOAD_BUCKET = _s3_credentials_from_env("LOGO")
 
 
 class Staging(Production):
@@ -183,12 +177,8 @@ class E2ETest(Staging):
     WTF_CSRF_ENABLED = False
 
     # buckets - mirror staging
-    CSV_UPLOAD_BUCKET = cloud_config.s3_credentials(
-        "notify-api-csv-upload-bucket-staging"
-    )
-    LOGO_UPLOAD_BUCKET = cloud_config.s3_credentials(
-        "notify-admin-logo-upload-bucket-staging"
-    )
+    CSV_UPLOAD_BUCKET = _s3_credentials_from_env("CSV")
+    LOGO_UPLOAD_BUCKET = _s3_credentials_from_env("LOGO")
 
 
 class Demo(Staging):
@@ -201,7 +191,6 @@ class Sandbox(Staging):
 
 class Scanning(Production):
     HTTP_PROTOCOL = "http"
-    API_HOST_NAME = "https://notify-api-staging.app.cloud.gov/"
     SECRET_KEY = "dev-notify-secret-key"  # nosec B105 - only used in development
     ADMIN_CLIENT_USER_NAME = "notify-admin"
     ADMIN_CLIENT_SECRET = (

notifications-admin/app/main/views/activity.py

@@ -23,8 +23,6 @@ def get_report_info(service_id, report_name, s3_config):
         obj = get_s3_object(
             s3_config["bucket"],
             key,
-            s3_config["access_key_id"],
-            s3_config["secret_access_key"],
             s3_config["region"],
         )
 
@@ -56,10 +54,6 @@ def get_download_availability(service_id):
     # Get S3 config before spawning greenlets
     s3_config = {
         "bucket": current_app.config["CSV_UPLOAD_BUCKET"]["bucket"],
-        "access_key_id": current_app.config["CSV_UPLOAD_BUCKET"]["access_key_id"],
-        "secret_access_key": current_app.config["CSV_UPLOAD_BUCKET"][
-            "secret_access_key"
-        ],
         "region": current_app.config["CSV_UPLOAD_BUCKET"]["region"],
     }
 

notifications-admin/app/s3_client/__init__.py

@@ -8,27 +8,19 @@
 from notifications_utils.s3 import S3ObjectNotFound
 
 AWS_CLIENT_CONFIG = Config(
-    # This config is required to enable S3 to connect to FIPS-enabled
-    # endpoints.  See https://aws.amazon.com/compliance/fips/ for more
-    # information.
     s3={
         "addressing_style": "virtual",
     },
-    use_fips_endpoint=True,
 )
 
 
 def get_s3_object(
     bucket_name,
     filename,
-    access_key,
-    secret_key,
     region,
 ):
     # To inspect contents: obj.get()['Body'].read().decode('utf-8')
     session = Session(
-        aws_access_key_id=access_key,
-        aws_secret_access_key=secret_key,
         region_name=region,
     )
     s3 = session.resource(

notifications-admin/app/s3_client/s3_csv_client.py

@@ -20,13 +20,7 @@ def get_csv_location(service_id, upload_id):
     key = NEW_FILE_LOCATION_STRUCTURE.format(service_id, upload_id)
     region = current_app.config["CSV_UPLOAD_BUCKET"]["region"]
 
-    return (
-        bucket,
-        key,
-        current_app.config["CSV_UPLOAD_BUCKET"]["access_key_id"],
-        current_app.config["CSV_UPLOAD_BUCKET"]["secret_access_key"],
-        region,
-    )
+    return (bucket, key, region)
 
 
 def get_csv_upload(service_id, upload_id):
@@ -45,9 +39,7 @@ def s3upload(service_id, filedata):
 
     filedata = remove_blank_lines(filedata)
     upload_id = str(uuid.uuid4())
-    bucket_name, file_location, access_key, secret_key, region = get_csv_location(
-        service_id, upload_id
-    )
+    bucket_name, file_location, region = get_csv_location(service_id, upload_id)
     if bucket_name == "":
         exp_bucket = current_app.config["CSV_UPLOAD_BUCKET"]["bucket"]
         exp_region = current_app.config["CSV_UPLOAD_BUCKET"]["region"]
@@ -61,8 +53,6 @@ def s3upload(service_id, filedata):
         region=region,
         bucket_name=bucket_name,
         file_location=file_location,
-        access_key=access_key,
-        secret_key=secret_key,
     )
     return upload_id
 

notifications-admin/app/s3_client/s3_logo_client.py

@@ -14,8 +14,6 @@ def get_logo_location(filename=None):
     return (
         bucket_creds("bucket"),
         filename,
-        bucket_creds("access_key_id"),
-        bucket_creds("secret_access_key"),
         bucket_creds("region"),
     )
 
@@ -31,8 +29,8 @@ def delete_s3_object(filename):
 def persist_logo(old_name, new_name):
     if old_name == new_name:
         return
-    bucket_name, filename, access_key, secret_key, region = get_logo_location(new_name)
-    get_s3_object(bucket_name, filename, access_key, secret_key, region).copy_from(
+    bucket_name, filename, region = get_logo_location(new_name)
+    get_s3_object(bucket_name, filename, region).copy_from(
         CopySource="{}/{}".format(bucket_name, old_name)
     )
     delete_s3_object(old_name)
@@ -41,8 +39,6 @@ def persist_logo(old_name, new_name):
 def get_s3_objects_filter_by_prefix(prefix):
     bucket_name = bucket_creds("bucket")
     session = Session(
-        aws_access_key_id=bucket_creds("access_key_id"),
-        aws_secret_access_key=bucket_creds("secret_access_key"),
         region_name=bucket_creds("region"),
     )
     s3 = session.resource("s3")
@@ -67,8 +63,6 @@ def upload_email_logo(filename, filedata, user_id):
         bucket_name=bucket_name,
         file_location=upload_file_name,
         content_type="image/png",
-        access_key=bucket_creds("access_key_id"),
-        secret_key=bucket_creds("secret_access_key"),
     )
 
     return upload_file_name