Add SSM-based feature flags

infra/modules/feature_flags/main.tf

@@ -0,0 +1,9 @@
+resource "aws_ssm_parameter" "feature_flags" {
+  # checkov:skip=CKV2_AWS_34:Feature flags values don't need to be encrypted
+  for_each = var.feature_flags
+
+  name        = "/service/${var.service_name}/${each.key}"
+  value       = each.value
+  type        = "String"
+  description = "Feature flag for ${each.key} in ${var.service_name}"
+}

infra/modules/feature_flags/outputs.tf

@@ -0,0 +1,4 @@
+output "ssm_parameter_arns" {
+  description = "Map of feature flag keys to their ARNs"
+  value       = { for key, param in aws_ssm_parameter.feature_flags : key => param.arn }
+}

infra/modules/feature_flags/variables.tf

@@ -0,0 +1,9 @@
+variable "feature_flags" {
+  type        = map(string)
+  description = "A map of feature flags"
+}
+
+variable "service_name" {
+  type        = string
+  description = "The name of the service that the feature flagging system will be associated with"
+}

infra/{{app_name}}/app-config/dev.tf

@@ -22,4 +22,8 @@ module "dev_config" {
   # See https://docs.aws.amazon.com/AmazonECS/latest/developerguide/ecs-exec.html
   # Defaults to `false`. Uncomment the next line to enable.
   # enable_command_execution = true
+
+  feature_flag_overrides = {
+    BAR = true
+  }
 }

infra/{{app_name}}/app-config/env-config/feature_flags.tf

@@ -0,0 +1,10 @@
+locals {
+  feature_flag_defaults = {
+    FOO = false
+    BAR = false
+  }
+  feature_flags_config = merge(
+    local.feature_flag_defaults,
+    var.feature_flag_overrides
+  )
+}

infra/{{app_name}}/app-config/env-config/outputs.tf

@@ -2,6 +2,10 @@ output "database_config" {
   value = local.database_config
 }
 
+output "feature_flags_config" {
+  value = local.feature_flags_config
+}
+
 output "scheduled_jobs" {
   value = local.scheduled_jobs
 }

infra/{{app_name}}/app-config/env-config/variables.tf

@@ -60,6 +60,16 @@ variable "extra_identity_provider_logout_urls" {
   default     = []
 }
 
+variable "feature_flag_overrides" {
+  type        = map(string)
+  description = "Map of overrides for feature flags"
+  default     = {}
+  validation {
+    condition     = length(setsubtract(keys(var.feature_flag_overrides), keys(local.feature_flag_defaults))) == 0
+    error_message = "All features in feature_flag_overrides must be declared in feature_flag_defaults."
+  }
+}
+
 variable "has_database" {
   type = bool
 }

infra/{{app_name}}/service/feature_flags.tf

@@ -0,0 +1,16 @@
+locals {
+  feature_flags_config = local.environment_config.feature_flags_config
+
+  feature_flags_secrets = [
+    for feature_flag in keys(local.feature_flags_config) : {
+      name      = "FF_${feature_flag}"
+      valueFrom = module.feature_flags.ssm_parameter_arns[feature_flag]
+    }
+  ]
+}
+
+module "feature_flags" {
+  source        = "../../modules/feature_flags"
+  service_name  = local.service_name
+  feature_flags = local.feature_flags_config
+}

infra/{{app_name}}/service/main.tf

@@ -105,6 +105,7 @@ module "service" {
       name      = secret_name
       valueFrom = module.secrets[secret_name].secret_arn
     }],
+    local.feature_flags_secrets,
     module.app_config.enable_identity_provider ? [{
       name      = "COGNITO_CLIENT_SECRET"
       valueFrom = module.identity_provider_client[0].client_secret_arn

template-only-app/app.py

@@ -8,6 +8,7 @@
 import notifications
 import storage
 from db import get_db_connection
+from feature_flags import is_feature_enabled
 
 logging.basicConfig()
 logger = logging.getLogger()
@@ -50,6 +51,13 @@ def migrations():
         return f"Last migration on {last_migration_date}"
 
 
+@app.route("/feature-flags")
+def feature_flags():
+    foo_status = "enabled" if is_feature_enabled("FOO") else "disabled"
+    bar_status = "enabled" if is_feature_enabled("BAR") else "disabled"
+    return f"<p>Feature FOO is {foo_status}</p><p>Feature BAR is {bar_status}</p>"
+
+
 @app.route("/document-upload")
 def document_upload():
     path = f"uploads/{datetime.now().date()}/${{filename}}"

template-only-app/feature_flags.py

@@ -0,0 +1,8 @@
+import logging
+import os
+import boto3
+logger = logging.getLogger()
+def is_feature_enabled(feature_name: str) -> bool:
+    value = os.environ.get(f"FF_{feature_name}")
+    return value == "true" if value else False
+

template-only-app/templates/index.html

@@ -11,6 +11,7 @@ <h1>Hello, world</h1>
         <li><a href="/migrations">Migrations</a></li>
         <li><a href="/document-upload">Document Upload</a></li>
         <li><a href="/email-notifications">Email Notifications</a></li>
+        <li><a href="/feature-flags">Feature flags</a></li>
         <li><a href="/secrets">Secrets</a></li>
       </ul>
     </main>