Context

This is part of a wider BigQuery Assurance piece to to harden the security around BigQuery.

It allows the use of OAuth mechanism for authentication to BigQuery rather than relying on plain text JSON API Keys.

Changes proposed in this pull request

Enable Azure workload identity federation within DfE Analytics.

Set GOOGLE_CLOUD_CREDENTIALS secret in the key vault for each environment.

Guidance to review

See Dfe Analytics GEM for further details.

This change involves the following steps

• Set GOOGLE_CLOUD_CREDENTIALS by downloading from GCP. This should be done for each environment.
• Enable WIF in the Azure Infrastructure
• Enable WIF in the App. We can remove references to the the JSON API Key at the same time
• Enable WIF in the Review App and test sending of data to BIgQuery. This can be disabled after testing
• Release to production

Link to Trello card

The Data Insights ticket is here.

Things to check

• If the code removes any existing feature flags, a data migration has also been added to delete the entry from the database
• This code does not rely on migrations in the same Pull Request
• If this code includes a migration adding or changing columns, it also backfills existing records for consistency
• If this code adds a column to the DB, decide whether it needs to be in analytics yml file or analytics blocklist
• API release notes have been updated if necessary
• If it adds a significant user-facing change, is it documented in the CHANGELOG?
• Required environment variables have been updated or added to the Azure KeyVault