build(deps): bump pip from 22.2.2 to 22.3 (#2158)

Bumps [pip](https://github.com/pypa/pip) from 22.2.2 to 22.3.
- [Release notes](https://github.com/pypa/pip/releases)
- [Changelog](https://github.com/pypa/pip/blob/main/NEWS.rst)
- [Commits](pypa/pip@22.2.2...22.3)

---
updated-dependencies:
- dependency-name: pip
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

build(deps): bump botocore from 1.27.73 to 1.27.74 in /infrastructure…

…/constructs/lambda_layers/botocore (#2031)

Bumps [botocore](https://github.com/boto/botocore) from 1.27.73 to 1.27.74.
- [Release notes](https://github.com/boto/botocore/releases)
- [Changelog](https://github.com/boto/botocore/blob/develop/CHANGELOG.rst)
- [Commits](boto/botocore@1.27.73...1.27.74)

---
updated-dependencies:
- dependency-name: botocore
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

build(deps): bump aws-cdk from 2.39.1 to 2.41.0 (#2004)

* build(deps): bump aws-cdk from 2.39.1 to 2.41.0

Bumps [aws-cdk](https://github.com/aws/aws-cdk/tree/HEAD/packages/aws-cdk) from 2.39.1 to 2.41.0.
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.md)
- [Commits](https://github.com/aws/aws-cdk/commits/v2.41.0/packages/aws-cdk)

---
updated-dependencies:
- dependency-name: aws-cdk
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* build(deps): bump aws-cdk-aws-lambda-python-alpha

Bumps [aws-cdk-aws-lambda-python-alpha](https://github.com/aws/aws-cdk) from 2.24.0a0 to 2.39.1a0.
- [Release notes](https://github.com/aws/aws-cdk/releases)
- [Changelog](https://github.com/aws/aws-cdk/blob/main/CHANGELOG.v2.md)
- [Commits](https://github.com/aws/aws-cdk/commits)

---
updated-dependencies:
- dependency-name: aws-cdk-aws-lambda-python-alpha
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* fix: Update poetry aws-cdk.aws-lambda-python-alpha@^2.41.0-alpha.0

* fix: Regenerate lock file with newer Poetry

Fills in the package hashes properly.

* refactor: Unlock aws-cdk.aws-lambda-python-alpha version

* fix: Downgrade jsonschema

It won't build with old poetry2nix.

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Jim Gan <jgan@linz.govt.nz>
Co-authored-by: Victor Engmark <vengmark@linz.govt.nz>

feat: Switching to OIDC connect (#1822)

* feat: Change AccountPrincipal to WebIdentityPrincipal for oidc

The application_stack.py uses aws_iam account principal to deploy AWS resources. This change updates account principal to web identity principal, which connects via oidc. GitHub actions no longer relies non using AWS access keys for deployment.

* feat: Update GitHub workflow to use oidc

Oidc integration requires id-token write and contents read permissions to authenticate. Remove AWS access keys as they are no longer required for oidc. Update ci role-to-assume as a transitory measure (to avoid breaking existing workflow during testing). Prod and non-prod role-to-assume are left untouched. These role arns will be updated manually on GitHub secrets during switch over.

* feat: Assume role with web identity provider for boto3

Boto3 requires a web_identity_token_file paired with a role_arn to establish connection to AWS using oidc. AWS_WEB_IDENTITY_TOKEN_FILE is supported by AWS CLI

* fix: Include account root principal in main principal

Should allow S3 role assumption.

* fix: Remove role from secrets to help with debugging

Apply this change to CI, NON-PROD and PROD AWS accounts. Context: #1822 (comment)

* fix: Move static values to env

The following values AWS_ROLE_ARN, AWS_WEB_IDENTITY, and AWS_DEFAULT_REGION doesn't need to be made available to / within other processes. Moving them to env as to be a bit tidier. Context: #1822 (comment)

* fix: Remove role from secrets to help with debugging

* feat: Set oidc role arn in .env file

Centralise role arn in .env file that get parse as environment variable prior to configuring AWS credentials.

* refactor: Make token filename obvious, tidy up env file

* fix: Remove AssumeRoleWithWebIdentity

This part of the workflow isn't used anywhere. It was added in 54dd655 with the assumption that it is used for s3 role assumption. This turned out not to be the case and was fixed in afbc25d; however, this section of the workflow was left behind.

Co-authored-by: Victor Engmark <vengmark@linz.govt.nz>

fix: bump lambda timeout to 15 mins (#1825)

feat: delete assets no longer referenced (#1773)

* feat: delete s3 files not referenced in latest dataset version

* refactor: check Delete Marker in test & remove delete markers on cleanup

Co-authored-by: Victor Engmark <vengmark@linz.govt.nz>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>

fix: Typo (#1785)

Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>

build(deps): bump actions/setup-python from 3 to 4 (#1728)

Bumps [actions/setup-python](https://github.com/actions/setup-python) from 3 to 4.
- [Release notes](https://github.com/actions/setup-python/releases)
- [Commits](actions/setup-python@v3...v4)

---
updated-dependencies:
- dependency-name: actions/setup-python
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Mitchell Paff <77649372+MitchellPaff@users.noreply.github.com>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>

feat: validate partial datasets prep 4 (#1665)

In order to handle the cases where the file is used from the Geostore.

refactor: remove s3 users role in order to move in stack (#1646)