Skip to content

Commit 52ff144

Browse files
axelkrastek1-nhsaxelkrastek1-nhs
committed
NRL-846 Use the auth store policy for lambdas
1 parent c77609e commit 52ff144

File tree

7 files changed

+39
-53
lines changed

7 files changed

+39
-53
lines changed

‎terraform/account-wide-infrastructure/dev/vars.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,6 @@ variable "dev_api_domain_name" {
1010
}
1111

1212
variable "devsandbox_api_domain_name" {
13-
description = "The internal DNS name of the API Gateway for the dev environment"
13+
description = "The internal DNS name of the API Gateway for the dev sandbox environment"
1414
default = "dev-sandbox.api.record-locator.dev.national.nhs.uk"
1515
}

‎terraform/account-wide-infrastructure/modules/permissions-store-bucket/iam.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,8 @@ resource "aws_iam_policy" "read-s3-authorization-store" {
1111
]
1212
Effect = "Allow"
1313
Resource = [
14-
aws_s3_bucket.authorization-store.arn
14+
aws_s3_bucket.authorization-store.arn,
15+
"${aws_s3_bucket.authorization-store.arn}/*",
1516
]
1617
},
1718
]

‎terraform/infrastructure/data.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,11 @@ data "aws_s3_bucket" "authorization-store" {
1010
bucket = "${local.shared_prefix}-authorization-store"
1111
}
1212

13+
data "aws_iam_policy" "auth-store-read-policy" {
14+
count = var.use_shared_resources ? 1 : 0
15+
name = "${local.shared_prefix}-read-s3-authorization-store"
16+
}
17+
1318
data "aws_dynamodb_table" "pointers-table" {
1419
count = var.use_shared_resources ? 1 : 0
1520
name = "${local.shared_prefix}-pointers-table"

‎terraform/infrastructure/lambda.tf‎

Lines changed: 26 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -17,7 +17,8 @@ module "consumer__readDocumentReference" {
1717
}
1818
additional_policies = [
1919
local.pointers_table_read_policy_arn,
20-
local.pointers_kms_read_write_arn
20+
local.pointers_kms_read_write_arn,
21+
local.auth_store_read_policy_arn
2122
]
2223
firehose_subscriptions = [
2324
module.firehose__processor.firehose_subscription
@@ -44,7 +45,8 @@ module "consumer__countDocumentReference" {
4445
}
4546
additional_policies = [
4647
local.pointers_table_read_policy_arn,
47-
local.pointers_kms_read_write_arn
48+
local.pointers_kms_read_write_arn,
49+
local.auth_store_read_policy_arn
4850
]
4951
firehose_subscriptions = [
5052
module.firehose__processor.firehose_subscription
@@ -71,7 +73,8 @@ module "consumer__searchDocumentReference" {
7173
}
7274
additional_policies = [
7375
local.pointers_table_read_policy_arn,
74-
local.pointers_kms_read_write_arn
76+
local.pointers_kms_read_write_arn,
77+
local.auth_store_read_policy_arn
7578
]
7679
firehose_subscriptions = [
7780
module.firehose__processor.firehose_subscription
@@ -98,7 +101,8 @@ module "consumer__searchPostDocumentReference" {
98101
}
99102
additional_policies = [
100103
local.pointers_table_read_policy_arn,
101-
local.pointers_kms_read_write_arn
104+
local.pointers_kms_read_write_arn,
105+
local.auth_store_read_policy_arn
102106
]
103107
firehose_subscriptions = [
104108
module.firehose__processor.firehose_subscription
@@ -126,7 +130,8 @@ module "producer__createDocumentReference" {
126130
additional_policies = [
127131
local.pointers_table_write_policy_arn,
128132
local.pointers_table_read_policy_arn,
129-
local.pointers_kms_read_write_arn
133+
local.pointers_kms_read_write_arn,
134+
local.auth_store_read_policy_arn
130135
]
131136
firehose_subscriptions = [
132137
module.firehose__processor.firehose_subscription
@@ -154,7 +159,8 @@ module "producer__deleteDocumentReference" {
154159
additional_policies = [
155160
local.pointers_table_write_policy_arn,
156161
local.pointers_table_read_policy_arn,
157-
local.pointers_kms_read_write_arn
162+
local.pointers_kms_read_write_arn,
163+
local.auth_store_read_policy_arn
158164
]
159165
firehose_subscriptions = [
160166
module.firehose__processor.firehose_subscription
@@ -181,7 +187,8 @@ module "producer__readDocumentReference" {
181187
}
182188
additional_policies = [
183189
local.pointers_table_read_policy_arn,
184-
local.pointers_kms_read_write_arn
190+
local.pointers_kms_read_write_arn,
191+
local.auth_store_read_policy_arn
185192
]
186193
firehose_subscriptions = [
187194
module.firehose__processor.firehose_subscription
@@ -208,7 +215,8 @@ module "producer__searchDocumentReference" {
208215
}
209216
additional_policies = [
210217
local.pointers_table_read_policy_arn,
211-
local.pointers_kms_read_write_arn
218+
local.pointers_kms_read_write_arn,
219+
local.auth_store_read_policy_arn
212220
]
213221
firehose_subscriptions = [
214222
module.firehose__processor.firehose_subscription
@@ -235,7 +243,8 @@ module "producer__searchPostDocumentReference" {
235243
}
236244
additional_policies = [
237245
local.pointers_table_read_policy_arn,
238-
local.pointers_kms_read_write_arn
246+
local.pointers_kms_read_write_arn,
247+
local.auth_store_read_policy_arn
239248
]
240249
firehose_subscriptions = [
241250
module.firehose__processor.firehose_subscription
@@ -263,7 +272,8 @@ module "producer__updateDocumentReference" {
263272
additional_policies = [
264273
local.pointers_table_read_policy_arn,
265274
local.pointers_table_write_policy_arn,
266-
local.pointers_kms_read_write_arn
275+
local.pointers_kms_read_write_arn,
276+
local.auth_store_read_policy_arn
267277
]
268278
firehose_subscriptions = [
269279
module.firehose__processor.firehose_subscription
@@ -291,7 +301,8 @@ module "producer__upsertDocumentReference" {
291301
additional_policies = [
292302
local.pointers_table_write_policy_arn,
293303
local.pointers_table_read_policy_arn,
294-
local.pointers_kms_read_write_arn
304+
local.pointers_kms_read_write_arn,
305+
local.auth_store_read_policy_arn
295306
]
296307
firehose_subscriptions = [
297308
module.firehose__processor.firehose_subscription
@@ -319,7 +330,8 @@ module "consumer__status" {
319330
}
320331
additional_policies = [
321332
local.pointers_table_read_policy_arn,
322-
local.pointers_kms_read_write_arn
333+
local.pointers_kms_read_write_arn,
334+
local.auth_store_read_policy_arn
323335
]
324336
firehose_subscriptions = [
325337
module.firehose__processor.firehose_subscription
@@ -348,7 +360,8 @@ module "producer__status" {
348360
}
349361
additional_policies = [
350362
local.pointers_table_read_policy_arn,
351-
local.pointers_kms_read_write_arn
363+
local.pointers_kms_read_write_arn,
364+
local.auth_store_read_policy_arn
352365
]
353366
firehose_subscriptions = [
354367
module.firehose__processor.firehose_subscription

‎terraform/infrastructure/locals.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,9 @@ locals {
3535

3636
aws_account_id = data.aws_caller_identity.current.account_id
3737

38-
auth_store_id = var.use_shared_resources ? data.aws_s3_bucket.authorization-store[0].id : module.ephemeral-s3-permission-store[0].bucket_id
39-
auth_store_arn = var.use_shared_resources ? data.aws_s3_bucket.authorization-store[0].arn : module.ephemeral-s3-permission-store[0].bucket_arn
38+
auth_store_id = var.use_shared_resources ? data.aws_s3_bucket.authorization-store[0].id : module.ephemeral-s3-permission-store[0].bucket_id
39+
auth_store_arn = var.use_shared_resources ? data.aws_s3_bucket.authorization-store[0].arn : module.ephemeral-s3-permission-store[0].bucket_arn
40+
auth_store_read_policy_arn = var.use_shared_resources ? data.aws_iam_policy.auth-store-read-policy[0].arn : module.ephemeral-s3-permission-store[0].bucket_read_policy_arn
4041

4142
pointers_table_name = var.use_shared_resources ? data.aws_dynamodb_table.pointers-table[0].name : module.ephemeral-pointers-table[0].table_name
4243
pointers_table_read_policy_arn = var.use_shared_resources ? data.aws_iam_policy.pointers-table-read[0].arn : module.ephemeral-pointers-table[0].read_policy_arn

‎terraform/infrastructure/modules/permissions-store-bucket/iam.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,8 @@ resource "aws_iam_policy" "read-s3-authorization-store" {
1111
]
1212
Effect = "Allow"
1313
Resource = [
14-
aws_s3_bucket.authorization-store.arn
14+
aws_s3_bucket.authorization-store.arn,
15+
"${aws_s3_bucket.authorization-store.arn}/*",
1516
]
1617
},
1718
]

‎terraform/infrastructure/s3.tf‎

Lines changed: 0 additions & 35 deletions
This file was deleted.

0 commit comments

Comments
 (0)