[DTOSS-11293] - Create Production Environment & Enhance RBAC #586
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
josielsouzanordcloud
force-pushed
the
DTOSS-11293-create-prod-environment
branch
from
63365dc to
10ea648
Compare
saliceti
reviewed
Oct 22, 2025
saliceti
reviewed
Oct 22, 2025
saliceti
reviewed
Oct 22, 2025
saliceti
reviewed
Oct 22, 2025
josielsouzanordcloud
force-pushed
the
DTOSS-11293-create-prod-environment
branch
from
c0f3331 to
0db733e
Compare
mrlockstar
reviewed
Oct 22, 2025
josielsouzanordcloud
force-pushed
the
DTOSS-11293-create-prod-environment
branch
2 times, most recently
from
9bb560d to
27918a6
Compare
mrlockstar
reviewed
Oct 23, 2025
| variable "seed_demo_data" { | ||
| description = "Whether or not to seed the demo data in the database." | ||
| type = bool | ||
| default = false |
Contributor
There was a problem hiding this comment.
I thought we were not going to put defaults on child modules to make them more transferable?
Contributor
There was a problem hiding this comment.
Instead we put the defaults in
infrastructure/terraform/variables.tf
Take heed that all the other variables in this file ([infrastructure/modules/container-apps/variables.tf] do
not have defaults.
Contributor
Author
There was a problem hiding this comment.
Hi @mrlockstar , I've got a request from @saliceti to apply default values and remove from variables these values when appropriated, and I judged this to be one.
Happy to change if we all think it should be in the infrastructure/terraform/variables.tf
Contributor
There was a problem hiding this comment.
Yes we agreed to centralise default values at root module level
Contributor
Author
There was a problem hiding this comment.
Fixed as agreed.
josielsouzanordcloud
force-pushed
the
DTOSS-11293-create-prod-environment
branch
from
005bf70 to
9b38485
Compare
saliceti
reviewed
Oct 23, 2025
| storage_queues = ["notifications-message-status-updates", "notifications-message-batch-retries"] | ||
|
|
||
| always_allowed_paths = ["/sha"] | ||
| NO_OP_DATE = "0 0 31 2 *" |
… RBAC - Add production Terraform variables configuration - Enable secure Key Vault integration for secret management - Configure production DNS (manage-breast-screening.nhs.uk) - Enable geo-redundant PostgreSQL backups for data protection - Set up production API endpoints and Front Door profile - Disable demo data seeding for production environment - Enable alerting and monitoring for production workloads - Enhance resource group init with RBAC for Entra ID groups - Implement group-based permission model in Bicep templates - Enable use_apex_domain to the environment Breaking changes: None (new production environment) Security: Key Vault protection and RBAC groups enabled Add false positive rbac role GUID entries to .gitleaksignore rename variables and remove from variables.yml and variables.tfvars variables with default values the same as values set including '/healthcheck' as always_allowed_paths on Front Door removing default value with module and let in root removing unused variable NO_OP_DATE
josielsouzanordcloud
force-pushed
the
DTOSS-11293-create-prod-environment
branch
from
a41c547 to
8064b5c
Compare
mrlockstar
reviewed
Oct 23, 2025
saliceti
approved these changes
Oct 23, 2025
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
This PR introduces the production environment configuration for the NHS Digital breast screening management service, implementing secure infrastructure patterns and enhanced RBAC permissions for Entra ID groups using Azure Bicep templates.
Jira link
Changes Made
Production Environment Configuration
Enhanced Infrastructure Security
Security & Compliance Features
Following Azure best practices:
Infrastructure Highlights