upload artifacts to s3 for reuse

Author: Karthikeyannhs

.github/workflows/cicd-3-test-deploy.yaml

@@ -103,6 +103,19 @@ jobs:
           make terraform env=$ENVIRONMENT stack=api-layer tf-command=apply workspace=$WORKSPACE
         working-directory: ./infrastructure
 
+      - name: "Extract S3 bucket name from Terraform output"
+        id: tf_output
+        run: |
+          BUCKET=$(terraform output -raw lambda_artifact_bucket)
+          echo "bucket_name=$BUCKET" >> $GITHUB_OUTPUT
+        working-directory: ./infrastructure/stacks/api-layer
+
+      - name: "Upload lambda artifact to S3"
+        run: |
+          aws s3 cp ./build/lambda.zip \
+            s3://${{ steps.tf_output.outputs.bucket_name }}/artifacts/${{ needs.metadata.outputs.version }}/lambda.zip \
+            --region eu-west-2
+
   regression-tests:
     name: "Regression Tests"
     needs: deploy

infrastructure/stacks/api-layer/s3_buckets.tf

@@ -25,3 +25,16 @@ module "s3_firehose_backup_bucket" {
   stack_name   = local.stack_name
   workspace    = terraform.workspace
 }
+
+module "s3_lambda_artifact_bucket" {
+  source       = "../../modules/s3"
+  bucket_name  = "eli-artifacts"
+  environment  = var.environment
+  project_name = var.project_name
+  stack_name   = local.stack_name
+  workspace    = terraform.workspace
+}
+
+output "lambda_artifact_bucket" {
+  value = module.s3_lambda_artifact_bucket.storage_bucket_name
+}

infrastructure/stacks/iams-developer-roles/github_actions_policies.tf

@@ -195,7 +195,11 @@ resource "aws_iam_policy" "s3_management" {
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-splunk",
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-splunk/*",
           "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-splunk-access-logs",
-          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-splunk-access-logs/*"
+          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-splunk-access-logs/*",
+          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-artifacts",
+          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-artifacts/*",
+          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-artifacts-access-logs",
+          "arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-artifacts-access-logs/*",
         ]
       }
     ]