Skip to content

Commit 1b7030b

Browse files
JamesW1-NHSJamesW1-NHS
committed
for flat folder structure
1 parent 045e08f commit 1b7030b

File tree

3 files changed

+42
-98
lines changed

3 files changed

+42
-98
lines changed

‎id_sync/Dockerfile‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
FROM public.ecr.aws/lambda/python:3.11 AS base
2+
3+
# Create non-root user
4+
RUN mkdir -p /home/appuser && \
5+
echo 'appuser:x:1001:1001::/home/appuser:/sbin/nologin' >> /etc/passwd && \
6+
echo 'appuser:x:1001:' >> /etc/group && \
7+
chown -R 1001:1001 /home/appuser && pip install "poetry~=1.5.0"
8+
9+
# Install Poetry dependencies
10+
# Copy id_sync Poetry files
11+
COPY id_sync/poetry.lock id_sync/pyproject.toml id_sync/README.md ./
12+
# Copy shared/src/common to ./src/common
13+
COPY shared/src/common ./src/common
14+
15+
RUN echo "Listing /var/task after source code copy:" && ls -R /var/task
16+
17+
# Install id_sync dependencies
18+
WORKDIR /var/task
19+
RUN poetry config virtualenvs.create false && poetry install --no-interaction --no-ansi --no-root --only main
20+
21+
# -----------------------------
22+
FROM base AS build
23+
24+
# Set working directory back to Lambda task root
25+
WORKDIR /var/task
26+
27+
# Copy shared source code
28+
COPY shared/src/common ./common
29+
30+
# Copy id_sync source code
31+
COPY id_sync/src .
32+
33+
# Set correct permissions
34+
RUN chmod 644 $(find . -type f) && chmod 755 $(find . -type d)
35+
36+
# Build as non-root user
37+
USER 1001:1001
38+
39+
# Set the Lambda handler
40+
CMD ["id_sync.handler"]

‎terraform/id_sync_lambda.tf‎

Lines changed: 2 additions & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -1,75 +1,8 @@
11
# Define the directory containing the Docker image and calculate its SHA-256 hash for triggering redeployments
22
locals {
3-
lambdas_dir = abspath("${path.root}/../lambdas")
4-
shared_dir = "${local.lambdas_dir}/shared"
5-
id_sync_lambda_dir = "${local.lambdas_dir}/id_sync"
6-
id_sync_dockerfile = "${local.lambdas_dir}/id_sync.Dockerfile"
7-
8-
# Get files from both directories
9-
shared_files = fileset(local.shared_dir, "**")
3+
id_sync_lambda_dir = abspath("${path.root}/../id_sync")
104
id_sync_lambda_files = fileset(local.id_sync_lambda_dir, "**")
11-
12-
# Calculate SHA for both directories
13-
shared_dir_sha = sha1(join("", [for f in local.shared_files : filesha1("${local.shared_dir}/${f}")]))
145
id_sync_lambda_dir_sha = sha1(join("", [for f in local.id_sync_lambda_files : filesha1("${local.id_sync_lambda_dir}/${f}")]))
15-
16-
# Combined SHA to trigger rebuild when either directory changes
17-
combined_sha = sha1("${local.shared_dir_sha}${local.id_sync_lambda_dir_sha}")
18-
repo_root = abspath("${path.root}/..")
19-
is_azure_devops = can(regex("^/agent/_work", path.root))
20-
21-
debug_paths = {
22-
terraform_root = path.root
23-
repo_root = local.repo_root
24-
lambdas_dir = local.lambdas_dir
25-
dockerfile_path = local.id_sync_dockerfile
26-
is_azure = local.is_azure_devops
27-
}
28-
}
29-
30-
resource "null_resource" "find_dockerfile" {
31-
provisioner "local-exec" {
32-
command = <<-EOT
33-
echo "=== FINDING DOCKERFILE ==="
34-
35-
ls -la "${local.lambdas_dir}/" || echo "lambdas directory not found"
36-
ls -la .. || echo "parent directory not found"
37-
ls -la ${path.root}/.. || echo "grandparent directory not found"
38-
39-
EOT
40-
}
41-
}
42-
43-
resource "null_resource" "debug_directory_structure" {
44-
provisioner "local-exec" {
45-
command = <<-EOT
46-
echo "=== AZURE DEVOPS DIRECTORY DEBUG ==="
47-
echo "Current working directory: $(pwd)"
48-
echo "Terraform root: ${path.root}"
49-
echo ""
50-
echo "=== DIRECTORY CONTENTS ==="
51-
echo "Contents of current directory:"
52-
ls -la
53-
echo ""
54-
echo "Contents of parent directory:"
55-
ls -la ..
56-
echo ""
57-
echo "Contents of grandparent directory:"
58-
ls -la ../..
59-
echo ""
60-
echo "Looking for lambdas directory at various levels:"
61-
echo "Level 1 (../lambdas):"
62-
ls -la ../lambdas 2>/dev/null || echo "Not found at ../lambdas"
63-
echo "Level 2 (../../lambdas):"
64-
ls -la ../../lambdas 2>/dev/null || echo "Not found at ../../lambdas"
65-
echo "Level 3 (../../../lambdas):"
66-
ls -la ../../../lambdas 2>/dev/null || echo "Not found at ../../../lambdas"
67-
echo ""
68-
echo "Looking for Dockerfiles:"
69-
find .. -name "*.Dockerfile" -type f 2>/dev/null || echo "No Dockerfiles found"
70-
echo "=== END DEBUG ==="
71-
EOT
72-
}
736
}
747

758
resource "aws_ecr_repository" "id_sync_lambda_repository" {
@@ -79,35 +12,14 @@ resource "aws_ecr_repository" "id_sync_lambda_repository" {
7912
name = "${local.short_prefix}-id-sync-repo"
8013
force_delete = local.is_temp
8114
}
82-
resource "null_resource" "validate_dockerfile" {
83-
triggers = {
84-
dockerfile_path = "${local.lambdas_dir}/id_sync.Dockerfile"
85-
}
8615

87-
provisioner "local-exec" {
88-
command = <<-EOT
89-
echo "Checking for Dockerfile at: ${local.lambdas_dir}/id_sync.Dockerfile"
90-
if [ ! -f "${local.lambdas_dir}/id_sync.Dockerfile" ]; then
91-
echo "ERROR: Dockerfile not found!"
92-
echo "Current directory: $(pwd)"
93-
echo "Looking for: ${local.lambdas_dir}/id_sync.Dockerfile"
94-
echo "Files in lambdas directory:"
95-
ls -la "${local.lambdas_dir}/" || echo "lambdas directory not found"
96-
exit 1
97-
else
98-
echo "✅ Dockerfile found!"
99-
fi
100-
EOT
101-
}
102-
}
10316
# Module for building and pushing Docker image to ECR
10417
module "id_sync_docker_image" {
10518
source = "terraform-aws-modules/lambda/aws//modules/docker-build"
10619
version = "8.0.1"
10720

10821
create_ecr_repo = false
10922
ecr_repo = aws_ecr_repository.id_sync_lambda_repository.name
110-
docker_file_path = "id_sync.Dockerfile"
11123
ecr_repo_lifecycle_policy = jsonencode({
11224
"rules" : [
11325
{
@@ -127,7 +39,7 @@ module "id_sync_docker_image" {
12739

12840
platform = "linux/amd64"
12941
use_image_tag = false
130-
source_path = local.lambdas_dir
42+
source_path = local.id_sync_lambda_dir
13143
triggers = {
13244
dir_sha = local.id_sync_lambda_dir_sha
13345
}
@@ -256,8 +168,6 @@ resource "aws_iam_policy" "id_sync_lambda_exec_policy" {
256168
"arn:aws:lambda:${var.aws_region}:${var.immunisation_account_id}:function:imms-${var.sub_environment}-id_sync_lambda",
257169
]
258170
},
259-
# NEW
260-
# NB anomaly: do we want this in "id_sync_lambda_sqs_access_policy"?
261171
{
262172
Effect = "Allow",
263173
Action = [
@@ -267,7 +177,6 @@ resource "aws_iam_policy" "id_sync_lambda_exec_policy" {
267177
],
268178
Resource = "arn:aws:sqs:eu-west-2:${var.immunisation_account_id}:${local.short_prefix}-id-sync-queue"
269179
},
270-
# NB anomaly: in redis_sync this appears in "redis_sync_lambda_kms_access_policy"
271180
{
272181
Effect = "Allow",
273182
Action = [
@@ -364,7 +273,6 @@ resource "aws_lambda_function" "id_sync_lambda" {
364273
REDIS_HOST = data.aws_elasticache_cluster.existing_redis.cache_nodes[0].address
365274
REDIS_PORT = data.aws_elasticache_cluster.existing_redis.cache_nodes[0].port
366275
ID_SYNC_PROC_LAMBDA_NAME = "imms-${var.sub_environment}-id_sync_lambda"
367-
# NEW
368276
DELTA_TABLE_NAME = aws_dynamodb_table.delta-dynamodb-table.name
369277
IEDS_TABLE_NAME = aws_dynamodb_table.events-dynamodb-table.name
370278
PDS_ENV = var.pds_environment
@@ -384,9 +292,6 @@ resource "aws_cloudwatch_log_group" "id_sync_log_group" {
384292
retention_in_days = 30
385293
}
386294

387-
# delete config_lambda_notification / new_s3_invoke_permission - not required; duplicate
388-
389-
# NEW
390295
resource "aws_lambda_event_source_mapping" "id_sync_sqs_trigger" {
391296
event_source_arn = "arn:aws:sqs:eu-west-2:${var.immunisation_account_id}:${local.short_prefix}-id-sync-queue"
392297
function_name = aws_lambda_function.id_sync_lambda.arn # TODO

‎terraform/sqs_id_sync.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,6 @@
11
resource "aws_sqs_queue" "id_sync_queue" {
22
name = "${local.short_prefix}-id-sync-queue"
33
kms_master_key_id = data.aws_kms_key.existing_id_sync_sqs_encryption_key.arn
4-
# TODO: visibility_timeout_seconds must not be less than aws_lambda_function.id_sync_lambda_timeout
54
visibility_timeout_seconds = 360
65
redrive_policy = jsonencode({
76
deadLetterTargetArn = aws_sqs_queue.id_sync_dlq.arn

0 commit comments

Comments
 (0)