Skip to content

Commit 50ebd3d

Browse files
mfjarvismfjarvis
committed
VED-355: Move mesh processor back to terraform folder as it depends on the batch sources bucket.
1 parent a603792 commit 50ebd3d

File tree

4 files changed

+76
-75
lines changed

4 files changed

+76
-75
lines changed

‎infra/environments/non-prod/variables.tfvars‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,8 @@ dspp_admin_role = "root"
77
environment = "dev"
88
parent_route53_zone_name = "dev.vds.platform.nhs.uk"
99
child_route53_zone_name = "imms.dev.vds.platform.nhs.uk"
10-
mesh_mailbox_id = null
11-
mesh_dlq_mailbox_id = null
10+
# TODO - null these out once we're using the int account
11+
# mesh_mailbox_id = null
12+
# mesh_dlq_mailbox_id = null
13+
mesh_mailbox_id = "X26OT303"
14+
mesh_dlq_mailbox_id = "X26OT304"

‎infra/mesh.tf‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
# MESH Client Module - conditionally created based on environment configuration
2+
module "mesh" {
3+
count = var.mesh_mailbox_id != null ? 1 : 0
4+
source = "git::https://github.com/nhsdigital/terraform-aws-mesh-client.git//module?ref=v2.1.5"
5+
6+
name_prefix = "imms-${var.environment}"
7+
account_id = var.imms_account_id
8+
mesh_env = var.environment == "prod"? "production" : "integration"
9+
subnet_ids = toset([])
10+
mailbox_ids = [var.mesh_mailbox_id]
11+
12+
compress_threshold = 1 * 1024 * 1024
13+
get_message_max_concurrency = 10
14+
handshake_schedule = "rate(24 hours)"
15+
}

infra/mesh_processor.tf renamed to terraform/mesh_processor.tf

Lines changed: 54 additions & 68 deletions
Original file line numberDiff line numberDiff line change
@@ -1,59 +1,39 @@
1-
# Only create MESH processor resources if MESH is configured for this environment
1+
# Define the directory containing the Docker image and calculate its SHA-256 hash for triggering redeployments
22
locals {
3-
create_mesh_processor = var.mesh_mailbox_id != null
4-
vpc_default = aws_vpc.default.id
5-
}
6-
7-
data "aws_subnets" "default" {
8-
filter {
9-
name = "vpc-id"
10-
values = [aws_vpc.default.id]
11-
}
3+
create_mesh_processor = local.environment == "int" || local.environment == "prod"
4+
mesh_processor_lambda_dir = abspath("${path.root}/../mesh_processor")
5+
mesh_processor_lambda_files = fileset(local.mesh_processor_lambda_dir, "**")
6+
mesh_processor_lambda_dir_sha = sha1(join("", [for f in local.mesh_processor_lambda_files : filesha1("${local.mesh_processor_lambda_dir}/${f}")]))
7+
# This should match the prefix used in the infra Terraform
8+
mesh_module_prefix = "imms-${local.config_env}"
129
}
1310

11+
data "aws_s3_bucket" "mesh" {
12+
count = local.create_mesh_processor ? 1 : 0
1413

15-
# MESH Client Module - conditionally created based on environment configuration
16-
module "mesh" {
17-
count = local.create_mesh_processor ? 1 : 0
18-
source = "git::https://github.com/nhsdigital/terraform-aws-mesh-client.git//module?ref=v2.1.5"
19-
20-
name_prefix = "imms-${var.environment}"
21-
mesh_env = var.environment == "prod"? "production" : "integration"
22-
subnet_ids = data.aws_subnets.default.ids
23-
24-
mailbox_ids = [var.mesh_mailbox_id]
25-
verify_ssl = "true"
26-
get_message_max_concurrency = 10
27-
compress_threshold = 1 * 1024 * 1024
28-
handshake_schedule = "rate(24 hours)"
29-
30-
account_id = var.imms_account_id
14+
bucket = "${local.mesh_module_prefix}-mesh"
3115
}
3216

33-
# Define the directory containing the Docker image and calculate its SHA-256 hash for triggering redeployments
34-
locals {
35-
mesh_processor_lambda_dir = abspath("${path.root}/../mesh_processor")
36-
mesh_processor_lambda_files = fileset(local.mesh_processor_lambda_dir, "**")
37-
mesh_processor_lambda_dir_sha = sha1(join("", [for f in local.mesh_processor_lambda_files : filesha1("${local.mesh_processor_lambda_dir}/${f}")]))
38-
mesh_s3_bucket_name = local.create_mesh_processor ? module.mesh[0].mesh_bucket_name : null
39-
mesh_s3_logs_bucket_name = local.create_mesh_processor ? module.mesh[0].mesh_logs_bucket_name : null
40-
mesh_processor_name = "imms-${var.environment}-mesh-processor"
41-
mesh_processor_lambda_name = "${local.mesh_processor_name}-lambda"
17+
data "aws_kms_key" "mesh" {
18+
count = local.create_mesh_processor ? 1 : 0
19+
20+
key_id = "alias/${local.mesh_module_prefix}-mesh"
4221
}
4322

4423
resource "aws_ecr_repository" "mesh_file_converter_lambda_repository" {
4524
count = local.create_mesh_processor ? 1 : 0
46-
25+
4726
image_scanning_configuration {
4827
scan_on_push = true
4928
}
50-
name = "${local.mesh_processor_name}-repo"
51-
force_delete = false
29+
name = "${local.short_prefix}-mesh_processor-repo"
30+
force_delete = local.is_temp
5231
}
5332

5433
# Module for building and pushing Docker image to ECR
5534
module "mesh_processor_docker_image" {
56-
count = local.create_mesh_processor ? 1 : 0
35+
count = local.create_mesh_processor ? 1 : 0
36+
5737
source = "terraform-aws-modules/lambda/aws//modules/docker-build"
5838
version = "8.0.1"
5939

@@ -86,7 +66,8 @@ module "mesh_processor_docker_image" {
8666

8767
# Define the lambdaECRImageRetreival policy
8868
resource "aws_ecr_repository_policy" "mesh_processor_lambda_ECRImageRetreival_policy" {
89-
count = local.create_mesh_processor ? 1 : 0
69+
count = local.create_mesh_processor ? 1 : 0
70+
9071
repository = aws_ecr_repository.mesh_file_converter_lambda_repository[0].name
9172

9273
policy = jsonencode({
@@ -107,7 +88,7 @@ resource "aws_ecr_repository_policy" "mesh_processor_lambda_ECRImageRetreival_po
10788
],
10889
"Condition" : {
10990
"StringLike" : {
110-
"aws:sourceArn" : "arn:aws:lambda:eu-west-2:${var.imms_account_id}:function:${local.mesh_processor_lambda_name}"
91+
"aws:sourceArn" : "arn:aws:lambda:eu-west-2:${local.immunisation_account_id}:function:${local.short_prefix}-mesh_processor_lambda"
11192
}
11293
}
11394
}
@@ -118,7 +99,8 @@ resource "aws_ecr_repository_policy" "mesh_processor_lambda_ECRImageRetreival_po
11899
# IAM Role for Lambda
119100
resource "aws_iam_role" "mesh_processor_lambda_exec_role" {
120101
count = local.create_mesh_processor ? 1 : 0
121-
name = "${local.mesh_processor_lambda_name}-exec-role"
102+
103+
name = "${local.short_prefix}-mesh_processor-lambda-exec-role"
122104
assume_role_policy = jsonencode({
123105
Version = "2012-10-17",
124106
Statement = [{
@@ -135,7 +117,8 @@ resource "aws_iam_role" "mesh_processor_lambda_exec_role" {
135117
# Policy for Lambda execution role
136118
resource "aws_iam_policy" "mesh_processor_lambda_exec_policy" {
137119
count = local.create_mesh_processor ? 1 : 0
138-
name = "${local.mesh_processor_lambda_name}-exec-policy"
120+
121+
name = "${local.short_prefix}-mesh_processor-lambda-exec-policy"
139122
policy = jsonencode({
140123
Version = "2012-10-17",
141124
Statement = [
@@ -146,7 +129,7 @@ resource "aws_iam_policy" "mesh_processor_lambda_exec_policy" {
146129
"logs:CreateLogStream",
147130
"logs:PutLogEvents"
148131
]
149-
Resource = "arn:aws:logs:${var.aws_region}:${var.imms_account_id}:log-group:/aws/lambda/${local.mesh_processor_lambda_name}:*"
132+
Resource = "arn:aws:logs:${var.aws_region}:${local.immunisation_account_id}:log-group:/aws/lambda/${local.short_prefix}-mesh_processor_lambda:*"
150133
},
151134
{
152135
Effect = "Allow"
@@ -157,8 +140,8 @@ resource "aws_iam_policy" "mesh_processor_lambda_exec_policy" {
157140
"s3:CopyObject"
158141
]
159142
Resource = [
160-
aws_s3_bucket.batch_data_source_bucket[0].arn,
161-
"${aws_s3_bucket.batch_data_source_bucket[0].arn}/*"
143+
aws_s3_bucket.batch_data_source_bucket.arn,
144+
"${aws_s3_bucket.batch_data_source_bucket.arn}/*"
162145
]
163146
},
164147
{
@@ -171,18 +154,18 @@ resource "aws_iam_policy" "mesh_processor_lambda_exec_policy" {
171154
"s3:DeleteObject"
172155
]
173156
Resource = [
174-
"arn:aws:s3:::${local.mesh_s3_bucket_name}",
175-
"arn:aws:s3:::${local.mesh_s3_bucket_name}/*",
176-
"arn:aws:s3:::${local.mesh_s3_logs_bucket_name}/*"
157+
data.aws_s3_bucket.mesh[0].arn,
158+
"${data.aws_s3_bucket.mesh[0].arn}/*"
177159
]
178160
}
179161
]
180162
})
181163
}
182164

183165
resource "aws_iam_policy" "mesh_processor_lambda_kms_access_policy" {
184-
count = local.create_mesh_processor ? 1 : 0
185-
name = "${aws_lambda_function.mesh_file_converter_lambda[0].function_name}-kms-policy"
166+
count = local.create_mesh_processor ? 1 : 0
167+
168+
name = "${local.short_prefix}-mesh_processor-lambda-kms-policy"
186169
description = "Allow Lambda to decrypt environment variables"
187170

188171
policy = jsonencode({
@@ -196,7 +179,7 @@ resource "aws_iam_policy" "mesh_processor_lambda_kms_access_policy" {
196179
"kms:GenerateDataKey*"
197180
]
198181
Resource = [
199-
data.aws_kms_key.mesh_s3_encryption_key.arn
182+
data.aws_kms_key.mesh[0].arn
200183
]
201184
}
202185
]
@@ -205,22 +188,26 @@ resource "aws_iam_policy" "mesh_processor_lambda_kms_access_policy" {
205188

206189
# Attach the execution policy to the Lambda role
207190
resource "aws_iam_role_policy_attachment" "mesh_processor_lambda_exec_policy_attachment" {
208-
count = local.create_mesh_processor ? 1 : 0
191+
count = local.create_mesh_processor ? 1 : 0
192+
209193
role = aws_iam_role.mesh_processor_lambda_exec_role[0].name
210194
policy_arn = aws_iam_policy.mesh_processor_lambda_exec_policy[0].arn
211195
}
212196

197+
213198
# Attach the kms policy to the Lambda role
214199
resource "aws_iam_role_policy_attachment" "mesh_processor_lambda_kms_policy_attachment" {
215-
count = local.create_mesh_processor ? 1 : 0
200+
count = local.create_mesh_processor ? 1 : 0
201+
216202
role = aws_iam_role.mesh_processor_lambda_exec_role[0].name
217203
policy_arn = aws_iam_policy.mesh_processor_lambda_kms_access_policy[0].arn
218204
}
219205

220206
# Lambda Function with Security Group and VPC.
221207
resource "aws_lambda_function" "mesh_file_converter_lambda" {
222-
count = local.create_mesh_processor ? 1 : 0
223-
function_name = "${local.mesh_processor_name}_lambda"
208+
count = local.create_mesh_processor ? 1 : 0
209+
210+
function_name = "${local.short_prefix}-mesh_processor_lambda"
224211
role = aws_iam_role.mesh_processor_lambda_exec_role[0].arn
225212
package_type = "Image"
226213
image_uri = module.mesh_processor_docker_image[0].image_uri
@@ -229,37 +216,36 @@ resource "aws_lambda_function" "mesh_file_converter_lambda" {
229216

230217
environment {
231218
variables = {
232-
Destination_BUCKET_NAME = aws_s3_bucket.batch_data_source_bucket[0].bucket
233-
MESH_FILE_PROC_LAMBDA_NAME = "${local.mesh_processor_lambda_name}"
219+
Destination_BUCKET_NAME = aws_s3_bucket.batch_data_source_bucket.bucket
234220
}
235221
}
236222
}
237223

238224
# Permission for S3 to invoke Lambda function
239225
resource "aws_lambda_permission" "mesh_s3_invoke_permission" {
240-
count = local.create_mesh_processor ? 1 : 0
226+
count = local.create_mesh_processor ? 1 : 0
227+
241228
statement_id = "AllowExecutionFromS3"
242229
action = "lambda:InvokeFunction"
243230
function_name = aws_lambda_function.mesh_file_converter_lambda[0].function_name
244231
principal = "s3.amazonaws.com"
245-
source_arn = "arn:aws:s3:::${local.mesh_s3_bucket_name}"
232+
source_arn = "arn:aws:s3:::local-immunisation-mesh"
246233
}
247234

248-
# S3 Bucket notification to trigger Lambda function
249235
resource "aws_s3_bucket_notification" "mesh_datasources_lambda_notification" {
250-
count = local.create_mesh_processor ? 1 : 0
251-
bucket = local.mesh_s3_bucket_name
236+
count = local.create_mesh_processor ? 1 : 0
237+
238+
bucket = data.aws_s3_bucket.mesh[0].bucket
252239

253240
lambda_function {
254241
lambda_function_arn = aws_lambda_function.mesh_file_converter_lambda[0].arn
255242
events = ["s3:ObjectCreated:*"]
256243
}
257-
258-
depends_on = [aws_lambda_permission.mesh_s3_invoke_permission]
259244
}
260245

261246
resource "aws_cloudwatch_log_group" "mesh_file_converter_log_group" {
262-
count = local.create_mesh_processor ? 1 : 0
263-
name = "/aws/lambda/${aws_lambda_function.mesh_file_converter_lambda[0].function_name}"
247+
count = local.create_mesh_processor ? 1 : 0
248+
249+
name = "/aws/lambda/${local.short_prefix}-mesh_processor_lambda"
264250
retention_in_days = 30
265-
}
251+
}

‎terraform/variables.tf‎

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,8 @@ locals {
2020
prefix = "${var.project_name}-${var.service}-${local.env}"
2121
short_prefix = "${var.project_short_name}-${local.env}"
2222
batch_prefix = "immunisation-batch-${local.env}"
23-
config_env = local.environment == "prod" ? "prod" : "dev"
23+
# TODO - add int when we switch to the new account
24+
config_env = local.environment == "prod" ? "prod" : "dev"
2425

2526
root_domain = "${local.config_env}.vds.platform.nhs.uk"
2627
project_domain_name = data.aws_route53_zone.project_zone.name
@@ -93,7 +94,3 @@ data "aws_kms_key" "existing_lambda_encryption_key" {
9394
data "aws_kms_key" "existing_kinesis_encryption_key" {
9495
key_id = "alias/imms-batch-kinesis-stream-encryption"
9596
}
96-
97-
data "aws_kms_key" "mesh_s3_encryption_key" {
98-
key_id = "alias/local-immunisation-mesh"
99-
}

0 commit comments

Comments
 (0)