Skip to content

Commit 0a9c89e

Browse files
robg-nhsrobg-nhs
authored
Merge branch 'main' into PRMP-1580
2 parents b475f18 + e8b0989 commit 0a9c89e

File tree

7 files changed

+148
-14
lines changed

7 files changed

+148
-14
lines changed

‎.github/workflows/sonarcloud-analysis.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ jobs:
1818
with:
1919
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
2020
- name: SonarQube Scan
21-
uses: SonarSource/sonarqube-scan-action@v4
21+
uses: SonarSource/sonarqube-scan-action@v5
2222
env:
2323
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # Needed to get PR information, if any
2424
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

‎infrastructure/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,10 @@
1414

1515
| Name | Source | Version |
1616
|------|--------|---------|
17+
| <a name="module_access-audit-alarm"></a> [access-audit-alarm](#module\_access-audit-alarm) | ./modules/lambda_alarms | n/a |
18+
| <a name="module_access-audit-alarm-topic"></a> [access-audit-alarm-topic](#module\_access-audit-alarm-topic) | ./modules/sns | n/a |
19+
| <a name="module_access-audit-gateway"></a> [access-audit-gateway](#module\_access-audit-gateway) | ./modules/gateway | n/a |
20+
| <a name="module_access-audit-lambda"></a> [access-audit-lambda](#module\_access-audit-lambda) | ./modules/lambda | n/a |
1721
| <a name="module_access_audit_dynamodb_table"></a> [access\_audit\_dynamodb\_table](#module\_access\_audit\_dynamodb\_table) | ./modules/dynamo_db | n/a |
1822
| <a name="module_api_endpoint_url_ssm_parameter"></a> [api\_endpoint\_url\_ssm\_parameter](#module\_api\_endpoint\_url\_ssm\_parameter) | ./modules/ssm_parameter | n/a |
1923
| <a name="module_auth_session_dynamodb_table"></a> [auth\_session\_dynamodb\_table](#module\_auth\_session\_dynamodb\_table) | ./modules/dynamo_db | n/a |
@@ -315,6 +319,7 @@
315319
| [aws_lambda_event_source_mapping.nems_message_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
316320
| [aws_lambda_event_source_mapping.nrl_pointer_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
317321
| [aws_lambda_event_source_mapping.pdf-stitching-lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
322+
| [aws_lambda_event_source_mapping.unstitched_lloyd_george_dynamodb_stream](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
318323
| [aws_lambda_permission.bulk_upload_metadata_schedule_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
319324
| [aws_lambda_permission.bulk_upload_report_schedule_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
320325
| [aws_lambda_permission.data_collection_schedule_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |

‎infrastructure/api.tf‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,9 @@ resource "aws_api_gateway_deployment" "ndr_api_deploy" {
7474
module.upload_confirm_result_gateway,
7575
module.upload_confirm_result_lambda,
7676
module.virus_scan_result_gateway,
77-
module.virus_scan_result_lambda
77+
module.virus_scan_result_lambda,
78+
module.access-audit-gateway,
79+
module.access-audit-lambda
7880
]))
7981
}
8082

‎infrastructure/lambda-access-audit.tf‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
module "access-audit-gateway" {
2+
# Gateway Variables
3+
source = "./modules/gateway"
4+
api_gateway_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
5+
parent_id = aws_api_gateway_rest_api.ndr_doc_store_api.root_resource_id
6+
http_methods = ["POST"]
7+
authorization = "CUSTOM"
8+
gateway_path = "AccessAudit"
9+
authorizer_id = aws_api_gateway_authorizer.repo_authoriser.id
10+
require_credentials = true
11+
origin = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
12+
13+
# Lambda Variables
14+
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
15+
owner = var.owner
16+
environment = var.environment
17+
18+
depends_on = [
19+
aws_api_gateway_rest_api.ndr_doc_store_api,
20+
]
21+
}
22+
23+
module "access-audit-alarm" {
24+
source = "./modules/lambda_alarms"
25+
lambda_function_name = module.access-audit-lambda.function_name
26+
lambda_timeout = module.access-audit-lambda.timeout
27+
lambda_name = "access_audit_handler"
28+
namespace = "AWS/Lambda"
29+
alarm_actions = [module.access-audit-alarm-topic.arn]
30+
ok_actions = [module.access-audit-alarm-topic.arn]
31+
depends_on = [module.access-audit-lambda, module.access-audit-alarm-topic]
32+
}
33+
34+
35+
module "access-audit-alarm-topic" {
36+
source = "./modules/sns"
37+
sns_encryption_key_id = module.sns_encryption_key.id
38+
current_account_id = data.aws_caller_identity.current.account_id
39+
topic_name = "access-audit-alarms-topic"
40+
topic_protocol = "lambda"
41+
topic_endpoint = module.access-audit-lambda.lambda_arn
42+
depends_on = [module.sns_encryption_key]
43+
delivery_policy = jsonencode({
44+
"Version" : "2012-10-17",
45+
"Statement" : [
46+
{
47+
"Effect" : "Allow",
48+
"Principal" : {
49+
"Service" : "cloudwatch.amazonaws.com"
50+
},
51+
"Action" : [
52+
"SNS:Publish",
53+
],
54+
"Condition" : {
55+
"ArnLike" : {
56+
"aws:SourceArn" : "arn:aws:cloudwatch:eu-west-2:${data.aws_caller_identity.current.account_id}:alarm:*"
57+
}
58+
}
59+
"Resource" : "*"
60+
}
61+
]
62+
})
63+
}
64+
65+
module "access-audit-lambda" {
66+
source = "./modules/lambda"
67+
name = "AccessAuditLambda"
68+
handler = "handlers.access_audit_handler.lambda_handler"
69+
iam_role_policy_documents = [
70+
module.ndr-app-config.app_config_policy,
71+
module.auth_session_dynamodb_table.dynamodb_write_policy_document,
72+
module.auth_session_dynamodb_table.dynamodb_read_policy_document,
73+
module.access_audit_dynamodb_table.dynamodb_write_policy_document
74+
]
75+
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
76+
resource_id = module.access-audit-gateway.gateway_resource_id
77+
http_methods = ["POST"]
78+
79+
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
80+
lambda_environment_variables = {
81+
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
82+
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
83+
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
84+
WORKSPACE = terraform.workspace
85+
AUTH_SESSION_TABLE_NAME = "${terraform.workspace}_${var.auth_session_dynamodb_table_name}"
86+
ACCESS_AUDIT_TABLE_NAME = "${terraform.workspace}_${var.access_audit_dynamodb_table_name}"
87+
}
88+
depends_on = [
89+
aws_api_gateway_rest_api.ndr_doc_store_api,
90+
module.access-audit-gateway,
91+
module.ndr-app-config,
92+
]
93+
}

‎infrastructure/lambda-delete-doc-object.tf‎

Lines changed: 33 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -77,7 +77,8 @@ resource "aws_iam_policy" "dynamodb_stream_delete_object_policy" {
7777
Effect = "Allow"
7878
Resource = [
7979
module.lloyd_george_reference_dynamodb_table.dynamodb_stream_arn,
80-
module.document_reference_dynamodb_table.dynamodb_stream_arn
80+
module.document_reference_dynamodb_table.dynamodb_stream_arn,
81+
module.unstitched_lloyd_george_reference_dynamodb_table.dynamodb_stream_arn
8182
]
8283
},
8384
]
@@ -95,7 +96,32 @@ resource "aws_lambda_event_source_mapping" "lloyd_george_dynamodb_stream" {
9596
pattern = jsonencode({
9697
"eventName" : [
9798
"REMOVE"
98-
]
99+
],
100+
userIdentity = {
101+
type = ["Service"],
102+
principalId = ["dynamodb.amazonaws.com"]
103+
}
104+
})
105+
}
106+
}
107+
}
108+
109+
resource "aws_lambda_event_source_mapping" "unstitched_lloyd_george_dynamodb_stream" {
110+
event_source_arn = module.unstitched_lloyd_george_reference_dynamodb_table.dynamodb_stream_arn
111+
function_name = module.delete-document-object-lambda.lambda_arn
112+
batch_size = 1
113+
starting_position = "LATEST"
114+
115+
filter_criteria {
116+
filter {
117+
pattern = jsonencode({
118+
"eventName" : [
119+
"REMOVE"
120+
],
121+
userIdentity = {
122+
type = ["Service"],
123+
principalId = ["dynamodb.amazonaws.com"]
124+
}
99125
})
100126
}
101127
}
@@ -112,7 +138,11 @@ resource "aws_lambda_event_source_mapping" "document_reference_dynamodb_stream"
112138
pattern = jsonencode({
113139
"eventName" : [
114140
"REMOVE"
115-
]
141+
],
142+
userIdentity = {
143+
type = ["Service"],
144+
principalId = ["dynamodb.amazonaws.com"]
145+
}
116146
})
117147
}
118148
}

‎infrastructure/lambda-delete-doc-ref.tf‎

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -78,21 +78,24 @@ module "delete-doc-ref-lambda" {
7878
module.stitch_metadata_reference_dynamodb_table.dynamodb_read_policy_document,
7979
module.stitch_metadata_reference_dynamodb_table.dynamodb_write_policy_document,
8080
module.sqs-nrl-queue.sqs_read_policy_document,
81-
module.sqs-nrl-queue.sqs_write_policy_document
81+
module.sqs-nrl-queue.sqs_write_policy_document,
82+
module.unstitched_lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
83+
module.unstitched_lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document
8284
]
8385
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
8486
resource_id = module.delete-doc-ref-gateway.gateway_resource_id
8587
http_methods = ["DELETE"]
8688
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
8789
lambda_environment_variables = {
88-
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
89-
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
90-
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
91-
DOCUMENT_STORE_DYNAMODB_NAME = "${terraform.workspace}_${var.docstore_dynamodb_table_name}"
92-
LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
93-
STITCH_METADATA_DYNAMODB_NAME = "${terraform.workspace}_${var.stitch_metadata_dynamodb_table_name}"
94-
WORKSPACE = terraform.workspace
95-
NRL_SQS_QUEUE_URL = module.sqs-nrl-queue.sqs_url
90+
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
91+
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
92+
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
93+
DOCUMENT_STORE_DYNAMODB_NAME = "${terraform.workspace}_${var.docstore_dynamodb_table_name}"
94+
LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
95+
STITCH_METADATA_DYNAMODB_NAME = "${terraform.workspace}_${var.stitch_metadata_dynamodb_table_name}"
96+
UNSTITCHED_LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.unstitched_lloyd_george_dynamodb_table_name}"
97+
WORKSPACE = terraform.workspace
98+
NRL_SQS_QUEUE_URL = module.sqs-nrl-queue.sqs_url
9699
}
97100
depends_on = [
98101
aws_api_gateway_rest_api.ndr_doc_store_api,

‎infrastructure/lambda-pdf-stitching.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ module "pdf-stitching-lambda" {
2020
api_execution_arn = null
2121
is_invoked_from_gateway = false
2222
lambda_environment_variables = {
23+
APIM_API_URL = data.aws_ssm_parameter.apim_url.value
2324
PDF_STITCHING_SQS_URL = module.sqs-stitching-queue.sqs_url
2425
NRL_SQS_URL = module.sqs-nrl-queue.sqs_url
2526
LLOYD_GEORGE_BUCKET_NAME = "${terraform.workspace}-${var.lloyd_george_bucket_name}"

0 commit comments

Comments
 (0)