Skip to content

Commit 31d3472

Browse files
oliverbeumkes-nhsoliverbeumkes-nhs
authored
Merge branch 'main' into PRM-539
2 parents af80df1 + c7ee43b commit 31d3472

14 files changed

+172
-5
lines changed

‎infrastructure/kms_pdm.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
module "pdm_encryption_key" {
2+
source = "./modules/kms"
3+
kms_key_name = "alias/pdm-encryption-key-kms-${terraform.workspace}"
4+
kms_key_description = "Custom KMS Key to enable server side encryption for PDM resources"
5+
environment = var.environment
6+
owner = var.owner
7+
service_identifiers = ["ssm.amazonaws.com"]
8+
kms_deletion_window = var.kms_deletion_window
9+
}

‎infrastructure/lambda-document-upload-check.tf‎

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -6,19 +6,24 @@ module "document_upload_check_lambda" {
66
module.ndr-bulk-staging-store.s3_read_policy_document,
77
module.ndr-bulk-staging-store.s3_write_policy_document,
88
module.ndr-lloyd-george-store.s3_write_policy_document,
9+
module.pdm-document-store.s3_write_policy_document,
910
aws_iam_policy.ssm_access_policy.policy,
1011
module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
1112
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
13+
module.pdm_dynamodb_table.dynamodb_read_policy_document,
14+
module.pdm_dynamodb_table.dynamodb_write_policy_document,
1215
data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy
1316
]
1417
kms_deletion_window = var.kms_deletion_window
1518
rest_api_id = null
1619
http_methods = null
1720
api_execution_arn = null
1821
lambda_environment_variables = {
19-
LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
20-
STAGING_STORE_BUCKET_NAME = "${terraform.workspace}-${var.staging_store_bucket_name}"
21-
LLOYD_GEORGE_BUCKET_NAME = "${terraform.workspace}-${var.lloyd_george_bucket_name}"
22+
LLOYD_GEORGE_DYNAMODB_NAME = module.lloyd_george_reference_dynamodb_table.table_name
23+
PDM_DYNAMODB_NAME = module.pdm_dynamodb_table.table_name
24+
STAGING_STORE_BUCKET_NAME = module.ndr-bulk-staging-store.bucket_id
25+
LLOYD_GEORGE_BUCKET_NAME = module.ndr-lloyd-george-store.bucket_id
26+
PDM_BUCKET_NAME = module.pdm-document-store.bucket_id
2227
WORKSPACE = terraform.workspace
2328
VIRUS_SCAN_STUB = !local.is_production
2429

@@ -48,7 +53,8 @@ data "aws_security_groups" "virus_scanner_api" {
4853
}
4954

5055
resource "aws_s3_bucket_notification" "document_upload_check_lambda_trigger" {
51-
bucket = module.ndr-bulk-staging-store.bucket_id
56+
bucket = module.ndr-bulk-staging-store.bucket_id
57+
eventbridge = true
5258
lambda_function {
5359
lambda_function_arn = module.document_upload_check_lambda.lambda_arn
5460
events = ["s3:ObjectCreated:*"]

‎infrastructure/lambda-get-document-fhir.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,8 +40,10 @@ module "get-doc-fhir-lambda" {
4040
iam_role_policy_documents = [
4141
module.ndr-app-config.app_config_policy,
4242
module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
43+
module.pdm_dynamodb_table.dynamodb_read_policy_document,
4344
aws_iam_policy.ssm_access_policy.policy,
4445
module.ndr-lloyd-george-store.s3_read_policy_document,
46+
module.pdm-document-store.s3_read_policy_document,
4547
]
4648
kms_deletion_window = var.kms_deletion_window
4749
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id

‎infrastructure/lambda-post-document-fhir.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ module "post-document-references-fhir-lambda" {
55
iam_role_policy_documents = [
66
module.document_reference_dynamodb_table.dynamodb_write_policy_document,
77
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
8+
module.pdm_dynamodb_table.dynamodb_write_policy_document,
89
module.ndr-bulk-staging-store.s3_write_policy_document,
910
module.ndr-app-config.app_config_policy,
1011
aws_iam_policy.ssm_access_policy.policy

‎infrastructure/lambda-search-document-references-fhir.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ module "search-document-references-fhir-lambda" {
77
module.document_reference_dynamodb_table.dynamodb_write_policy_document,
88
module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
99
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
10+
module.pdm_dynamodb_table.dynamodb_read_policy_document,
11+
module.pdm_dynamodb_table.dynamodb_write_policy_document,
1012
module.ndr-lloyd-george-store.s3_read_policy_document,
1113
module.ndr-document-store.s3_read_policy_document,
1214
module.ndr-app-config.app_config_policy

‎infrastructure/modules/ssm_parameter/main.tf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,34 @@
11
resource "aws_ssm_parameter" "secret" {
2+
count = var.ignore_value_changes ? 0 : 1
23
name = "/ndr/${terraform.workspace}/${var.name}"
34
type = var.type
45
description = var.description
56
value = var.value
7+
key_id = var.key_id
68
depends_on = [var.resource_depends_on]
79
tags = {
810
Name = "${terraform.workspace}-ssm"
911
}
12+
13+
}
14+
15+
16+
resource "aws_ssm_parameter" "secret_ignore_value_changes" {
17+
count = var.ignore_value_changes ? 1 : 0
18+
name = "/ndr/${terraform.workspace}/${var.name}"
19+
type = var.type
20+
description = var.description
21+
value = var.value
22+
key_id = var.key_id
23+
depends_on = [var.resource_depends_on]
24+
tags = {
25+
Name = "${terraform.workspace}-ssm"
26+
}
27+
28+
lifecycle {
29+
ignore_changes = [
30+
value,
31+
]
32+
}
1033
}
1134

‎infrastructure/modules/ssm_parameter/variable.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,3 +37,15 @@ variable "owner" {
3737
description = "Owner tag used to identify the team or individual responsible for the resource."
3838
type = string
3939
}
40+
41+
variable "key_id" {
42+
type = string
43+
default = null
44+
description = "KMS Key ID or ARN to encrypt the SecureString parameter"
45+
}
46+
47+
variable "ignore_value_changes" {
48+
type = bool
49+
default = false
50+
description = "Whether to ignore changes to the value field"
51+
}

‎infrastructure/policies.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ resource "aws_iam_policy" "read_only_role_extra_permissions" {
3030
"kms:Decrypt",
3131
],
3232
Resource = [
33-
"arn:aws:lambda:eu-west-2:${data.aws_caller_identity.current.account_id}:function:*",
33+
"arn:aws:kms:eu-west-2:${data.aws_caller_identity.current.account_id}:key/*",
3434
]
3535
}
3636
]

‎infrastructure/ssm_parameters_externally_signed_mtls.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Creating Params to hold a copy of externally signed client cert and key
2+
module "ssm_param_external_client_cert" {
3+
count = local.is_sandbox ? 0 : 1
4+
source = "./modules/ssm_parameter"
5+
environment = var.environment
6+
owner = var.owner
7+
name = "external_client_cert"
8+
type = "SecureString"
9+
description = "Externally signed client certificate for mTLS"
10+
value = "REPLACE_ME"
11+
key_id = module.pdm_encryption_key.id
12+
ignore_value_changes = true
13+
}
14+
15+
module "ssm_param_external_client_key" {
16+
count = local.is_sandbox ? 0 : 1
17+
source = "./modules/ssm_parameter"
18+
environment = var.environment
19+
owner = var.owner
20+
name = "external_client_key"
21+
type = "SecureString"
22+
description = "Externally signed client certificate for mTLS"
23+
value = "REPLACE_ME"
24+
key_id = module.pdm_encryption_key.id
25+
ignore_value_changes = true
26+
}

‎scripts/confs/dev.conf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
[req]
2+
default_bits = 4096
3+
distinguished_name = req_distinguished_name
4+
req_extensions = v3_req
5+
prompt = no
6+
7+
[req_distinguished_name]
8+
C = GB
9+
ST = West Yorkshire
10+
L = Leeds
11+
O = NHS England
12+
OU = National Document Repository
13+
CN = client.dev.ndr.national.nhs.uk
14+
15+
[v3_req]
16+
keyUsage = keyEncipherment, dataEncipherment
17+
extendedKeyUsage = serverAuth

0 commit comments

Comments
 (0)