Skip to content

Commit 34610bf

Browse files
robg-testrobg-test
authored
Merge branch 'main' into PRMP-1048
2 parents 504b353 + 9a6ec86 commit 34610bf

File tree

14 files changed

+182
-36
lines changed

14 files changed

+182
-36
lines changed

‎.github/actions/tf-plan-apply/action.yml‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
name: "Terraform Plan & Apply"
2+
description: "Run Terraform Plan & Apply for a given component"
3+
4+
inputs:
5+
aws_assume_role:
6+
description: "AWS IAM Role to assume"
7+
required: true
8+
9+
aws_region:
10+
description: "AWS Region to use"
11+
required: true
12+
default: "eu-west-2"
13+
14+
terraform_version:
15+
description: "Terraform version to use"
16+
required: false
17+
default: "1.13.3"
18+
19+
backend_conf:
20+
description: "Terraform backend config file"
21+
required: true
22+
23+
working_directory:
24+
description: "Terraform working directory"
25+
required: false
26+
default: "./infrastructure"
27+
28+
workspace:
29+
description: "Workspace (ndr-dev, ndr-test, pre-prod, prod) or Sandbox name [a-z0-9]{1,8}"
30+
required: true
31+
32+
tf_vars_file:
33+
description: "Terraform variables file"
34+
required: true
35+
36+
tf_extra_args:
37+
description: "Additional Terraform arguments to pass in"
38+
required: false
39+
default: ""
40+
41+
do_apply:
42+
description: "Whether to run 'terraform apply' after 'terraform plan'"
43+
required: false
44+
default: "true"
45+
46+
runs:
47+
using: "composite"
48+
steps:
49+
- name: Configure AWS Credentials
50+
uses: aws-actions/configure-aws-credentials@v5
51+
with:
52+
role-to-assume: ${{ inputs.aws_assume_role }}
53+
role-skip-session-tagging: true
54+
aws-region: ${{ inputs.aws_region }}
55+
mask-aws-account-id: true
56+
57+
- name: Setup Terraform
58+
uses: hashicorp/setup-terraform@v3
59+
with:
60+
terraform_version: ${{ inputs.terraform_version }}
61+
terraform_wrapper: false
62+
63+
- name: Initialise Terraform
64+
run: terraform init -backend-config=${{ inputs.backend_conf }}
65+
working-directory: ${{ inputs.working_directory }}
66+
shell: bash
67+
68+
- name: Select Terraform Workspace
69+
run: terraform workspace select -or-create ${{ inputs.workspace }}
70+
working-directory: ${{ inputs.working_directory }}
71+
shell: bash
72+
73+
- name: Check Terraform Formatting
74+
run: terraform fmt -check
75+
working-directory: ${{ inputs.working_directory }}
76+
shell: bash
77+
78+
- name: Run Terraform Plan
79+
run: |
80+
terraform plan -input=false -no-color -var-file="${{ inputs.tf_vars_file }}" ${{ inputs.tf_extra_args }} -out tf.plan
81+
working-directory: ${{ inputs.working_directory }}
82+
shell: bash
83+
84+
- name: Run Terraform Apply
85+
if: ${{ inputs.do_apply == 'true' }}
86+
run: terraform apply -auto-approve -input=false tf.plan
87+
working-directory: ${{ inputs.working_directory }}
88+
shell: bash

‎.github/workflows/deploy-sandbox.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ on:
1010
required: true
1111
type: "string"
1212
sandbox_name:
13-
description: "Sandbox name [a-z0-9]{1,8}"
13+
description: "Sandbox name [a-z0-9]{1,7}"
1414
required: true
1515
type: "string"
1616

@@ -27,8 +27,8 @@ jobs:
2727
steps:
2828
- name: Validate sandbox name
2929
run: |
30-
if ! [[ "$SANDBOX_NAME" =~ ^[a-z0-9]{1,8}$ ]]; then
31-
echo "Sandbox name must match [a-z0-9]{1,8} (lowercase letters and digits only, 1-8 chars)."
30+
if ! [[ "$SANDBOX_NAME" =~ ^[a-z0-9]{1,7}$ ]]; then
31+
echo "Sandbox name must match [a-z0-9]{1,7} (lowercase letters and digits only, 1-7 chars)."
3232
exit 1
3333
fi
3434
env:

‎infrastructure/cloudfront.tf‎

Lines changed: 38 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,7 @@ resource "aws_cloudfront_distribution" "s3_presign_mask" {
8080
target_origin_id = module.ndr-bulk-staging-store.bucket_id
8181
viewer_protocol_policy = "redirect-to-https"
8282
cache_policy_id = aws_cloudfront_cache_policy.nocache.id
83-
origin_request_policy_id = aws_cloudfront_origin_request_policy.viewer.id
83+
origin_request_policy_id = aws_cloudfront_origin_request_policy.uploader.id
8484

8585
lambda_function_association {
8686
event_type = "origin-request"
@@ -124,9 +124,44 @@ resource "aws_cloudfront_origin_request_policy" "viewer" {
124124
header_behavior = "whitelist"
125125
headers {
126126
items = [
127-
"Host",
128127
"CloudFront-Viewer-Country",
129-
"X-Forwarded-For"
128+
"X-Forwarded-For",
129+
]
130+
}
131+
}
132+
133+
cookies_config {
134+
cookie_behavior = "none"
135+
}
136+
}
137+
138+
resource "aws_cloudfront_origin_request_policy" "uploader" {
139+
name = "${terraform.workspace}_BlockQueriesAndAllowUploader"
140+
141+
query_strings_config {
142+
query_string_behavior = "whitelist"
143+
query_strings {
144+
items = [
145+
"X-Amz-Algorithm",
146+
"X-Amz-Credential",
147+
"X-Amz-Date",
148+
"X-Amz-Expires",
149+
"X-Amz-SignedHeaders",
150+
"X-Amz-Signature",
151+
"X-Amz-Security-Token"
152+
]
153+
}
154+
}
155+
156+
headers_config {
157+
header_behavior = "whitelist"
158+
headers {
159+
items = [
160+
"CloudFront-Viewer-Country",
161+
"X-Forwarded-For",
162+
"Access-Control-Request-Method",
163+
"Access-Control-Request-Headers",
164+
"Origin"
130165
]
131166
}
132167
}

‎infrastructure/dynamo_db.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -557,3 +557,34 @@ module "alarm_state_history_table" {
557557
environment = var.environment
558558
owner = var.owner
559559
}
560+
561+
module "bulk_upload_contact_lookup_table" {
562+
source = "./modules/dynamo_db"
563+
table_name = var.bulk_upload_contact_lookup_table_name
564+
hash_key = "OdsCode"
565+
deletion_protection_enabled = var.deletion_protection_enabled
566+
point_in_time_recovery_enabled = !local.is_sandbox
567+
stream_enabled = false
568+
ttl_enabled = false
569+
570+
attributes = [
571+
{
572+
name = "OdsCode",
573+
type = "S"
574+
},
575+
{
576+
name = "Email"
577+
type = "S"
578+
}
579+
]
580+
global_secondary_indexes = [
581+
{
582+
name = "EmailIndex"
583+
hash_key = "Email"
584+
projection_type = "ALL"
585+
},
586+
]
587+
588+
environment = var.environment
589+
owner = var.owner
590+
}

‎infrastructure/lambda-document-upload-check.tf‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,6 @@ module "document_upload_check_lambda" {
1010
aws_iam_policy.ssm_access_policy.policy,
1111
module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
1212
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
13-
module.pdm_dynamodb_table.dynamodb_read_policy_document,
14-
module.pdm_dynamodb_table.dynamodb_write_policy_document,
1513
data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
1614
module.document_upload_review_dynamodb_table.dynamodb_read_policy_document,
1715
module.document_upload_review_dynamodb_table.dynamodb_write_policy_document,
@@ -24,9 +22,7 @@ module "document_upload_check_lambda" {
2422
http_methods = null
2523
api_execution_arn = null
2624
lambda_environment_variables = {
27-
LLOYD_GEORGE_DYNAMODB_NAME = module.lloyd_george_reference_dynamodb_table.table_name
2825
DOCUMENT_REVIEW_DYNAMODB_NAME = module.document_upload_review_dynamodb_table.table_name
29-
PDM_DYNAMODB_NAME = module.pdm_dynamodb_table.table_name
3026
STAGING_STORE_BUCKET_NAME = module.ndr-bulk-staging-store.bucket_id
3127
LLOYD_GEORGE_BUCKET_NAME = module.ndr-lloyd-george-store.bucket_id
3228
PDM_BUCKET_NAME = module.pdm-document-store.bucket_id
@@ -45,6 +41,7 @@ module "document_upload_check_lambda" {
4541
module.ndr-bulk-staging-store,
4642
module.ndr-lloyd-george-store,
4743
module.lloyd_george_reference_dynamodb_table,
44+
module.core_dynamodb_table,
4845
]
4946
}
5047

‎infrastructure/lambda-get-document-fhir.tf‎

Lines changed: 9 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,6 @@ module "get-doc-fhir-lambda" {
3939
iam_role_policy_documents = [
4040
module.ndr-app-config.app_config_policy,
4141
module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
42-
module.pdm_dynamodb_table.dynamodb_read_policy_document,
4342
module.core_dynamodb_table.dynamodb_read_policy_document,
4443
aws_iam_policy.ssm_access_policy.policy,
4544
aws_iam_policy.mtls_access_ssm_policy.policy,
@@ -52,21 +51,18 @@ module "get-doc-fhir-lambda" {
5251
http_methods = ["GET"]
5352
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
5453
lambda_environment_variables = {
55-
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
56-
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
57-
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
58-
WORKSPACE = terraform.workspace
59-
ENVIRONMENT = var.environment
60-
PRESIGNED_ASSUME_ROLE = aws_iam_role.get_fhir_doc_presign_url_role.arn
61-
LLOYD_GEORGE_DYNAMODB_NAME = module.lloyd_george_reference_dynamodb_table.table_name
62-
PDM_DYNAMODB_NAME = module.pdm_dynamodb_table.table_name
63-
OIDC_CALLBACK_URL = contains(["prod"], terraform.workspace) ? "https://${var.domain}/auth-callback" : "https://${terraform.workspace}.${var.domain}/auth-callback"
64-
CLOUDFRONT_URL = aws_cloudfront_distribution.s3_presign_mask.domain_name
65-
PDS_FHIR_IS_STUBBED = local.is_sandbox
54+
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
55+
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
56+
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
57+
WORKSPACE = terraform.workspace
58+
ENVIRONMENT = var.environment
59+
PRESIGNED_ASSUME_ROLE = aws_iam_role.get_fhir_doc_presign_url_role.arn
60+
OIDC_CALLBACK_URL = contains(["prod"], terraform.workspace) ? "https://${var.domain}/auth-callback" : "https://${terraform.workspace}.${var.domain}/auth-callback"
61+
CLOUDFRONT_URL = aws_cloudfront_distribution.s3_presign_mask.domain_name
62+
PDS_FHIR_IS_STUBBED = local.is_sandbox
6663
}
6764
depends_on = [
6865
aws_api_gateway_method.get_document_reference,
69-
module.pdm_dynamodb_table,
7066
module.lloyd_george_reference_dynamodb_table,
7167
module.core_dynamodb_table,
7268
]

‎infrastructure/lambda-post-document-fhir.tf‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ module "post-document-references-fhir-lambda" {
55
iam_role_policy_documents = [
66
module.document_reference_dynamodb_table.dynamodb_write_policy_document,
77
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
8-
module.pdm_dynamodb_table.dynamodb_write_policy_document,
98
module.core_dynamodb_table.dynamodb_write_policy_document,
109
module.ndr-bulk-staging-store.s3_write_policy_document,
1110
module.ndr-app-config.app_config_policy,
@@ -21,8 +20,6 @@ module "post-document-references-fhir-lambda" {
2120
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
2221
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
2322
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
24-
LLOYD_GEORGE_DYNAMODB_NAME = module.lloyd_george_reference_dynamodb_table.table_name
25-
PDM_DYNAMODB_NAME = module.pdm_dynamodb_table.table_name
2623
STAGING_STORE_BUCKET_NAME = "${terraform.workspace}-${var.staging_store_bucket_name}"
2724
DOCUMENT_RETRIEVE_ENDPOINT_APIM = "${local.apim_api_url}/DocumentReference"
2825
PDS_FHIR_IS_STUBBED = local.is_sandbox
@@ -31,7 +28,6 @@ module "post-document-references-fhir-lambda" {
3128
}
3229

3330
depends_on = [
34-
module.pdm_dynamodb_table,
3531
module.core_dynamodb_table,
3632
module.lloyd_george_reference_dynamodb_table,
3733
]

‎infrastructure/lambda-search-document-references-fhir.tf‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,6 @@ module "search-document-references-fhir-lambda" {
77
module.document_reference_dynamodb_table.dynamodb_write_policy_document,
88
module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
99
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
10-
module.pdm_dynamodb_table.dynamodb_read_policy_document,
11-
module.pdm_dynamodb_table.dynamodb_write_policy_document,
1210
module.core_dynamodb_table.dynamodb_read_policy_document,
1311
module.core_dynamodb_table.dynamodb_write_policy_document,
1412
module.ndr-lloyd-george-store.s3_read_policy_document,
@@ -26,15 +24,14 @@ module "search-document-references-fhir-lambda" {
2624
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
2725
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
2826
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
29-
DYNAMODB_TABLE_LIST = "[\u0022${module.pdm_dynamodb_table.table_name}\u0022, \u0022${module.lloyd_george_reference_dynamodb_table.table_name}\u0022]"
27+
DYNAMODB_TABLE_LIST = "[\u0022${module.core_dynamodb_table.table_name}\u0022, \u0022${module.lloyd_george_reference_dynamodb_table.table_name}\u0022]"
3028
DOCUMENT_RETRIEVE_ENDPOINT_APIM = "${local.apim_api_url}/DocumentReference"
3129
WORKSPACE = terraform.workspace
3230
}
3331
depends_on = [
3432
aws_api_gateway_rest_api.ndr_doc_store_api,
3533
module.search-document-references-gateway,
3634
module.ndr-app-config,
37-
module.pdm_dynamodb_table,
3835
module.core_dynamodb_table,
3936
module.lloyd_george_reference_dynamodb_table,
4037
]

‎infrastructure/modules/app_config/configurations/dev.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636
"enabled": "false"
3737
},
3838
"lloydGeorgeValidationStrictModeEnabled": {
39-
"enabled": "true"
39+
"enabled": "false"
4040
},
4141
"uploadDocumentIteration2Enabled": {
4242
"enabled": "false"

‎infrastructure/modules/app_config/configurations/pre-prod.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636
"enabled": "true"
3737
},
3838
"lloydGeorgeValidationStrictModeEnabled": {
39-
"enabled": "true"
39+
"enabled": "false"
4040
},
4141
"uploadDocumentIteration2Enabled": {
4242
"enabled": "false"

0 commit comments

Comments
 (0)