Skip to content

Commit 493fb49

Browse files
NogaNHSNogaNHS
authored
Merge branch 'main' into PRMP-840
2 parents 79534e6 + e7dad78 commit 493fb49

File tree

33 files changed

+223
-27
lines changed

33 files changed

+223
-27
lines changed

.github/workflows/automated-sbom-repo-scan.yml renamed to .github/workflows/automated-pr-validator.yml

Lines changed: 31 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,23 +1,23 @@
1-
name: 'Z-AUTOMATED: SBOM Repo Scan'
1+
name: "Z-AUTOMATED: PR Validator"
22

33
on:
44
pull_request:
55
types: [opened, synchronize, reopened]
66

7-
permissions:
8-
actions: read # Required for anchore/sbom-action
9-
contents: write # Required for anchore/sbom-action
10-
id-token: write # Required for requesting the JWT
11-
pull-requests: write
12-
137
jobs:
148
sbom_scan:
159
name: SBOM Repo Scan
1610
runs-on: ubuntu-latest
11+
permissions:
12+
actions: read # Required for anchore/sbom-action
13+
contents: write # Required for anchore/sbom-action
14+
id-token: write # Required for requesting the JWT
15+
pull-requests: write
1716
steps:
18-
- uses: actions/checkout@v5
17+
- name: Checkout
18+
uses: actions/checkout@v5
1919
with:
20-
fetch-depth: 0 # Shallow clones should be disabled for a better relevancy of analysis
20+
fetch-depth: 0
2121

2222
- uses: anchore/sbom-action@v0
2323
with:
@@ -51,14 +51,14 @@ jobs:
5151
repo: context.repo.repo,
5252
issue_number: context.issue.number,
5353
})
54-
54+
5555
const botComment = comments.find(comment => {
5656
return comment.user.type === 'Bot' && comment.body.includes('Code security issues found')
5757
})
5858
5959
// 2. Prepare format of the comment
6060
const output = `### Code security issues found
61-
61+
6262
View full details [here](https://github.com/${{ github.repository }}/security/code-scanning?query=is%3Aopen+pr%3A${{ github.event.pull_request.number }}).`;
6363
6464
// 3. If we have a comment, update it, otherwise create a new one
@@ -70,7 +70,7 @@ jobs:
7070
body: output
7171
})
7272
}
73-
73+
7474
github.rest.issues.createComment({
7575
issue_number: context.issue.number,
7676
owner: context.repo.owner,
@@ -89,7 +89,7 @@ jobs:
8989
repo: context.repo.repo,
9090
issue_number: context.issue.number,
9191
})
92-
92+
9393
const botComment = comments.find(comment => {
9494
return comment.user.type === 'Bot' && comment.body.includes('Code security issues found')
9595
})
@@ -102,3 +102,21 @@ jobs:
102102
comment_id: botComment.id
103103
})
104104
}
105+
106+
markdown-validation:
107+
name: Markdown Validation
108+
runs-on: ubuntu-latest
109+
permissions:
110+
contents: read
111+
steps:
112+
- name: Checkout
113+
uses: actions/checkout@v6
114+
with:
115+
fetch-depth: 0
116+
117+
- name: Run Markdown Validation Script
118+
id: validate
119+
run: |
120+
BRANCH_NAME=${{ github.event.repository.default_branch }}
121+
chmod +x scripts/markdown-validator.sh
122+
scripts/markdown-validator.sh

‎.markdownlint.jsonc‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"MD013": false,
3+
"MD033": false
4+
}

‎.terraform-docs.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,11 @@ sections:
1414

1515
content: |-
1616
{{ .Requirements }}
17+
1718
{{ .Resources }}
19+
1820
{{ .Inputs }}
21+
1922
{{ .Outputs }}
2023
2124
output:

‎README.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,8 @@ This repository is used to build the infrastructure the NDR. That is it's sole p
88
- [Terraform docs](https://github.com/terraform-docs/terraform-docs)
99

1010
To install terraform-docs on WSL use the following commands (e.g. for v0.20.0):
11-
```
11+
12+
```shell
1213
curl -sSLo ./terraform-docs.tar.gz https://terraform-docs.io/dl/v0.20.0/terraform-docs-v0.20.0-$(uname)-amd64.tar.gz
1314
tar -xzf terraform-docs.tar.gz
1415
chmod +x terraform-docs
@@ -24,7 +25,7 @@ As this repository is a standalone infrastructure there is no python/node based
2425

2526
- Set this repository to get it's pre-commit hooks from .githooks
2627

27-
```
28+
```shell
2829
git config core.hooksPath .githooks
2930
```
3031

‎bootstrap/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
# Terraform Bootstrap
2+
13
## Requirements
24

35
| Name | Version |

‎infrastructure/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
# National Document Repository - Infrastructure as Code
2+
13
## Requirements
24

35
| Name | Version |

‎infrastructure/api.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,8 @@ resource "aws_api_gateway_deployment" "ndr_api_deploy" {
7676
module.send-feedback-gateway,
7777
module.send-feedback-lambda,
7878
module.review_document_version_gateway,
79+
module.review_document_status_gateway,
80+
module.review-document-status-check-lambda,
7981
module.update-doc-ref-lambda,
8082
module.update-upload-state-gateway,
8183
module.update-upload-state-lambda,

‎infrastructure/gateway-review-document.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,3 +32,15 @@ module "review_document_version_gateway" {
3232
"method.request.path.version" = true
3333
}
3434
}
35+
36+
module "review_document_status_gateway" {
37+
source = "./modules/gateway"
38+
api_gateway_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
39+
parent_id = module.review_document_version_gateway.gateway_resource_id
40+
gateway_path = "Status"
41+
http_methods = ["GET"]
42+
require_credentials = true
43+
authorization = "CUSTOM"
44+
authorizer_id = aws_api_gateway_authorizer.repo_authoriser.id
45+
origin = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
46+
}

‎infrastructure/lambda-bulk-upload-metadata-processor.tf‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,19 @@ module "bulk-upload-metadata-processor-lambda" {
44
handler = "handlers.bulk_upload_metadata_processor_handler.lambda_handler"
55
lambda_timeout = 900
66
memory_size = 1769
7+
78
iam_role_policy_documents = [
89
module.ndr-bulk-staging-store.s3_read_policy_document,
910
module.ndr-bulk-staging-store.s3_write_policy_document,
1011
module.bulk_upload_report_dynamodb_table.dynamodb_read_policy_document,
1112
module.bulk_upload_report_dynamodb_table.dynamodb_write_policy_document,
1213
module.sqs-lg-bulk-upload-metadata-queue.sqs_read_policy_document,
1314
module.sqs-lg-bulk-upload-metadata-queue.sqs_write_policy_document,
14-
module.ndr-app-config.app_config_policy
15+
module.ndr-app-config.app_config_policy,
16+
aws_iam_policy.ssm_access_policy.policy,
17+
data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
1518
]
1619

17-
rest_api_id = null
18-
api_execution_arn = null
19-
2020
lambda_environment_variables = {
2121
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
2222
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
@@ -27,7 +27,15 @@ module "bulk-upload-metadata-processor-lambda" {
2727
LLOYD_GEORGE_BUCKET_NAME = "${terraform.workspace}-${var.lloyd_george_bucket_name}"
2828
LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
2929
METADATA_SQS_QUEUE_URL = module.sqs-lg-bulk-upload-metadata-queue.sqs_url
30+
31+
VIRUS_SCAN_STUB = !local.is_production
3032
}
33+
34+
vpc_subnet_ids = length(data.aws_security_groups.virus_scanner_api.ids) == 1 ? module.ndr-vpc-ui.private_subnets : []
35+
vpc_security_group_ids = length(data.aws_security_groups.virus_scanner_api.ids) == 1 ? [data.aws_security_groups.virus_scanner_api.ids[0]] : []
36+
37+
rest_api_id = null
38+
api_execution_arn = null
3139
is_gateway_integration_needed = false
3240
is_invoked_from_gateway = false
3341
}

‎infrastructure/lambda-review-document-status.tf‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
module "review-document-status-check-lambda" {
2+
source = "./modules/lambda"
3+
name = "ReviewDocumentStatusCheck"
4+
handler = "handlers.review_document_status_check_handler.lambda_handler"
5+
iam_role_policy_documents = [
6+
module.ndr-app-config.app_config_policy,
7+
aws_iam_policy.ssm_access_policy.policy,
8+
local.is_production ? "" : module.document_review_dynamodb_table[0].dynamodb_read_policy_document
9+
]
10+
kms_deletion_window = var.kms_deletion_window
11+
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
12+
resource_id = module.review_document_status_gateway.gateway_resource_id
13+
http_methods = ["GET"]
14+
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
15+
lambda_environment_variables = {
16+
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
17+
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
18+
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
19+
DOCUMENT_REVIEW_DYNAMODB_NAME = local.is_production ? "" : module.document_review_dynamodb_table[0].table_name
20+
DOCUMENT_REVIEW_S3_BUCKET_NAME = module.ndr-document-pending-review-store.bucket_id
21+
WORKSPACE = terraform.workspace
22+
}
23+
}
24+
25+
module "review-document-status-check-lambda-alarm" {
26+
source = "./modules/lambda_alarms"
27+
lambda_function_name = module.review-document-status-check-lambda.function_name
28+
lambda_timeout = module.review-document-status-check-lambda.timeout
29+
lambda_name = "search_document_review_handler"
30+
namespace = "AWS/Lambda"
31+
alarm_actions = [module.review-document-status-check-alarm-topic.arn]
32+
ok_actions = [module.review-document-status-check-alarm-topic.arn]
33+
}
34+
35+
module "review-document-status-check-alarm-topic" {
36+
source = "./modules/sns"
37+
sns_encryption_key_id = module.sns_encryption_key.id
38+
topic_name = "search-document-review-lambda-alarm-topic"
39+
topic_protocol = "lambda"
40+
topic_endpoint = module.review-document-status-check-lambda.lambda_arn
41+
delivery_policy = jsonencode({
42+
"Version" : "2012-10-17",
43+
"Statement" : [
44+
{
45+
"Effect" : "Allow",
46+
"Principal" : {
47+
"Service" : "cloudwatch.amazonaws.com"
48+
},
49+
"Action" : [
50+
"SNS:Publish",
51+
],
52+
"Condition" : {
53+
"ArnLike" : {
54+
"aws:SourceArn" : "arn:aws:cloudwatch:eu-west-2:${data.aws_caller_identity.current.account_id}:alarm:*"
55+
}
56+
}
57+
"Resource" : "*"
58+
}
59+
]
60+
})
61+
}

0 commit comments

Comments
 (0)