[PRMP - 541] Enforce virus scans on expedite files (#506)

Co-authored-by: Robert Gaskin <[email protected]>

Author: PedroSoaresNHS

infrastructure/lambda-bulk-upload-metadata-processor.tf

@@ -4,19 +4,19 @@ module "bulk-upload-metadata-processor-lambda" {
   handler        = "handlers.bulk_upload_metadata_processor_handler.lambda_handler"
   lambda_timeout = 900
   memory_size    = 1769
+
   iam_role_policy_documents = [
     module.ndr-bulk-staging-store.s3_read_policy_document,
     module.ndr-bulk-staging-store.s3_write_policy_document,
     module.bulk_upload_report_dynamodb_table.dynamodb_read_policy_document,
     module.bulk_upload_report_dynamodb_table.dynamodb_write_policy_document,
     module.sqs-lg-bulk-upload-metadata-queue.sqs_read_policy_document,
     module.sqs-lg-bulk-upload-metadata-queue.sqs_write_policy_document,
-    module.ndr-app-config.app_config_policy
+    module.ndr-app-config.app_config_policy,
+    aws_iam_policy.ssm_access_policy.policy,
+    data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
   ]
 
-  rest_api_id       = null
-  api_execution_arn = null
-
   lambda_environment_variables = {
     APPCONFIG_APPLICATION      = module.ndr-app-config.app_config_application_id
     APPCONFIG_ENVIRONMENT      = module.ndr-app-config.app_config_environment_id
@@ -27,7 +27,15 @@ module "bulk-upload-metadata-processor-lambda" {
     LLOYD_GEORGE_BUCKET_NAME   = "${terraform.workspace}-${var.lloyd_george_bucket_name}"
     LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
     METADATA_SQS_QUEUE_URL     = module.sqs-lg-bulk-upload-metadata-queue.sqs_url
+
+    VIRUS_SCAN_STUB = !local.is_production
   }
+
+  vpc_subnet_ids         = length(data.aws_security_groups.virus_scanner_api.ids) == 1 ? module.ndr-vpc-ui.private_subnets : []
+  vpc_security_group_ids = length(data.aws_security_groups.virus_scanner_api.ids) == 1 ? [data.aws_security_groups.virus_scanner_api.ids[0]] : []
+
+  rest_api_id                   = null
+  api_execution_arn             = null
   is_gateway_integration_needed = false
   is_invoked_from_gateway       = false
 }