Skip to content

Commit 6839bc3

Browse files
AndyFlintNHSAndyFlintAnswerDigitalMohammadIqbalAD-NHSrobg-nhs
authored
[PRMP-1580] NHSOAuthTokenGenerator lambda
* [PRMP-1580] Added NHS OAuth Token Generator Lambda * [PRMP-1580] corrected ssm_access_policy * [PRMP-1580] - Add alarm and topic for nhs-oauth-token-generator-lambda * [PRMP-1580] Removed implicit dependencies, extended Lambda timeout * [PRMP-1580] Terraform formatting --------- Co-authored-by: Andy Flint <[email protected]> Co-authored-by: Mohammad Iqbal <[email protected]> Co-authored-by: robg-nhs <[email protected]>
1 parent e8b0989 commit 6839bc3

File tree

3 files changed

+85
-1
lines changed

3 files changed

+85
-1
lines changed

‎infrastructure/README.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,9 @@
120120
| <a name="module_nems-message-lambda"></a> [nems-message-lambda](#module\_nems-message-lambda) | ./modules/lambda | n/a |
121121
| <a name="module_nems-message-lambda-alarm"></a> [nems-message-lambda-alarm](#module\_nems-message-lambda-alarm) | ./modules/lambda_alarms | n/a |
122122
| <a name="module_nems-message-lambda-alarm-topic"></a> [nems-message-lambda-alarm-topic](#module\_nems-message-lambda-alarm-topic) | ./modules/sns | n/a |
123+
| <a name="module_nhs-oauth-token-generator-alarm"></a> [nhs-oauth-token-generator-alarm](#module\_nhs-oauth-token-generator-alarm) | ./modules/lambda_alarms | n/a |
124+
| <a name="module_nhs-oauth-token-generator-alarm-topic"></a> [nhs-oauth-token-generator-alarm-topic](#module\_nhs-oauth-token-generator-alarm-topic) | ./modules/sns | n/a |
125+
| <a name="module_nhs-oauth-token-generator-lambda"></a> [nhs-oauth-token-generator-lambda](#module\_nhs-oauth-token-generator-lambda) | ./modules/lambda | n/a |
123126
| <a name="module_nrl-dlq-alarm-topic"></a> [nrl-dlq-alarm-topic](#module\_nrl-dlq-alarm-topic) | ./modules/sns | n/a |
124127
| <a name="module_pdf-stitching-alarm-topic"></a> [pdf-stitching-alarm-topic](#module\_pdf-stitching-alarm-topic) | ./modules/sns | n/a |
125128
| <a name="module_pdf-stitching-lambda"></a> [pdf-stitching-lambda](#module\_pdf-stitching-lambda) | ./modules/lambda | n/a |
@@ -209,10 +212,12 @@
209212
| [aws_cloudwatch_event_rule.bulk_upload_metadata_schedule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
210213
| [aws_cloudwatch_event_rule.bulk_upload_report_schedule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
211214
| [aws_cloudwatch_event_rule.data_collection_schedule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
215+
| [aws_cloudwatch_event_rule.nhs_oauth_token_generator_schedule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
212216
| [aws_cloudwatch_event_rule.statistical_report_schedule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
213217
| [aws_cloudwatch_event_target.bulk_upload_metadata_schedule_event](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
214218
| [aws_cloudwatch_event_target.bulk_upload_report_schedule_event](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
215219
| [aws_cloudwatch_event_target.data_collection_schedule_event](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
220+
| [aws_cloudwatch_event_target.nhs_oauth_token_generator_schedule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
216221
| [aws_cloudwatch_event_target.statistical_report_schedule_event](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
217222
| [aws_cloudwatch_log_group.mesh_log_group](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
218223
| [aws_cloudwatch_log_metric_filter.edge_presign_error](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_metric_filter) | resource |
@@ -318,6 +323,7 @@
318323
| [aws_lambda_permission.bulk_upload_metadata_schedule_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
319324
| [aws_lambda_permission.bulk_upload_report_schedule_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
320325
| [aws_lambda_permission.data_collection_schedule_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
326+
| [aws_lambda_permission.nhs_oauth_token_generator_schedule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
321327
| [aws_lambda_permission.statistical_report_schedule_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
322328
| [aws_rum_app_monitor.ndr](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/rum_app_monitor) | resource |
323329
| [aws_s3_bucket.access_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |

‎infrastructure/lambda-nhs-oauth-token-generator.tf‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
module "nhs-oauth-token-generator-lambda" {
2+
source = "./modules/lambda"
3+
name = "NhsOauthTokenGeneratorLambda"
4+
handler = "handlers.nhs_oauth_token_generator_handler.lambda_handler"
5+
lambda_timeout = 120
6+
iam_role_policy_documents = [
7+
aws_iam_policy.ssm_access_policy.policy,
8+
module.ndr-app-config.app_config_policy
9+
]
10+
11+
rest_api_id = null
12+
api_execution_arn = null
13+
14+
lambda_environment_variables = {
15+
WORKSPACE = terraform.workspace
16+
}
17+
is_gateway_integration_needed = false
18+
is_invoked_from_gateway = false
19+
}
20+
21+
module "nhs-oauth-token-generator-alarm" {
22+
source = "./modules/lambda_alarms"
23+
lambda_function_name = module.nhs-oauth-token-generator-lambda.function_name
24+
lambda_timeout = module.nhs-oauth-token-generator-lambda.timeout
25+
lambda_name = "nhs_oauth_token_generator_handler"
26+
namespace = "AWS/Lambda"
27+
alarm_actions = [module.nhs-oauth-token-generator-alarm-topic.arn]
28+
ok_actions = [module.nhs-oauth-token-generator-alarm-topic.arn]
29+
}
30+
31+
module "nhs-oauth-token-generator-alarm-topic" {
32+
source = "./modules/sns"
33+
sns_encryption_key_id = module.sns_encryption_key.id
34+
current_account_id = data.aws_caller_identity.current.account_id
35+
topic_name = "nhs-oauth-token-generator-topic"
36+
topic_protocol = "lambda"
37+
topic_endpoint = module.nhs-oauth-token-generator-lambda.lambda_arn
38+
delivery_policy = jsonencode({
39+
"Version" : "2012-10-17",
40+
"Statement" : [
41+
{
42+
"Effect" : "Allow",
43+
"Principal" : {
44+
"Service" : "cloudwatch.amazonaws.com"
45+
},
46+
"Action" : [
47+
"SNS:Publish",
48+
],
49+
"Condition" : {
50+
"ArnLike" : {
51+
"aws:SourceArn" : "arn:aws:cloudwatch:eu-west-2:${data.aws_caller_identity.current.account_id}:alarm:*"
52+
}
53+
}
54+
"Resource" : "*"
55+
}
56+
]
57+
})
58+
}

‎infrastructure/schedules.tf‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -164,4 +164,24 @@ resource "aws_iam_role_policy_attachment" "ods_weekly_update_ecs_execution" {
164164
count = local.is_sandbox ? 0 : 1
165165
role = aws_iam_role.ods_weekly_update_ecs_execution[0].name
166166
policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonEC2ContainerServiceEventsRole"
167-
}
167+
}
168+
169+
resource "aws_cloudwatch_event_rule" "nhs_oauth_token_generator_schedule" {
170+
name = "${terraform.workspace}_nhs_oauth_token_generator_schedule"
171+
description = "Schedule for NHS OAuth Token Generator Lambda"
172+
schedule_expression = "rate(9 minutes)"
173+
}
174+
175+
resource "aws_cloudwatch_event_target" "nhs_oauth_token_generator_schedule" {
176+
rule = aws_cloudwatch_event_rule.nhs_oauth_token_generator_schedule.name
177+
target_id = "nhs_oauth_token_generator_schedule"
178+
arn = module.nhs-oauth-token-generator-lambda.lambda_arn
179+
}
180+
181+
resource "aws_lambda_permission" "nhs_oauth_token_generator_schedule" {
182+
statement_id = "AllowExecutionFromCloudWatch"
183+
action = "lambda:InvokeFunction"
184+
function_name = module.nhs-oauth-token-generator-lambda.function_name
185+
principal = "events.amazonaws.com"
186+
source_arn = aws_cloudwatch_event_rule.nhs_oauth_token_generator_schedule.arn
187+
}

0 commit comments

Comments
 (0)