Skip to content

Commit 759ca9b

Browse files
adamwhitingnhsadamwhitingnhs
authored
Merge branch 'main' into PRMT-439
2 parents 933ee5d + c04adab commit 759ca9b

22 files changed

+171
-85
lines changed

‎bootstrap/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
| Name | Version |
1111
|------|---------|
12-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.70.0 |
12+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.0 |
1313

1414
## Modules
1515

‎infrastructure/README.md‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
| Name | Version |
1111
|------|---------|
12-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.86.1 |
12+
| <a name="provider_aws"></a> [aws](#provider\_aws) | ~> 5.0 |
1313

1414
## Modules
1515

@@ -50,6 +50,7 @@
5050
| <a name="module_create-token-lambda"></a> [create-token-lambda](#module\_create-token-lambda) | ./modules/lambda | n/a |
5151
| <a name="module_create_doc_alarm"></a> [create\_doc\_alarm](#module\_create\_doc\_alarm) | ./modules/lambda_alarms | n/a |
5252
| <a name="module_create_doc_alarm_topic"></a> [create\_doc\_alarm\_topic](#module\_create\_doc\_alarm\_topic) | ./modules/sns | n/a |
53+
| <a name="module_create_document_reference_gateway"></a> [create\_document\_reference\_gateway](#module\_create\_document\_reference\_gateway) | ./modules/gateway | n/a |
5354
| <a name="module_create_token-alarm"></a> [create\_token-alarm](#module\_create\_token-alarm) | ./modules/lambda_alarms | n/a |
5455
| <a name="module_create_token-alarm_topic"></a> [create\_token-alarm\_topic](#module\_create\_token-alarm\_topic) | ./modules/sns | n/a |
5556
| <a name="module_data-collection-alarm"></a> [data-collection-alarm](#module\_data-collection-alarm) | ./modules/lambda_alarms | n/a |
@@ -128,6 +129,7 @@
128129
| <a name="module_pdf-stitching-alarm-topic"></a> [pdf-stitching-alarm-topic](#module\_pdf-stitching-alarm-topic) | ./modules/sns | n/a |
129130
| <a name="module_pdf-stitching-lambda"></a> [pdf-stitching-lambda](#module\_pdf-stitching-lambda) | ./modules/lambda | n/a |
130131
| <a name="module_pdf-stitching-lambda-alarms"></a> [pdf-stitching-lambda-alarms](#module\_pdf-stitching-lambda-alarms) | ./modules/lambda_alarms | n/a |
132+
| <a name="module_post-document-references-fhir-lambda"></a> [post-document-references-fhir-lambda](#module\_post-document-references-fhir-lambda) | ./modules/lambda | n/a |
131133
| <a name="module_pdm-document-store"></a> [pdm-document-store](#module\_pdm-document-store) | ./modules/s3/ | n/a |
132134
| <a name="module_pdm_dynamodb_table"></a> [pdm\_dynamodb\_table](#module\_pdm\_dynamodb\_table) | ./modules/dynamo_db | n/a |
133135
| <a name="module_route53_fargate_ui"></a> [route53\_fargate\_ui](#module\_route53\_fargate\_ui) | ./modules/route53 | n/a |
@@ -177,6 +179,7 @@
177179

178180
| Name | Type |
179181
|------|------|
182+
| [aws_api_gateway_account.logging](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_account) | resource |
180183
| [aws_api_gateway_api_key.api_key_pdm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_api_key) | resource |
181184
| [aws_api_gateway_api_key.apim](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_api_key) | resource |
182185
| [aws_api_gateway_authorizer.repo_authoriser](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_authorizer) | resource |
@@ -192,7 +195,6 @@
192195
| [aws_api_gateway_integration_response.get_document_reference_mock_403_response](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_integration_response) | resource |
193196
| [aws_api_gateway_integration_response.get_document_reference_mock_404_response](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_integration_response) | resource |
194197
| [aws_api_gateway_method.get_document_reference](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method) | resource |
195-
| [aws_api_gateway_method.get_document_references_fhir](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method) | resource |
196198
| [aws_api_gateway_method.login_proxy_method](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method) | resource |
197199
| [aws_api_gateway_method.sandbox_get_document_reference](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method) | resource |
198200
| [aws_api_gateway_method_response.response_200](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method_response) | resource |
@@ -258,6 +260,7 @@
258260
| [aws_iam_policy.ses_send_email_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
259261
| [aws_iam_policy.ssm_access_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
260262
| [aws_iam_policy.ssm_access_policy_authoriser](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
263+
| [aws_iam_role.api_gateway_cloudwatch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
261264
| [aws_iam_role.cognito_unauthenticated](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
262265
| [aws_iam_role.create_post_presign_url_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
263266
| [aws_iam_role.cross_account_backup_iam_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
@@ -270,6 +273,7 @@
270273
| [aws_iam_role.splunk_sqs_forwarder](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
271274
| [aws_iam_role.stitch_presign_url_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
272275
| [aws_iam_role_policy.splunk_access_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy) | resource |
276+
| [aws_iam_role_policy_attachment.api_gateway_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
273277
| [aws_iam_role_policy_attachment.backup_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
274278
| [aws_iam_role_policy_attachment.cloudwatch_rum_cognito_unauth](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
275279
| [aws_iam_role_policy_attachment.create_post_presign_url](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |

‎infrastructure/api.tf‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@ resource "aws_api_gateway_deployment" "ndr_api_deploy" {
4949
module.back_channel_logout_lambda,
5050
module.document_reference_gateway,
5151
module.create-doc-ref-lambda,
52+
module.create_document_reference_gateway,
5253
module.create-token-gateway,
5354
module.create-token-lambda,
5455
module.delete-doc-ref-gateway,
@@ -74,6 +75,7 @@ resource "aws_api_gateway_deployment" "ndr_api_deploy" {
7475
module.update-upload-state-lambda,
7576
module.upload_confirm_result_gateway,
7677
module.upload_confirm_result_lambda,
78+
module.post-document-references-fhir-lambda,
7779
module.virus_scan_result_gateway,
7880
module.virus_scan_result_lambda
7981
]
@@ -93,14 +95,19 @@ resource "aws_api_gateway_stage" "ndr_api" {
9395
stage_name = var.environment
9496
xray_tracing_enabled = var.enable_xray_tracing
9597

96-
depends_on = [aws_cloudwatch_log_group.api_gateway_stage]
98+
depends_on = [
99+
aws_cloudwatch_log_group.api_gateway_stage
100+
]
97101
}
98102

99103
resource "aws_cloudwatch_log_group" "api_gateway_stage" {
100104
# Name must follow this format to allow execution logging
101105
# https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html
102106
name = "API-Gateway-Execution-Logs_${aws_api_gateway_rest_api.ndr_doc_store_api.id}/${var.environment}"
103107
retention_in_days = 0
108+
depends_on = [
109+
aws_api_gateway_account.logging
110+
]
104111
}
105112

106113
resource "aws_api_gateway_method_settings" "api_gateway_stage" {

‎infrastructure/firewall.tf‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,15 @@ module "firewall_waf_v2" {
66
count = local.is_sandbox ? 0 : 1
77
}
88

9+
module "firewall_waf_v2_api" {
10+
source = "./modules/firewall_waf_v2"
11+
cloudfront_acl = false
12+
environment = var.environment
13+
owner = var.owner
14+
count = local.is_sandbox ? 0 : 1
15+
api = true
16+
}
17+
918
resource "aws_wafv2_web_acl_association" "web_acl_association" {
1019
resource_arn = module.ndr-ecs-fargate-app.load_balancer_arn
1120
web_acl_arn = module.firewall_waf_v2[0].arn
@@ -18,10 +27,10 @@ resource "aws_wafv2_web_acl_association" "web_acl_association" {
1827

1928
resource "aws_wafv2_web_acl_association" "api_gateway" {
2029
resource_arn = aws_api_gateway_stage.ndr_api.arn
21-
web_acl_arn = module.firewall_waf_v2[0].arn
30+
web_acl_arn = module.firewall_waf_v2_api[0].arn
2231
count = local.is_sandbox ? 0 : 1
2332
depends_on = [
2433
aws_api_gateway_stage.ndr_api,
25-
module.firewall_waf_v2[0]
34+
module.firewall_waf_v2_api[0]
2635
]
2736
}

‎infrastructure/gateway-document-reference.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
module "document_reference_gateway" {
2+
source = "./modules/gateway"
3+
api_gateway_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
4+
parent_id = aws_api_gateway_rest_api.ndr_doc_store_api.root_resource_id
5+
http_methods = ["POST", "GET"]
6+
authorization = "NONE"
7+
api_key_required = true
8+
gateway_path = "DocumentReference"
9+
require_credentials = true
10+
}

‎infrastructure/iam.tf‎

Lines changed: 35 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,12 @@ data "aws_iam_policy_document" "assume_role_policy_for_create_lambda" {
2020
actions = ["sts:AssumeRole"]
2121

2222
principals {
23-
type = "AWS"
24-
identifiers = [module.create-doc-ref-lambda.lambda_execution_role_arn]
23+
type = "AWS"
24+
identifiers = compact([
25+
module.create-doc-ref-lambda.lambda_execution_role_arn,
26+
local.is_production ? null : module.post-document-references-fhir-lambda[0].lambda_execution_role_arn
27+
])
28+
2529
}
2630
}
2731
}
@@ -193,3 +197,32 @@ resource "aws_iam_role_policy_attachment" "ods_report_presign_url" {
193197
role = aws_iam_role.ods_report_presign_url_role.name
194198
policy_arn = aws_iam_policy.s3_document_data_policy_for_ods_report_lambda.arn
195199
}
200+
201+
resource "aws_iam_role" "api_gateway_cloudwatch" {
202+
count = local.is_sandbox ? 0 : 1
203+
name = "${terraform.workspace}_NdrAPIGatewayLogs"
204+
205+
assume_role_policy = jsonencode({
206+
Version = "2012-10-17"
207+
Statement = [
208+
{
209+
Action = "sts:AssumeRole"
210+
Effect = "Allow"
211+
Principal = {
212+
Service = "apigateway.amazonaws.com"
213+
}
214+
},
215+
]
216+
})
217+
}
218+
219+
resource "aws_iam_role_policy_attachment" "api_gateway_logs" {
220+
count = local.is_sandbox ? 0 : 1
221+
role = aws_iam_role.api_gateway_cloudwatch[0].name
222+
policy_arn = "arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs"
223+
}
224+
225+
resource "aws_api_gateway_account" "logging" {
226+
count = local.is_sandbox ? 0 : 1
227+
cloudwatch_role_arn = aws_iam_role.api_gateway_cloudwatch[0].arn
228+
}

‎infrastructure/lambda-create-doc-ref.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
1-
module "document_reference_gateway" {
1+
module "create_document_reference_gateway" {
22
source = "./modules/gateway"
33
api_gateway_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
44
parent_id = aws_api_gateway_rest_api.ndr_doc_store_api.root_resource_id
55
http_methods = ["POST"]
66
authorization = "CUSTOM"
7-
gateway_path = "DocumentReference"
7+
gateway_path = "CreateDocumentReference"
88
authorizer_id = aws_api_gateway_authorizer.repo_authoriser.id
99
require_credentials = true
1010
origin = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
@@ -73,7 +73,7 @@ module "create-doc-ref-lambda" {
7373
module.ndr-app-config.app_config_policy,
7474
]
7575
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
76-
resource_id = module.document_reference_gateway.gateway_resource_id
76+
resource_id = module.create_document_reference_gateway.gateway_resource_id
7777
http_methods = ["POST"]
7878
memory_size = 512
7979

‎infrastructure/lambda-post-document-fhir.tf‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
module "post-document-references-fhir-lambda" {
2+
count = local.is_production ? 0 : 1
3+
source = "./modules/lambda"
4+
name = "PostDocumentReferencesFHIR"
5+
handler = "handlers.post_fhir_document_reference_handler.lambda_handler"
6+
iam_role_policy_documents = [
7+
module.document_reference_dynamodb_table.dynamodb_write_policy_document,
8+
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
9+
module.ndr-bulk-staging-store.s3_write_policy_document,
10+
module.ndr-app-config.app_config_policy,
11+
aws_iam_policy.ssm_access_policy.policy
12+
]
13+
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
14+
resource_id = module.document_reference_gateway.gateway_resource_id
15+
http_methods = ["POST"]
16+
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
17+
lambda_environment_variables = {
18+
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
19+
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
20+
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
21+
DOCUMENT_STORE_DYNAMODB_NAME = "${terraform.workspace}_${var.docstore_dynamodb_table_name}"
22+
LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
23+
STAGING_STORE_BUCKET_NAME = "${terraform.workspace}-${var.staging_store_bucket_name}"
24+
DOCUMENT_RETRIEVE_ENDPOINT_APIM = "${local.apim_api_url}/DocumentReference"
25+
PDS_FHIR_IS_STUBBED = local.is_sandbox
26+
WORKSPACE = terraform.workspace
27+
PRESIGNED_ASSUME_ROLE = aws_iam_role.create_post_presign_url_role.arn
28+
}
29+
}

‎infrastructure/lambda-search-document-references-fhir.tf‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,3 @@
1-
resource "aws_api_gateway_method" "get_document_references_fhir" {
2-
count = local.is_production ? 0 : 1
3-
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
4-
resource_id = module.document_reference_gateway.gateway_resource_id
5-
http_method = "GET"
6-
authorization = "NONE"
7-
api_key_required = true
8-
}
9-
10-
111
module "search-document-references-fhir-lambda" {
122
count = local.is_production ? 0 : 1
133
source = "./modules/lambda"

‎infrastructure/modules/firewall_waf_v2/local.tf‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ locals {
22

33
image_regex = "^\\/images(\\/\\w+)+\\/$"
44

5-
waf_rules = [
5+
waf_rules_raw = [
66
{
77
name = "AWSCoreRuleSet"
88
managed_rule_name = "AWSManagedRulesCommonRuleSet"
@@ -47,8 +47,14 @@ locals {
4747
}
4848
]
4949

50+
# Filter out AWSBotControl if var.api is true
51+
waf_rules = [
52+
for rule in local.waf_rules_raw : rule
53+
if !(var.api && rule.name == "AWSBotControl")
54+
]
55+
5056
waf_rules_map = zipmap(
5157
range(0, length(local.waf_rules)),
5258
local.waf_rules
5359
)
54-
}
60+
}

0 commit comments

Comments
 (0)