Skip to content

Commit 7b96cb5

Browse files
steph-torres-nhssteph-torres-nhs
committed
Merge branch 'main' into PRMP-579
2 parents 66b9e92 + 07623cd commit 7b96cb5

23 files changed

+618
-41
lines changed

‎infrastructure/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@
5151
| <a name="module_create-token-lambda"></a> [create-token-lambda](#module_create-token-lambda) | ./modules/lambda | n/a |
5252
| <a name="module_create_doc_alarm"></a> [create_doc_alarm](#module_create_doc_alarm) | ./modules/lambda_alarms | n/a |
5353
| <a name="module_create_doc_alarm_topic"></a> [create_doc_alarm_topic](#module_create_doc_alarm_topic) | ./modules/sns | n/a |
54-
| <a name="module_create_document_reference_gateway"></a> [create_document_reference_gateway](#module_create_document_reference_gateway) | ./modules/gateway | n/a |
54+
| <a name="module_document_reference_gateway"></a> [document_reference_gateway](#module_document_reference_gateway) | ./modules/gateway | n/a |
5555
| <a name="module_create_token-alarm"></a> [create_token-alarm](#module_create_token-alarm) | ./modules/lambda_alarms | n/a |
5656
| <a name="module_create_token-alarm_topic"></a> [create_token-alarm_topic](#module_create_token-alarm_topic) | ./modules/sns | n/a |
5757
| <a name="module_data-collection-alarm"></a> [data-collection-alarm](#module_data-collection-alarm) | ./modules/lambda_alarms | n/a |

‎infrastructure/api.tf‎

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,11 @@ resource "aws_api_gateway_base_path_mapping" "api_mapping" {
2323
stage_name = var.environment
2424
domain_name = local.api_gateway_full_domain_name
2525

26-
depends_on = [aws_api_gateway_deployment.ndr_api_deploy, aws_api_gateway_rest_api.ndr_doc_store_api]
26+
depends_on = [
27+
aws_api_gateway_deployment.ndr_api_deploy,
28+
aws_api_gateway_rest_api.ndr_doc_store_api,
29+
aws_api_gateway_stage.ndr_api
30+
]
2731
}
2832

2933
resource "aws_api_gateway_resource" "auth_resource" {
@@ -45,13 +49,13 @@ resource "aws_api_gateway_deployment" "ndr_api_deploy" {
4549
module.back-channel-logout-gateway,
4650
module.back_channel_logout_lambda,
4751
module.create-doc-ref-lambda,
48-
module.create_document_reference_gateway,
4952
module.create-token-gateway,
5053
module.create-token-lambda,
5154
module.delete-doc-ref-gateway,
5255
module.delete-doc-ref-lambda,
5356
module.document-manifest-job-gateway,
5457
module.document-manifest-job-lambda,
58+
module.document_reference_gateway,
5559
module.feature-flags-gateway,
5660
module.feature-flags-lambda,
5761
module.fhir_document_reference_gateway,
@@ -68,6 +72,7 @@ resource "aws_api_gateway_deployment" "ndr_api_deploy" {
6872
module.search-patient-details-lambda,
6973
module.send-feedback-gateway,
7074
module.send-feedback-lambda,
75+
module.update_doc_ref_lambda,
7176
module.update-upload-state-gateway,
7277
module.update-upload-state-lambda,
7378
module.document-status-check-gateway,

‎infrastructure/api_mtls.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,8 @@ resource "aws_api_gateway_base_path_mapping" "api_mapping_mtls" {
3535

3636
depends_on = [
3737
aws_api_gateway_deployment.ndr_api_deploy_mtls,
38-
aws_api_gateway_rest_api.ndr_doc_store_api_mtls
38+
aws_api_gateway_rest_api.ndr_doc_store_api_mtls,
39+
aws_api_gateway_stage.ndr_api_mtls
3940
]
4041
}
4142

‎infrastructure/dynamo_db.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,10 @@ module "lloyd_george_reference_dynamodb_table" {
8989
{
9090
name = "CurrentGpOds"
9191
type = "S"
92+
},
93+
{
94+
name = "S3FileKey"
95+
type = "S"
9296
}
9397
]
9498

@@ -107,6 +111,11 @@ module "lloyd_george_reference_dynamodb_table" {
107111
name = "OdsCodeIndex"
108112
hash_key = "CurrentGpOds"
109113
projection_type = "ALL"
114+
},
115+
{
116+
name = "S3FileKeyIndex"
117+
hash_key = "S3FileKey"
118+
projection_type = "ALL"
110119
}
111120
]
112121

‎infrastructure/dynamo_db_review.tf‎

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
module "document_review_dynamodb_table" {
2+
source = "./modules/dynamo_db"
3+
table_name = var.document_review_table_name
4+
hash_key = "ID"
5+
deletion_protection_enabled = local.is_production
6+
stream_enabled = false
7+
ttl_enabled = true
8+
ttl_attribute_name = "TTL"
9+
point_in_time_recovery_enabled = !local.is_sandbox
10+
11+
attributes = [
12+
{
13+
name = "ID"
14+
type = "S"
15+
},
16+
{
17+
name = "Custodian"
18+
type = "S"
19+
},
20+
{
21+
name = "NhsNumber"
22+
type = "S"
23+
},
24+
{
25+
name = "ReviewStatus"
26+
type = "S"
27+
},
28+
{
29+
name = "Author"
30+
type = "S"
31+
},
32+
{
33+
name = "Reviewer"
34+
type = "S"
35+
},
36+
{
37+
name = "ReviewDate"
38+
type = "S"
39+
},
40+
{
41+
name = "UploadDate"
42+
type = "N"
43+
}
44+
45+
]
46+
47+
global_secondary_indexes = [
48+
{
49+
name = "CustodianIndex"
50+
hash_key = "Custodian"
51+
range_key = "UploadDate"
52+
projection_type = "ALL"
53+
54+
},
55+
{
56+
name = "AuthorIndex"
57+
hash_key = "Author"
58+
range_key = "UploadDate"
59+
projection_type = "ALL"
60+
61+
},
62+
{
63+
name = "ReviewStatusIndex"
64+
hash_key = "ReviewStatus"
65+
range_key = "UploadDate"
66+
projection_type = "ALL"
67+
},
68+
{
69+
name = "ReviewerIndex"
70+
hash_key = "Reviewer"
71+
range_key = "ReviewDate"
72+
projection_type = "ALL"
73+
},
74+
{
75+
name = "NhsNumberIndex"
76+
hash_key = "NhsNumber"
77+
range_key = "UploadDate"
78+
projection_type = "ALL"
79+
}
80+
]
81+
82+
environment = var.environment
83+
owner = var.owner
84+
}

‎infrastructure/gateway-document-reference.tf‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,30 @@ module "fhir_document_reference_gateway" {
1010
require_credentials = true
1111
}
1212

13+
module "document_reference_gateway" {
14+
source = "./modules/gateway"
15+
api_gateway_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
16+
parent_id = aws_api_gateway_rest_api.ndr_doc_store_api.root_resource_id
17+
http_methods = ["POST"]
18+
authorization = "CUSTOM"
19+
gateway_path = "DocumentReference"
20+
authorizer_id = aws_api_gateway_authorizer.repo_authoriser.id
21+
require_credentials = true
22+
origin = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
23+
}
24+
25+
module "document_reference_id_gateway" {
26+
source = "./modules/gateway"
27+
api_gateway_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
28+
parent_id = module.document_reference_gateway.gateway_resource_id
29+
http_methods = ["PUT"]
30+
authorization = "CUSTOM"
31+
gateway_path = "{id}"
32+
authorizer_id = aws_api_gateway_authorizer.repo_authoriser.id
33+
require_credentials = true
34+
origin = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
35+
36+
request_parameters = {
37+
"method.request.path.id" = true
38+
}
39+
}

‎infrastructure/iam.tf‎

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ data "aws_iam_policy_document" "assume_role_policy_for_create_lambda" {
2323
type = "AWS"
2424
identifiers = compact([
2525
module.create-doc-ref-lambda.lambda_execution_role_arn,
26-
local.is_production ? null : module.post-document-references-fhir-lambda.lambda_execution_role_arn
26+
module.post-document-references-fhir-lambda.lambda_execution_role_arn
2727
])
2828
}
2929
}
@@ -243,3 +243,26 @@ resource "aws_api_gateway_account" "logging" {
243243
count = local.is_sandbox ? 0 : 1
244244
cloudwatch_role_arn = aws_iam_role.api_gateway_cloudwatch[0].arn
245245
}
246+
247+
data "aws_iam_policy_document" "assume_role_policy_for_update_lambda" {
248+
statement {
249+
actions = ["sts:AssumeRole"]
250+
251+
principals {
252+
type = "AWS"
253+
identifiers = compact([
254+
module.update_doc_ref_lambda.lambda_execution_role_arn
255+
])
256+
}
257+
}
258+
}
259+
260+
resource "aws_iam_role" "update_put_presign_url_role" {
261+
name = "${terraform.workspace}_update_put_presign_url_role"
262+
assume_role_policy = data.aws_iam_policy_document.assume_role_policy_for_update_lambda.json
263+
}
264+
265+
resource "aws_iam_role_policy_attachment" "update_put_presign_url" {
266+
role = aws_iam_role.update_put_presign_url_role.name
267+
policy_arn = aws_iam_policy.s3_document_data_policy_put_only.arn
268+
}

‎infrastructure/lambda-authoriser.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ module "authoriser-alarm" {
4646
module "authoriser-alarm-topic" {
4747
source = "./modules/sns"
4848
sns_encryption_key_id = module.sns_encryption_key.id
49-
topic_name = "create_doc-alarms-topic"
49+
topic_name = "authoriser-alarms-topic"
5050
topic_protocol = "lambda"
5151
topic_endpoint = module.authoriser-lambda.lambda_arn
5252
delivery_policy = jsonencode({

‎infrastructure/lambda-bulk-upload-metadata-processor.tf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,3 +72,26 @@ module "bulk-upload-metadata-processor-alarm-topic" {
7272

7373
depends_on = [module.bulk-upload-metadata-processor-lambda, module.sns_encryption_key]
7474
}
75+
76+
resource "aws_lambda_permission" "bulk_upload_metadata_processor_lambda" {
77+
statement_id = "AllowS3Invoke"
78+
action = "lambda:InvokeFunction"
79+
function_name = module.bulk-upload-metadata-processor-lambda.function_name
80+
principal = "s3.amazonaws.com"
81+
source_arn = module.ndr-bulk-staging-store.bucket_arn
82+
}
83+
84+
resource "aws_s3_bucket_notification" "bulk_upload_metadata_processor_lambda_trigger" {
85+
bucket = module.ndr-bulk-staging-store.bucket_id
86+
87+
lambda_function {
88+
lambda_function_arn = module.bulk-upload-metadata-processor-lambda.lambda_arn
89+
events = ["s3:ObjectCreated:*"]
90+
filter_prefix = "expedite/"
91+
filter_suffix = ".pdf"
92+
}
93+
94+
depends_on = [
95+
aws_lambda_permission.bulk_upload_metadata_processor_lambda
96+
]
97+
}

‎infrastructure/lambda-create-doc-ref.tf‎

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,3 @@
1-
module "create_document_reference_gateway" {
2-
source = "./modules/gateway"
3-
api_gateway_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
4-
parent_id = aws_api_gateway_rest_api.ndr_doc_store_api.root_resource_id
5-
http_methods = ["POST"]
6-
authorization = "CUSTOM"
7-
gateway_path = "CreateDocumentReference"
8-
authorizer_id = aws_api_gateway_authorizer.repo_authoriser.id
9-
require_credentials = true
10-
origin = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
11-
}
12-
131
module "create_doc_alarm" {
142
source = "./modules/lambda_alarms"
153
lambda_function_name = module.create-doc-ref-lambda.function_name
@@ -73,7 +61,7 @@ module "create-doc-ref-lambda" {
7361
]
7462
kms_deletion_window = var.kms_deletion_window
7563
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
76-
resource_id = module.create_document_reference_gateway.gateway_resource_id
64+
resource_id = module.document_reference_gateway.gateway_resource_id
7765
http_methods = ["POST"]
7866
memory_size = 512
7967

@@ -92,7 +80,7 @@ module "create-doc-ref-lambda" {
9280
PRESIGNED_ASSUME_ROLE = aws_iam_role.create_post_presign_url_role.arn
9381
}
9482
depends_on = [
95-
module.create_document_reference_gateway,
83+
module.document_reference_gateway,
9684
aws_api_gateway_rest_api.ndr_doc_store_api,
9785
module.document_reference_dynamodb_table,
9886
module.lloyd_george_reference_dynamodb_table,

0 commit comments

Comments
 (0)