Skip to content

Commit 7ca4826

Browse files
adamwhitingnhsadamwhitingnhs
committed
[PRMP-166] Add update doc ref lambda and refactor create gateway to use shared doc ref gateway
1 parent d9b46e8 commit 7ca4826

File tree

12 files changed

+163
-22
lines changed

12 files changed

+163
-22
lines changed

‎infrastructure/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@
5151
| <a name="module_create-token-lambda"></a> [create-token-lambda](#module_create-token-lambda) | ./modules/lambda | n/a |
5252
| <a name="module_create_doc_alarm"></a> [create_doc_alarm](#module_create_doc_alarm) | ./modules/lambda_alarms | n/a |
5353
| <a name="module_create_doc_alarm_topic"></a> [create_doc_alarm_topic](#module_create_doc_alarm_topic) | ./modules/sns | n/a |
54-
| <a name="module_create_document_reference_gateway"></a> [create_document_reference_gateway](#module_create_document_reference_gateway) | ./modules/gateway | n/a |
54+
| <a name="module_document_reference_gateway"></a> [document_reference_gateway](#module_document_reference_gateway) | ./modules/gateway | n/a |
5555
| <a name="module_create_token-alarm"></a> [create_token-alarm](#module_create_token-alarm) | ./modules/lambda_alarms | n/a |
5656
| <a name="module_create_token-alarm_topic"></a> [create_token-alarm_topic](#module_create_token-alarm_topic) | ./modules/sns | n/a |
5757
| <a name="module_data-collection-alarm"></a> [data-collection-alarm](#module_data-collection-alarm) | ./modules/lambda_alarms | n/a |

‎infrastructure/api.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,13 +45,13 @@ resource "aws_api_gateway_deployment" "ndr_api_deploy" {
4545
module.back-channel-logout-gateway,
4646
module.back_channel_logout_lambda,
4747
module.create-doc-ref-lambda,
48-
module.create_document_reference_gateway,
4948
module.create-token-gateway,
5049
module.create-token-lambda,
5150
module.delete-doc-ref-gateway,
5251
module.delete-doc-ref-lambda,
5352
module.document-manifest-job-gateway,
5453
module.document-manifest-job-lambda,
54+
module.document_reference_gateway,
5555
module.feature-flags-gateway,
5656
module.feature-flags-lambda,
5757
module.fhir_document_reference_gateway,
@@ -68,6 +68,7 @@ resource "aws_api_gateway_deployment" "ndr_api_deploy" {
6868
module.search-patient-details-lambda,
6969
module.send-feedback-gateway,
7070
module.send-feedback-lambda,
71+
module.update-doc-ref-lambda,
7172
module.update-upload-state-gateway,
7273
module.update-upload-state-lambda,
7374
module.document-status-check-gateway,

‎infrastructure/gateway-document-reference.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,14 @@ module "fhir_document_reference_gateway" {
1010
require_credentials = true
1111
}
1212

13+
module "document_reference_gateway" {
14+
source = "./modules/gateway"
15+
api_gateway_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
16+
parent_id = aws_api_gateway_rest_api.ndr_doc_store_api.root_resource_id
17+
http_methods = ["POST", "PUT"]
18+
authorization = "CUSTOM"
19+
gateway_path = "DocumentReference"
20+
authorizer_id = aws_api_gateway_authorizer.repo_authoriser.id
21+
require_credentials = true
22+
origin = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
23+
}

‎infrastructure/iam.tf‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -243,3 +243,26 @@ resource "aws_api_gateway_account" "logging" {
243243
count = local.is_sandbox ? 0 : 1
244244
cloudwatch_role_arn = aws_iam_role.api_gateway_cloudwatch[0].arn
245245
}
246+
247+
data "aws_iam_policy_document" "assume_role_policy_for_update_lambda" {
248+
statement {
249+
actions = ["sts:AssumeRole"]
250+
251+
principals {
252+
type = "AWS"
253+
identifiers = compact([
254+
module.update-doc-ref-lambda.lambda_execution_role_arn
255+
])
256+
}
257+
}
258+
}
259+
260+
resource "aws_iam_role" "update_put_presign_url_role" {
261+
name = "${terraform.workspace}update_put_presign_url_role"
262+
assume_role_policy = data.aws_iam_policy_document.assume_role_policy_for_update_lambda.json
263+
}
264+
265+
resource "aws_iam_role_policy_attachment" "update_put_presign_url" {
266+
role = aws_iam_role.update_put_presign_url_role.name
267+
policy_arn = aws_iam_policy.s3_document_data_policy_put_only.arn
268+
}

‎infrastructure/lambda-authoriser.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ module "authoriser-alarm" {
4646
module "authoriser-alarm-topic" {
4747
source = "./modules/sns"
4848
sns_encryption_key_id = module.sns_encryption_key.id
49-
topic_name = "create_doc-alarms-topic"
49+
topic_name = "authoriser-alarms-topic"
5050
topic_protocol = "lambda"
5151
topic_endpoint = module.authoriser-lambda.lambda_arn
5252
delivery_policy = jsonencode({

‎infrastructure/lambda-create-doc-ref.tf‎

Lines changed: 2 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,3 @@
1-
module "create_document_reference_gateway" {
2-
source = "./modules/gateway"
3-
api_gateway_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
4-
parent_id = aws_api_gateway_rest_api.ndr_doc_store_api.root_resource_id
5-
http_methods = ["POST"]
6-
authorization = "CUSTOM"
7-
gateway_path = "CreateDocumentReference"
8-
authorizer_id = aws_api_gateway_authorizer.repo_authoriser.id
9-
require_credentials = true
10-
origin = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
11-
}
12-
131
module "create_doc_alarm" {
142
source = "./modules/lambda_alarms"
153
lambda_function_name = module.create-doc-ref-lambda.function_name
@@ -73,7 +61,7 @@ module "create-doc-ref-lambda" {
7361
]
7462
kms_deletion_window = var.kms_deletion_window
7563
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
76-
resource_id = module.create_document_reference_gateway.gateway_resource_id
64+
resource_id = module.document_reference_gateway.gateway_resource_id
7765
http_methods = ["POST"]
7866
memory_size = 512
7967

@@ -92,7 +80,7 @@ module "create-doc-ref-lambda" {
9280
PRESIGNED_ASSUME_ROLE = aws_iam_role.create_post_presign_url_role.arn
9381
}
9482
depends_on = [
95-
module.create_document_reference_gateway,
83+
module.document_reference_gateway,
9684
aws_api_gateway_rest_api.ndr_doc_store_api,
9785
module.document_reference_dynamodb_table,
9886
module.lloyd_george_reference_dynamodb_table,

‎infrastructure/lambda-update-doc-ref.tf‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
module "update_doc_alarm" {
2+
source = "./modules/lambda_alarms"
3+
lambda_function_name = module.update-doc-ref-lambda.function_name
4+
lambda_timeout = module.update-doc-ref-lambda.timeout
5+
lambda_name = "update_document_reference_handler"
6+
namespace = "AWS/Lambda"
7+
alarm_actions = [module.update_doc_alarm_topic.arn]
8+
ok_actions = [module.update_doc_alarm_topic.arn]
9+
depends_on = [module.update-doc-ref-lambda, module.update_doc_alarm_topic]
10+
}
11+
12+
13+
module "update_doc_alarm_topic" {
14+
source = "./modules/sns"
15+
sns_encryption_key_id = module.sns_encryption_key.id
16+
topic_name = "update_doc-alarms-topic"
17+
topic_protocol = "lambda"
18+
topic_endpoint = module.update-doc-ref-lambda.lambda_arn
19+
depends_on = [module.sns_encryption_key]
20+
delivery_policy = jsonencode({
21+
"Version" : "2012-10-17",
22+
"Statement" : [
23+
{
24+
"Effect" : "Allow",
25+
"Principal" : {
26+
"Service" : "cloudwatch.amazonaws.com"
27+
},
28+
"Action" : [
29+
"SNS:Publish",
30+
],
31+
"Condition" : {
32+
"ArnLike" : {
33+
"aws:SourceArn" : "arn:aws:cloudwatch:eu-west-2:${data.aws_caller_identity.current.account_id}:alarm:*"
34+
}
35+
}
36+
"Resource" : "*"
37+
}
38+
]
39+
})
40+
}
41+
42+
module "update-doc-ref-lambda" {
43+
source = "./modules/lambda"
44+
name = "UpdateDocRefLambda"
45+
handler = "handlers.update_document_reference_handler.lambda_handler"
46+
iam_role_policy_documents = [
47+
module.ndr-bulk-staging-store.s3_read_policy_document,
48+
module.ndr-bulk-staging-store.s3_write_policy_document,
49+
module.ndr-lloyd-george-store.s3_write_policy_document,
50+
module.ndr-lloyd-george-store.s3_read_policy_document,
51+
module.ndr-document-store.s3_read_policy_document,
52+
module.ndr-document-store.s3_write_policy_document,
53+
module.document_reference_dynamodb_table.dynamodb_write_policy_document,
54+
module.document_reference_dynamodb_table.dynamodb_read_policy_document,
55+
module.stitch_metadata_reference_dynamodb_table.dynamodb_read_policy_document,
56+
module.stitch_metadata_reference_dynamodb_table.dynamodb_write_policy_document,
57+
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
58+
module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
59+
aws_iam_policy.ssm_access_policy.policy,
60+
module.ndr-app-config.app_config_policy,
61+
]
62+
kms_deletion_window = var.kms_deletion_window
63+
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
64+
resource_id = module.document_reference_gateway.gateway_resource_id
65+
http_methods = ["PUT"]
66+
memory_size = 512
67+
68+
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
69+
lambda_environment_variables = {
70+
STAGING_STORE_BUCKET_NAME = "${terraform.workspace}-${var.staging_store_bucket_name}"
71+
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
72+
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
73+
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
74+
DOCUMENT_STORE_BUCKET_NAME = "${terraform.workspace}-${var.docstore_bucket_name}"
75+
DOCUMENT_STORE_DYNAMODB_NAME = "${terraform.workspace}_${var.docstore_dynamodb_table_name}"
76+
LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
77+
STITCH_METADATA_DYNAMODB_NAME = "${terraform.workspace}_${var.stitch_metadata_dynamodb_table_name}"
78+
PDS_FHIR_IS_STUBBED = local.is_sandbox,
79+
WORKSPACE = terraform.workspace
80+
PRESIGNED_ASSUME_ROLE = aws_iam_role.update_put_presign_url_role.arn
81+
}
82+
depends_on = [
83+
module.document_reference_gateway,
84+
aws_api_gateway_rest_api.ndr_doc_store_api,
85+
module.document_reference_dynamodb_table,
86+
module.lloyd_george_reference_dynamodb_table,
87+
module.ndr-bulk-staging-store,
88+
module.ndr-app-config,
89+
module.lloyd_george_reference_dynamodb_table,
90+
module.document_reference_dynamodb_table,
91+
module.stitch_metadata_reference_dynamodb_table
92+
]
93+
}

‎infrastructure/modules/app_config/configurations/dev.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@
1414
},
1515
"lloydGeorgeValidationStrictModeEnabled": {
1616
"name": "lloydGeorgeValidationStrictModeEnabled"
17+
},
18+
"addDocumentEnabled": {
19+
"name": "addDocumentEnabled"
1720
}
1821
},
1922
"values": {
@@ -31,6 +34,9 @@
3134
},
3235
"lloydGeorgeValidationStrictModeEnabled": {
3336
"enabled": "true"
37+
},
38+
"addDocumentEnabled": {
39+
"enabled": "true"
3440
}
3541
},
3642
"version": "1"

‎infrastructure/modules/app_config/configurations/pre-prod.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@
1414
},
1515
"lloydGeorgeValidationStrictModeEnabled": {
1616
"name": "lloydGeorgeValidationStrictModeEnabled"
17+
},
18+
"addDocumentEnabled": {
19+
"name": "addDocumentEnabled"
1720
}
1821
},
1922
"values": {
@@ -31,6 +34,9 @@
3134
},
3235
"lloydGeorgeValidationStrictModeEnabled": {
3336
"enabled": "true"
37+
},
38+
"addDocumentEnabled": {
39+
"enabled": "false"
3440
}
3541
},
3642
"version": "1"

‎infrastructure/modules/app_config/configurations/prod.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@
1414
},
1515
"lloydGeorgeValidationStrictModeEnabled": {
1616
"name": "lloydGeorgeValidationStrictModeEnabled"
17+
},
18+
"addDocumentEnabled": {
19+
"name": "addDocumentEnabled"
1720
}
1821
},
1922
"values": {
@@ -31,6 +34,9 @@
3134
},
3235
"lloydGeorgeValidationStrictModeEnabled": {
3336
"enabled": "true"
37+
},
38+
"addDocumentEnabled": {
39+
"enabled": "false"
3440
}
3541
},
3642
"version": "1"

0 commit comments

Comments
 (0)