Skip to content

Commit 8382b18

Browse files
oliverbeumkes-nhsoliverbeumkes-nhs
authored
Merge branch 'main' into PRM-156
2 parents 1dd1313 + e08e123 commit 8382b18

File tree

14 files changed

+42
-68
lines changed

14 files changed

+42
-68
lines changed

‎bootstrap/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
| Name | Version |
1111
|------|---------|
12-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.70.0 |
12+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.0 |
1313

1414
## Modules
1515

‎infrastructure/README.md‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -224,6 +224,8 @@
224224
| [aws_cloudwatch_metric_alarm.stitching_dlq_new_messages](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm) | resource |
225225
| [aws_cognito_identity_pool.cloudwatch_rum](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_identity_pool) | resource |
226226
| [aws_cognito_identity_pool_roles_attachment.cloudwatch_rum](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_identity_pool_roles_attachment) | resource |
227+
| [aws_default_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_security_group) | resource |
228+
| [aws_default_vpc.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_vpc) | resource |
227229
| [aws_iam_policy.cloudwatch_log_query_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
228230
| [aws_iam_policy.cloudwatch_rum_cognito_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
229231
| [aws_iam_policy.copy_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
@@ -240,9 +242,7 @@
240242
| [aws_iam_policy.s3_document_data_policy_put_only](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
241243
| [aws_iam_policy.ses_send_email_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
242244
| [aws_iam_policy.ssm_access_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
243-
| [aws_iam_policy.ssm_policy_authoriser](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
244-
| [aws_iam_policy.ssm_policy_oidc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
245-
| [aws_iam_policy.ssm_policy_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
245+
| [aws_iam_policy.ssm_access_policy_authoriser](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
246246
| [aws_iam_role.cognito_unauthenticated](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
247247
| [aws_iam_role.create_post_presign_url_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
248248
| [aws_iam_role.cross_account_backup_iam_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |

‎infrastructure/firewall.tf‎

Lines changed: 3 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,14 @@
11
module "firewall_waf_v2" {
2-
source = "./modules/firewall_waf_v2"
3-
2+
source = "./modules/firewall_waf_v2"
43
environment = var.environment
54
owner = var.owner
6-
count = (terraform.workspace == "ndra" ||
7-
terraform.workspace == "ndrb" ||
8-
terraform.workspace == "ndrc" ||
9-
terraform.workspace == "ndrd") ? 0 : 1
5+
count = local.is_sandbox ? 0 : 1
106
}
117

128
resource "aws_wafv2_web_acl_association" "web_acl_association" {
139
resource_arn = module.ndr-ecs-fargate-app.load_balancer_arn
1410
web_acl_arn = module.firewall_waf_v2[0].arn
15-
16-
count = (terraform.workspace == "ndra" ||
17-
terraform.workspace == "ndrb" ||
18-
terraform.workspace == "ndrc" ||
19-
terraform.workspace == "ndrd") ? 0 : 1
11+
count = local.is_sandbox ? 0 : 1
2012
depends_on = [
2113
module.ndr-ecs-fargate-app,
2214
module.firewall_waf_v2[0]

‎infrastructure/iam.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ resource "aws_iam_policy" "s3_document_data_policy_for_stitch_lambda" {
4646
"Effect" : "Allow",
4747
"Action" : [
4848
"s3:GetObject",
49+
"S3:ListBucket",
4950
],
5051
"Resource" : ["${module.ndr-lloyd-george-store.bucket_arn}/combined_files/*"]
5152
}
@@ -188,4 +189,3 @@ resource "aws_iam_role_policy_attachment" "ods_report_presign_url" {
188189
role = aws_iam_role.ods_report_presign_url_role.name
189190
policy_arn = aws_iam_policy.s3_document_data_policy_for_ods_report_lambda.arn
190191
}
191-

‎infrastructure/lambda-authoriser.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ module "authoriser-lambda" {
33
name = "AuthoriserLambda"
44
handler = "handlers.authoriser_handler.lambda_handler"
55
iam_role_policy_documents = [
6-
aws_iam_policy.ssm_policy_authoriser.policy,
6+
aws_iam_policy.ssm_access_policy_authoriser.policy,
77
module.auth_session_dynamodb_table.dynamodb_read_policy_document,
88
module.auth_session_dynamodb_table.dynamodb_write_policy_document,
99
module.ndr-app-config.app_config_policy
@@ -23,7 +23,7 @@ module "authoriser-lambda" {
2323
is_invoked_from_gateway = true
2424

2525
depends_on = [
26-
aws_iam_policy.ssm_policy_authoriser,
26+
aws_iam_policy.ssm_access_policy_authoriser,
2727
module.auth_session_dynamodb_table,
2828
aws_api_gateway_rest_api.ndr_doc_store_api,
2929
module.ndr-app-config
@@ -82,7 +82,7 @@ resource "aws_api_gateway_authorizer" "repo_authoriser" {
8282
authorizer_result_ttl_in_seconds = 0
8383
}
8484

85-
resource "aws_iam_policy" "ssm_policy_authoriser" {
85+
resource "aws_iam_policy" "ssm_access_policy_authoriser" {
8686
name = "${terraform.workspace}_ssm_public_token_policy"
8787
policy = jsonencode({
8888
Version = "2012-10-17",

‎infrastructure/lambda-back-channel-logout.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ module "back_channel_logout_lambda" {
2424
name = "BackChannelLogoutHandler"
2525
handler = "handlers.back_channel_logout_handler.lambda_handler"
2626
iam_role_policy_documents = [
27-
aws_iam_policy.ssm_policy_oidc.policy,
27+
aws_iam_policy.ssm_access_policy.policy,
2828
module.auth_session_dynamodb_table.dynamodb_read_policy_document,
2929
module.auth_session_dynamodb_table.dynamodb_write_policy_document,
3030
module.ndr-app-config.app_config_policy
@@ -45,7 +45,7 @@ module "back_channel_logout_lambda" {
4545
}
4646
depends_on = [
4747
aws_api_gateway_rest_api.ndr_doc_store_api,
48-
aws_iam_policy.ssm_policy_oidc,
48+
aws_iam_policy.ssm_access_policy,
4949
module.auth_session_dynamodb_table,
5050
module.back-channel-logout-gateway,
5151
module.ndr-app-config

‎infrastructure/lambda-edge-presign.tf‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,8 +73,7 @@ module "edge-presign-lambda" {
7373
handler = "handlers.edge_presign_handler.lambda_handler"
7474
iam_role_policies = [
7575
"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
76-
aws_iam_policy.ssm_policy_oidc.arn,
77-
module.auth_state_dynamodb_table.dynamodb_policy,
76+
aws_iam_policy.ssm_access_policy.arn,
7877
module.ndr-app-config.app_config_policy_arn
7978
]
8079
providers = {

‎infrastructure/lambda-lloyd-george-record-stitch.tf‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,8 @@ module "lloyd-george-stitch-lambda" {
7373
module.stitch_metadata_reference_dynamodb_table.dynamodb_read_policy_document,
7474
module.stitch_metadata_reference_dynamodb_table.dynamodb_write_policy_document,
7575
module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
76-
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document
76+
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
77+
module.cloudfront_edge_dynamodb_table.dynamodb_write_policy_document
7778
]
7879
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
7980
resource_id = module.lloyd-george-stitch-gateway.gateway_resource_id
@@ -91,6 +92,7 @@ module "lloyd-george-stitch-lambda" {
9192
SPLUNK_SQS_QUEUE_URL = try(module.sqs-splunk-queue[0].sqs_url, null)
9293
WORKSPACE = terraform.workspace
9394
PRESIGNED_ASSUME_ROLE = aws_iam_role.stitch_presign_url_role.arn
95+
EDGE_REFERENCE_TABLE = module.cloudfront_edge_dynamodb_table.table_name
9496
}
9597
depends_on = [
9698
aws_api_gateway_rest_api.ndr_doc_store_api,

‎infrastructure/lambda-login-redirect.tf‎

Lines changed: 2 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ module "login_redirect_lambda" {
2020
name = "LoginRedirectHandler"
2121
handler = "handlers.login_redirect_handler.lambda_handler"
2222
iam_role_policy_documents = [
23-
aws_iam_policy.ssm_policy_oidc.policy,
23+
aws_iam_policy.ssm_access_policy.policy,
2424
module.auth_state_dynamodb_table.dynamodb_read_policy_document,
2525
module.auth_state_dynamodb_table.dynamodb_write_policy_document,
2626
module.ndr-app-config.app_config_policy
@@ -40,7 +40,7 @@ module "login_redirect_lambda" {
4040
depends_on = [
4141
aws_api_gateway_rest_api.ndr_doc_store_api,
4242
aws_api_gateway_resource.login_resource,
43-
aws_iam_policy.ssm_policy_oidc,
43+
aws_iam_policy.ssm_access_policy,
4444
module.auth_state_dynamodb_table,
4545
module.ndr-app-config
4646
]
@@ -89,22 +89,3 @@ module "login_redirect-alarm_topic" {
8989
depends_on = [module.login_redirect_lambda, module.sns_encryption_key]
9090
}
9191

92-
resource "aws_iam_policy" "ssm_policy_oidc" {
93-
name = "${terraform.workspace}_ssm_oidc_policy"
94-
policy = jsonencode({
95-
Version = "2012-10-17",
96-
Statement = [
97-
{
98-
Effect = "Allow",
99-
Action = [
100-
"ssm:GetParameters",
101-
"ssm:GetParameter",
102-
"ssm:GetParametersByPath"
103-
],
104-
Resource = [
105-
"arn:aws:ssm:*:*:parameter/*",
106-
]
107-
}
108-
]
109-
})
110-
}

‎infrastructure/lambda-logout.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ module "logout_lambda" {
2323
name = "LogoutHandler"
2424
handler = "handlers.logout_handler.lambda_handler"
2525
iam_role_policy_documents = [
26-
aws_iam_policy.ssm_policy_oidc.policy,
26+
aws_iam_policy.ssm_access_policy.policy,
2727
module.auth_session_dynamodb_table.dynamodb_read_policy_document,
2828
module.auth_session_dynamodb_table.dynamodb_write_policy_document,
2929
module.ndr-app-config.app_config_policy
@@ -42,7 +42,7 @@ module "logout_lambda" {
4242
}
4343
depends_on = [
4444
aws_api_gateway_rest_api.ndr_doc_store_api,
45-
aws_iam_policy.ssm_policy_oidc,
45+
aws_iam_policy.ssm_access_policy,
4646
module.auth_session_dynamodb_table,
4747
module.logout-gateway,
4848
module.ndr-app-config

0 commit comments

Comments
 (0)