Skip to content

Commit 839ebe9

Browse files
jameslinnelljameslinnell
authored
[NDR-196] Manage AWS KMS resources into IaC for Lambdas (#388)
* Add KMS to Lambda * KMS deletion time * set kms_deletion_window for lambdas * Remove script output * Allow root access to KMS * Add account id to lambda module * Add caller identity data to the lambda module * Remove requirement for account id as attricute of lambda * Update resource naming * resource id * Change resource name * Fix name change
1 parent a866b9c commit 839ebe9

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

47 files changed

+274
-127
lines changed

‎infrastructure/dev.tfvars‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,3 +10,5 @@ standalone_vpc_ig_tag = "ndr-dev"
1010
cloud_security_email_param_environment = "dev"
1111

1212
apim_environment = "internal-dev."
13+
14+
kms_deletion_window = 7

‎infrastructure/kms_sns.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,4 +5,5 @@ module "sns_encryption_key" {
55
environment = var.environment
66
owner = var.owner
77
service_identifiers = ["sns.amazonaws.com", "cloudwatch.amazonaws.com"]
8+
kms_deletion_window = var.kms_deletion_window
89
}

‎infrastructure/lambda-access-audit.tf‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -61,9 +61,10 @@ module "access-audit-lambda" {
6161
module.auth_session_dynamodb_table.dynamodb_read_policy_document,
6262
module.access_audit_dynamodb_table.dynamodb_write_policy_document
6363
]
64-
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
65-
resource_id = module.access-audit-gateway.gateway_resource_id
66-
http_methods = ["POST"]
64+
kms_deletion_window = var.kms_deletion_window
65+
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
66+
resource_id = module.access-audit-gateway.gateway_resource_id
67+
http_methods = ["POST"]
6768

6869
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
6970
lambda_environment_variables = {

‎infrastructure/lambda-authoriser.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,9 @@ module "authoriser-lambda" {
88
module.auth_session_dynamodb_table.dynamodb_write_policy_document,
99
module.ndr-app-config.app_config_policy
1010
]
11-
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
12-
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
11+
kms_deletion_window = var.kms_deletion_window
12+
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
13+
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
1314
lambda_environment_variables = {
1415
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
1516
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id

‎infrastructure/lambda-back-channel-logout.tf‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,11 @@ module "back_channel_logout_lambda" {
1919
module.auth_session_dynamodb_table.dynamodb_write_policy_document,
2020
module.ndr-app-config.app_config_policy
2121
]
22-
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
23-
resource_id = module.back-channel-logout-gateway.gateway_resource_id
24-
http_methods = ["POST"]
25-
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
22+
kms_deletion_window = var.kms_deletion_window
23+
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
24+
resource_id = module.back-channel-logout-gateway.gateway_resource_id
25+
http_methods = ["POST"]
26+
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
2627
lambda_environment_variables = {
2728
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
2829
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id

‎infrastructure/lambda-bulk-upload-metadata-preprocessor.tf‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,9 @@ module "bulk_upload_metadata_preprocessor_lambda" {
88
module.ndr-bulk-staging-store.s3_write_policy_document,
99
module.ndr-app-config.app_config_policy
1010
]
11-
rest_api_id = null
12-
api_execution_arn = null
11+
kms_deletion_window = var.kms_deletion_window
12+
rest_api_id = null
13+
api_execution_arn = null
1314

1415
lambda_environment_variables = {
1516
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
@@ -24,4 +25,5 @@ module "bulk_upload_metadata_preprocessor_lambda" {
2425
lambda_timeout = 900
2526
memory_size = 1769
2627
reserved_concurrent_executions = local.bulk_upload_lambda_concurrent_limit
27-
}
28+
}
29+

‎infrastructure/lambda-bulk-upload-metadata.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,9 @@ module "bulk-upload-metadata-lambda" {
1212
module.ndr-app-config.app_config_policy
1313
]
1414

15-
rest_api_id = null
16-
api_execution_arn = null
15+
kms_deletion_window = var.kms_deletion_window
16+
rest_api_id = null
17+
api_execution_arn = null
1718

1819
lambda_environment_variables = {
1920
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id

‎infrastructure/lambda-bulk-upload-report.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,9 @@ module "bulk-upload-report-lambda" {
1212
aws_iam_policy.dynamodb_policy_scan_bulk_report.policy,
1313
module.ndr-app-config.app_config_policy
1414
]
15-
rest_api_id = null
16-
api_execution_arn = null
15+
kms_deletion_window = var.kms_deletion_window
16+
rest_api_id = null
17+
api_execution_arn = null
1718

1819
lambda_environment_variables = {
1920
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id

‎infrastructure/lambda-bulk-upload.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,8 +20,9 @@ module "bulk-upload-lambda" {
2020
aws_iam_policy.ssm_access_policy.policy,
2121
module.ndr-app-config.app_config_policy
2222
]
23-
rest_api_id = null
24-
api_execution_arn = null
23+
kms_deletion_window = var.kms_deletion_window
24+
rest_api_id = null
25+
api_execution_arn = null
2526

2627
lambda_environment_variables = {
2728
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id

‎infrastructure/lambda-create-doc-ref.tf‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -71,10 +71,11 @@ module "create-doc-ref-lambda" {
7171
aws_iam_policy.ssm_access_policy.policy,
7272
module.ndr-app-config.app_config_policy,
7373
]
74-
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
75-
resource_id = module.create_document_reference_gateway.gateway_resource_id
76-
http_methods = ["POST"]
77-
memory_size = 512
74+
kms_deletion_window = var.kms_deletion_window
75+
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
76+
resource_id = module.create_document_reference_gateway.gateway_resource_id
77+
http_methods = ["POST"]
78+
memory_size = 512
7879

7980
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
8081
lambda_environment_variables = {

0 commit comments

Comments
 (0)