Skip to content

Commit 8fdbeaf

Browse files
MohammadIqbalAD-NHSMohammadIqbalAD-NHS
authored
Merge branch 'main' into PRMT-17
2 parents 0e5d093 + 3007caf commit 8fdbeaf

24 files changed

+111
-87
lines changed

‎.github/workflows/terraform-destroy-test-environments-cron.yml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,22 @@ jobs:
7979
working-directory: ./infrastructure
8080
shell: bash
8181

82+
- name: Pre-cleanup AWS Backup Recovery Points
83+
run: |
84+
RECOVERY_POINTS=$(aws backup list-recovery-points-by-backup-vault \
85+
--backup-vault-name ${{ matrix.sandbox-name }}_backup_vault \
86+
--region eu-west-2 \
87+
--query 'RecoveryPoints[*].RecoveryPointArn' \
88+
--output text)
89+
90+
for ARN in $RECOVERY_POINTS; do
91+
echo "Deleting recovery point: $ARN"
92+
aws backup delete-recovery-point \
93+
--backup-vault-name ${{ matrix.sandbox-name }}_backup_vault \
94+
--recovery-point-arn $ARN \
95+
--region eu-west-2
96+
done
97+
8298
- name: Terraform Destroy
8399
id: destroy
84100
run: terraform destroy -auto-approve -var-file="${{ vars.TF_VARS_FILE }}"

‎bootstrap/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
| Name | Version |
1111
|------|---------|
12-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.70.0 |
12+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.0 |
1313

1414
## Modules
1515

‎infrastructure/README.md‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88

99
| Name | Version |
1010
|------|---------|
11-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.86.1 |
11+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.95.0 |
1212

1313
## Modules
1414

@@ -39,8 +39,9 @@
3939
| <a name="module_bulk-upload-report-alarm-topic"></a> [bulk-upload-report-alarm-topic](#module\_bulk-upload-report-alarm-topic) | ./modules/sns | n/a |
4040
| <a name="module_bulk-upload-report-lambda"></a> [bulk-upload-report-lambda](#module\_bulk-upload-report-lambda) | ./modules/lambda | n/a |
4141
| <a name="module_bulk_upload_report_dynamodb_table"></a> [bulk\_upload\_report\_dynamodb\_table](#module\_bulk\_upload\_report\_dynamodb\_table) | ./modules/dynamo_db | n/a |
42-
| <a name="module_cloudfront-distribution-lg"></a> [cloudfront-distribution-lg](#module\_cloudfront-distribution-lg) | ./modules/cloudfront/ | n/a |
42+
| <a name="module_cloudfront-distribution-lg"></a> [cloudfront-distribution-lg](#module\_cloudfront-distribution-lg) | ./modules/cloudfront | n/a |
4343
| <a name="module_cloudfront_edge_dynamodb_table"></a> [cloudfront\_edge\_dynamodb\_table](#module\_cloudfront\_edge\_dynamodb\_table) | ./modules/dynamo_db | n/a |
44+
| <a name="module_cloudfront_firewall_waf_v2"></a> [cloudfront\_firewall\_waf\_v2](#module\_cloudfront\_firewall\_waf\_v2) | ./modules/firewall_waf_v2 | n/a |
4445
| <a name="module_create-doc-ref-gateway"></a> [create-doc-ref-gateway](#module\_create-doc-ref-gateway) | ./modules/gateway | n/a |
4546
| <a name="module_create-doc-ref-lambda"></a> [create-doc-ref-lambda](#module\_create-doc-ref-lambda) | ./modules/lambda | n/a |
4647
| <a name="module_create-token-gateway"></a> [create-token-gateway](#module\_create-token-gateway) | ./modules/gateway | n/a |
@@ -224,6 +225,8 @@
224225
| [aws_cloudwatch_metric_alarm.stitching_dlq_new_messages](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm) | resource |
225226
| [aws_cognito_identity_pool.cloudwatch_rum](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_identity_pool) | resource |
226227
| [aws_cognito_identity_pool_roles_attachment.cloudwatch_rum](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cognito_identity_pool_roles_attachment) | resource |
228+
| [aws_default_security_group.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_security_group) | resource |
229+
| [aws_default_vpc.default](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/default_vpc) | resource |
227230
| [aws_iam_policy.cloudwatch_log_query_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
228231
| [aws_iam_policy.cloudwatch_rum_cognito_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
229232
| [aws_iam_policy.copy_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
@@ -240,9 +243,7 @@
240243
| [aws_iam_policy.s3_document_data_policy_put_only](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
241244
| [aws_iam_policy.ses_send_email_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
242245
| [aws_iam_policy.ssm_access_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
243-
| [aws_iam_policy.ssm_policy_authoriser](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
244-
| [aws_iam_policy.ssm_policy_oidc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
245-
| [aws_iam_policy.ssm_policy_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
246+
| [aws_iam_policy.ssm_access_policy_authoriser](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
246247
| [aws_iam_role.cognito_unauthenticated](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
247248
| [aws_iam_role.create_post_presign_url_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
248249
| [aws_iam_role.cross_account_backup_iam_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |

‎infrastructure/cloudfront.tf‎

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,18 @@
1+
module "cloudfront_firewall_waf_v2" {
2+
source = "./modules/firewall_waf_v2"
3+
cloudfront_acl = true
4+
5+
environment = var.environment
6+
owner = var.owner
7+
count = local.is_sandbox ? 0 : 1
8+
providers = { aws = aws.us_east_1 }
9+
}
10+
111
module "cloudfront-distribution-lg" {
2-
source = "./modules/cloudfront/"
12+
source = "./modules/cloudfront"
313
bucket_domain_name = "${terraform.workspace}-${var.lloyd_george_bucket_name}.s3.eu-west-2.amazonaws.com"
414
bucket_id = module.ndr-lloyd-george-store.bucket_id
515
qualifed_arn = module.edge-presign-lambda.qualified_arn
616
depends_on = [module.edge-presign-lambda.qualified_arn, module.ndr-lloyd-george-store.bucket_id, module.ndr-lloyd-george-store.bucket_domain_name]
7-
}
17+
web_acl_id = try(module.cloudfront_firewall_waf_v2[0].arn, "")
18+
}

‎infrastructure/firewall.tf‎

Lines changed: 8 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,18 @@
11
module "firewall_waf_v2" {
2-
source = "./modules/firewall_waf_v2"
3-
4-
environment = var.environment
5-
owner = var.owner
6-
count = (terraform.workspace == "ndra" ||
7-
terraform.workspace == "ndrb" ||
8-
terraform.workspace == "ndrc" ||
9-
terraform.workspace == "ndrd") ? 0 : 1
2+
source = "./modules/firewall_waf_v2"
3+
cloudfront_acl = false
4+
environment = var.environment
5+
owner = var.owner
6+
count = local.is_sandbox ? 0 : 1
107
}
118

129
resource "aws_wafv2_web_acl_association" "web_acl_association" {
1310
resource_arn = module.ndr-ecs-fargate-app.load_balancer_arn
1411
web_acl_arn = module.firewall_waf_v2[0].arn
15-
16-
count = (terraform.workspace == "ndra" ||
17-
terraform.workspace == "ndrb" ||
18-
terraform.workspace == "ndrc" ||
19-
terraform.workspace == "ndrd") ? 0 : 1
12+
count = local.is_sandbox ? 0 : 1
2013
depends_on = [
2114
module.ndr-ecs-fargate-app,
2215
module.firewall_waf_v2[0]
2316
]
24-
}
17+
}
18+

‎infrastructure/iam.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ resource "aws_iam_policy" "s3_document_data_policy_for_stitch_lambda" {
4646
"Effect" : "Allow",
4747
"Action" : [
4848
"s3:GetObject",
49+
"S3:ListBucket",
4950
],
5051
"Resource" : ["${module.ndr-lloyd-george-store.bucket_arn}/combined_files/*"]
5152
}
@@ -188,4 +189,3 @@ resource "aws_iam_role_policy_attachment" "ods_report_presign_url" {
188189
role = aws_iam_role.ods_report_presign_url_role.name
189190
policy_arn = aws_iam_policy.s3_document_data_policy_for_ods_report_lambda.arn
190191
}
191-

‎infrastructure/lambda-authoriser.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ module "authoriser-lambda" {
33
name = "AuthoriserLambda"
44
handler = "handlers.authoriser_handler.lambda_handler"
55
iam_role_policy_documents = [
6-
aws_iam_policy.ssm_policy_authoriser.policy,
6+
aws_iam_policy.ssm_access_policy_authoriser.policy,
77
module.auth_session_dynamodb_table.dynamodb_read_policy_document,
88
module.auth_session_dynamodb_table.dynamodb_write_policy_document,
99
module.ndr-app-config.app_config_policy
@@ -23,7 +23,7 @@ module "authoriser-lambda" {
2323
is_invoked_from_gateway = true
2424

2525
depends_on = [
26-
aws_iam_policy.ssm_policy_authoriser,
26+
aws_iam_policy.ssm_access_policy_authoriser,
2727
module.auth_session_dynamodb_table,
2828
aws_api_gateway_rest_api.ndr_doc_store_api,
2929
module.ndr-app-config
@@ -82,7 +82,7 @@ resource "aws_api_gateway_authorizer" "repo_authoriser" {
8282
authorizer_result_ttl_in_seconds = 0
8383
}
8484

85-
resource "aws_iam_policy" "ssm_policy_authoriser" {
85+
resource "aws_iam_policy" "ssm_access_policy_authoriser" {
8686
name = "${terraform.workspace}_ssm_public_token_policy"
8787
policy = jsonencode({
8888
Version = "2012-10-17",

‎infrastructure/lambda-back-channel-logout.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ module "back_channel_logout_lambda" {
2424
name = "BackChannelLogoutHandler"
2525
handler = "handlers.back_channel_logout_handler.lambda_handler"
2626
iam_role_policy_documents = [
27-
aws_iam_policy.ssm_policy_oidc.policy,
27+
aws_iam_policy.ssm_access_policy.policy,
2828
module.auth_session_dynamodb_table.dynamodb_read_policy_document,
2929
module.auth_session_dynamodb_table.dynamodb_write_policy_document,
3030
module.ndr-app-config.app_config_policy
@@ -45,7 +45,7 @@ module "back_channel_logout_lambda" {
4545
}
4646
depends_on = [
4747
aws_api_gateway_rest_api.ndr_doc_store_api,
48-
aws_iam_policy.ssm_policy_oidc,
48+
aws_iam_policy.ssm_access_policy,
4949
module.auth_session_dynamodb_table,
5050
module.back-channel-logout-gateway,
5151
module.ndr-app-config

‎infrastructure/lambda-edge-presign.tf‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,8 +73,7 @@ module "edge-presign-lambda" {
7373
handler = "handlers.edge_presign_handler.lambda_handler"
7474
iam_role_policies = [
7575
"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
76-
aws_iam_policy.ssm_policy_oidc.arn,
77-
module.auth_state_dynamodb_table.dynamodb_policy,
76+
aws_iam_policy.ssm_access_policy.arn,
7877
module.ndr-app-config.app_config_policy_arn
7978
]
8079
providers = {

‎infrastructure/lambda-lloyd-george-record-stitch.tf‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,7 +73,8 @@ module "lloyd-george-stitch-lambda" {
7373
module.stitch_metadata_reference_dynamodb_table.dynamodb_read_policy_document,
7474
module.stitch_metadata_reference_dynamodb_table.dynamodb_write_policy_document,
7575
module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
76-
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document
76+
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
77+
module.cloudfront_edge_dynamodb_table.dynamodb_write_policy_document
7778
]
7879
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
7980
resource_id = module.lloyd-george-stitch-gateway.gateway_resource_id
@@ -91,6 +92,7 @@ module "lloyd-george-stitch-lambda" {
9192
SPLUNK_SQS_QUEUE_URL = try(module.sqs-splunk-queue[0].sqs_url, null)
9293
WORKSPACE = terraform.workspace
9394
PRESIGNED_ASSUME_ROLE = aws_iam_role.stitch_presign_url_role.arn
95+
EDGE_REFERENCE_TABLE = module.cloudfront_edge_dynamodb_table.table_name
9496
}
9597
depends_on = [
9698
aws_api_gateway_rest_api.ndr_doc_store_api,

0 commit comments

Comments
 (0)