Skip to content

Commit 9ce08e4

Browse files
committed
Merge branch 'main' into PRMP-588
# Conflicts: # infrastructure/lambda-document-review-processor.tf
2 parents e23be34 + 631f905 commit 9ce08e4

19 files changed

+188
-32
lines changed

.github/workflows/automated-deploy-dev.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -222,15 +222,19 @@ jobs:
222222
AWS_ASSUME_ROLE: ${{ secrets.AWS_ASSUME_ROLE }}
223223

224224
notify-slack:
225+
name: Notify Slack on Failure
225226
runs-on: ubuntu-latest
227+
environment: development
226228
needs: [terraform_plan_apply, deploy_lambdas, deploy_ui]
227229
if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
228230
steps:
229231
- name: Configure AWS Credentials
230232
uses: aws-actions/configure-aws-credentials@v5
231233
with:
232234
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
235+
role-skip-session-tagging: true
233236
aws-region: ${{ vars.AWS_REGION }}
237+
mask-aws-account-id: true
234238

235239
- name: Get slack bot token from SSM parameter store
236240
run: |

.github/workflows/automated-sonarqube-cloud-analysis.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,15 +28,19 @@ jobs:
2828
SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
2929

3030
notify-slack:
31+
name: Notify Slack on Failure
3132
runs-on: ubuntu-latest
33+
environment: development
3234
needs: [sonarqube_cloud]
3335
if: failure() && github.event_name == 'push' && github.ref == 'refs/heads/main'
3436
steps:
3537
- name: Configure AWS Credentials
3638
uses: aws-actions/configure-aws-credentials@v5
3739
with:
3840
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
41+
role-skip-session-tagging: true
3942
aws-region: ${{ vars.AWS_REGION }}
43+
mask-aws-account-id: true
4044

4145
- name: Get slack bot token from SSM parameter store
4246
run: |

.github/workflows/cron-daily-health-check.yml

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -198,15 +198,19 @@ jobs:
198198
secrets: inherit
199199

200200
notify-slack:
201+
name: Notify Slack on Failure
201202
runs-on: ubuntu-latest
203+
environment: development
202204
needs: [terraform_plan_apply, run_lambda_unit_tests, run_ui_unit_tests, run_cypress_tests, publish_lambda_layers, deploy_lambdas, deploy_ui]
203205
if: failure()
204206
steps:
205207
- name: Configure AWS Credentials
206208
uses: aws-actions/configure-aws-credentials@v5
207209
with:
208210
role-to-assume: ${{ secrets.AWS_ASSUME_ROLE }}
211+
role-skip-session-tagging: true
209212
aws-region: ${{ vars.AWS_REGION }}
213+
mask-aws-account-id: true
210214

211215
- name: Get slack bot token from SSM parameter store
212216
run: |

infrastructure/buckets.tf

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,8 @@ module "ndr-document-pending-review-store" {
166166
owner = var.owner
167167
enable_bucket_versioning = true
168168
force_destroy = local.is_force_destroy
169+
cloudfront_enabled = true
170+
cloudfront_arn = module.cloudfront-distribution-lg.cloudfront_arn
169171
enable_cors_configuration = true
170172
cors_rules = [
171173
{

infrastructure/cloudfront.tf

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -9,10 +9,15 @@ module "cloudfront_firewall_waf_v2" {
99
}
1010

1111
module "cloudfront-distribution-lg" {
12-
source = "./modules/cloudfront"
13-
bucket_domain_name = "${terraform.workspace}-${var.lloyd_george_bucket_name}.s3.eu-west-2.amazonaws.com"
14-
bucket_id = module.ndr-lloyd-george-store.bucket_id
15-
qualifed_arn = module.edge-presign-lambda.qualified_arn
16-
depends_on = [module.edge-presign-lambda.qualified_arn, module.ndr-lloyd-george-store.bucket_id, module.ndr-lloyd-george-store.bucket_domain_name]
17-
web_acl_id = try(module.cloudfront_firewall_waf_v2[0].arn, "")
18-
}
12+
source = "./modules/cloudfront"
13+
bucket_domain_name = module.ndr-lloyd-george-store.bucket_regional_domain_name
14+
bucket_id = module.ndr-lloyd-george-store.bucket_id
15+
qualifed_arn = module.edge-presign-lambda.qualified_arn
16+
depends_on = [module.edge-presign-lambda.qualified_arn, module.ndr-lloyd-george-store.bucket_id, module.ndr-lloyd-george-store.bucket_domain_name, module.ndr-document-pending-review-store.bucket_id, module.ndr-document-pending-review-store.bucket_domain_name]
17+
web_acl_id = try(module.cloudfront_firewall_waf_v2[0].arn, "")
18+
has_secondary_bucket = local.is_production ? false : true
19+
secondary_bucket_domain_name = module.ndr-document-pending-review-store.bucket_regional_domain_name
20+
secondary_bucket_id = module.ndr-document-pending-review-store.bucket_id
21+
secondary_bucket_path_pattern = "/review/*"
22+
log_bucket_id = local.access_logs_bucket_id
23+
}

infrastructure/lambda-bulk-upload-metadata-processor.tf

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,19 +4,19 @@ module "bulk-upload-metadata-processor-lambda" {
44
handler = "handlers.bulk_upload_metadata_processor_handler.lambda_handler"
55
lambda_timeout = 900
66
memory_size = 1769
7+
78
iam_role_policy_documents = [
89
module.ndr-bulk-staging-store.s3_read_policy_document,
910
module.ndr-bulk-staging-store.s3_write_policy_document,
1011
module.bulk_upload_report_dynamodb_table.dynamodb_read_policy_document,
1112
module.bulk_upload_report_dynamodb_table.dynamodb_write_policy_document,
1213
module.sqs-lg-bulk-upload-metadata-queue.sqs_read_policy_document,
1314
module.sqs-lg-bulk-upload-metadata-queue.sqs_write_policy_document,
14-
module.ndr-app-config.app_config_policy
15+
module.ndr-app-config.app_config_policy,
16+
aws_iam_policy.ssm_access_policy.policy,
17+
data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
1518
]
1619

17-
rest_api_id = null
18-
api_execution_arn = null
19-
2020
lambda_environment_variables = {
2121
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
2222
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
@@ -27,7 +27,15 @@ module "bulk-upload-metadata-processor-lambda" {
2727
LLOYD_GEORGE_BUCKET_NAME = "${terraform.workspace}-${var.lloyd_george_bucket_name}"
2828
LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
2929
METADATA_SQS_QUEUE_URL = module.sqs-lg-bulk-upload-metadata-queue.sqs_url
30+
31+
VIRUS_SCAN_STUB = !local.is_production
3032
}
33+
34+
vpc_subnet_ids = length(data.aws_security_groups.virus_scanner_api.ids) == 1 ? module.ndr-vpc-ui.private_subnets : []
35+
vpc_security_group_ids = length(data.aws_security_groups.virus_scanner_api.ids) == 1 ? [data.aws_security_groups.virus_scanner_api.ids[0]] : []
36+
37+
rest_api_id = null
38+
api_execution_arn = null
3139
is_gateway_integration_needed = false
3240
is_invoked_from_gateway = false
3341
}

infrastructure/lambda-document-review-processor.tf

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ module "document_review_processor_lambda" {
55
iam_role_policy_documents = [
66
module.document_review_queue.sqs_read_policy_document,
77
module.document_review_queue.sqs_write_policy_document,
8+
module.ndr-document-pending-review-store.s3_write_policy_document,
89
module.document_upload_review_dynamodb_table.dynamodb_read_policy_document,
910
module.document_upload_review_dynamodb_table.dynamodb_write_policy_document,
1011
module.ndr-bulk-staging-store.s3_read_policy_document,
@@ -23,7 +24,6 @@ module "document_review_processor_lambda" {
2324
DOCUMENT_REVIEW_DYNAMODB_NAME = module.document_upload_review_dynamodb_table.table_name
2425
WORKSPACE = terraform.workspace
2526
}
26-
depends_on = []
2727
}
2828

2929

infrastructure/lambda-edge-presign.tf

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -78,6 +78,6 @@ module "edge-presign-lambda" {
7878
providers = {
7979
aws = aws.us_east_1
8080
}
81-
bucket_name = module.ndr-lloyd-george-store.bucket_id
82-
table_name = module.cloudfront_edge_dynamodb_table.table_name
83-
}
81+
bucket_names = [module.ndr-lloyd-george-store.bucket_id, module.ndr-document-pending-review-store.bucket_id]
82+
table_name = module.cloudfront_edge_dynamodb_table.table_name
83+
}

infrastructure/modules/cloudfront/README.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ module "cloudfront" {
4242
|------|------|
4343
| [aws_cloudfront_cache_policy.nocache](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_cache_policy) | resource |
4444
| [aws_cloudfront_distribution.distribution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution) | resource |
45+
| [aws_cloudfront_distribution.distribution_with_secondary_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_distribution) | resource |
4546
| [aws_cloudfront_origin_access_control.cloudfront_s3_oac](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_origin_access_control) | resource |
4647
| [aws_cloudfront_origin_request_policy.viewer_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudfront_origin_request_policy) | resource |
4748
## Inputs
@@ -50,7 +51,12 @@ module "cloudfront" {
5051
|------|-------------|------|---------|:--------:|
5152
| <a name="input_bucket_domain_name"></a> [bucket\_domain\_name](#input\_bucket\_domain\_name) | Domain name to assign CloudFront distribution to. | `string` | n/a | yes |
5253
| <a name="input_bucket_id"></a> [bucket\_id](#input\_bucket\_id) | Bucket ID to assign CloudFront distribution to. | `string` | n/a | yes |
54+
| <a name="input_has_secondary_bucket"></a> [has\_secondary\_bucket](#input\_has\_secondary\_bucket) | Whether distribution is associated with a secondary bucket | `bool` | n/a | yes |
55+
| <a name="input_log_bucket_id"></a> [log\_bucket\_id](#input\_log\_bucket\_id) | The bucket ID to send access logs to | `string` | n/a | yes |
5356
| <a name="input_qualifed_arn"></a> [qualifed\_arn](#input\_qualifed\_arn) | Lambda@Edge function association. | `string` | n/a | yes |
57+
| <a name="input_secondary_bucket_domain_name"></a> [secondary\_bucket\_domain\_name](#input\_secondary\_bucket\_domain\_name) | Secondary bucket domain name | `string` | n/a | yes |
58+
| <a name="input_secondary_bucket_id"></a> [secondary\_bucket\_id](#input\_secondary\_bucket\_id) | Secondary bucket ID | `string` | n/a | yes |
59+
| <a name="input_secondary_bucket_path_pattern"></a> [secondary\_bucket\_path\_pattern](#input\_secondary\_bucket\_path\_pattern) | Path pattern for secondary bucket | `string` | n/a | yes |
5460
| <a name="input_web_acl_id"></a> [web\_acl\_id](#input\_web\_acl\_id) | Web ACL to associate this CloudFront distribution with. | `string` | `""` | no |
5561
## Outputs
5662

infrastructure/modules/cloudfront/main.tf

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,13 +13,17 @@ resource "aws_cloudfront_origin_access_control" "cloudfront_s3_oac" {
1313
}
1414

1515
resource "aws_cloudfront_distribution" "distribution" {
16+
count = var.has_secondary_bucket ? 0 : 1
17+
price_class = "PriceClass_100"
18+
1619
origin {
1720
domain_name = var.bucket_domain_name
1821
origin_id = var.bucket_id
1922
origin_access_control_id = aws_cloudfront_origin_access_control.cloudfront_s3_oac.id
2023
}
2124
enabled = true
2225
is_ipv6_enabled = true
26+
2327
default_cache_behavior {
2428
allowed_methods = ["HEAD", "GET", "OPTIONS"]
2529
cached_methods = ["HEAD", "GET", "OPTIONS"]
@@ -33,18 +37,99 @@ resource "aws_cloudfront_distribution" "distribution" {
3337
lambda_arn = var.qualifed_arn
3438
}
3539
}
40+
3641
viewer_certificate {
3742
cloudfront_default_certificate = true
3843
}
44+
3945
restrictions {
4046
geo_restriction {
4147
restriction_type = "whitelist"
4248
locations = local.allow_us_comms ? ["GB", "US"] : ["GB"]
4349
}
4450
}
4551
web_acl_id = var.web_acl_id
52+
53+
dynamic "logging_config" {
54+
for_each = var.log_bucket_id != "" ? [1] : []
55+
content {
56+
bucket = var.log_bucket_id
57+
prefix = "cloudfront/"
58+
}
59+
}
4660
}
4761

62+
resource "aws_cloudfront_distribution" "distribution_with_secondary_bucket" {
63+
count = var.has_secondary_bucket ? 1 : 0
64+
enabled = true
65+
is_ipv6_enabled = true
66+
price_class = "PriceClass_100"
67+
68+
origin {
69+
domain_name = var.bucket_domain_name
70+
origin_id = var.bucket_id
71+
origin_access_control_id = aws_cloudfront_origin_access_control.cloudfront_s3_oac.id
72+
}
73+
74+
default_cache_behavior {
75+
allowed_methods = ["HEAD", "GET", "OPTIONS"]
76+
cached_methods = ["HEAD", "GET", "OPTIONS"]
77+
target_origin_id = var.bucket_id
78+
viewer_protocol_policy = "redirect-to-https"
79+
cache_policy_id = aws_cloudfront_cache_policy.nocache.id
80+
origin_request_policy_id = aws_cloudfront_origin_request_policy.viewer_policy.id
81+
82+
lambda_function_association {
83+
event_type = "origin-request"
84+
lambda_arn = var.qualifed_arn
85+
}
86+
}
87+
88+
origin {
89+
domain_name = var.secondary_bucket_domain_name
90+
origin_id = var.secondary_bucket_id
91+
origin_access_control_id = aws_cloudfront_origin_access_control.cloudfront_s3_oac.id
92+
}
93+
94+
ordered_cache_behavior {
95+
allowed_methods = ["HEAD", "GET", "OPTIONS"]
96+
cached_methods = ["HEAD", "GET", "OPTIONS"]
97+
path_pattern = var.secondary_bucket_path_pattern
98+
target_origin_id = var.secondary_bucket_id
99+
viewer_protocol_policy = "redirect-to-https"
100+
cache_policy_id = aws_cloudfront_cache_policy.nocache.id
101+
origin_request_policy_id = aws_cloudfront_origin_request_policy.viewer_policy.id
102+
103+
lambda_function_association {
104+
event_type = "origin-request"
105+
lambda_arn = var.qualifed_arn
106+
}
107+
108+
}
109+
110+
dynamic "logging_config" {
111+
for_each = var.log_bucket_id != "" ? [1] : []
112+
content {
113+
bucket = var.log_bucket_id
114+
prefix = "cloudfront/"
115+
}
116+
}
117+
118+
viewer_certificate {
119+
cloudfront_default_certificate = true
120+
}
121+
122+
restrictions {
123+
geo_restriction {
124+
restriction_type = "whitelist"
125+
locations = local.allow_us_comms ? ["GB", "US"] : ["GB"]
126+
}
127+
}
128+
web_acl_id = var.web_acl_id
129+
130+
}
131+
132+
48133
resource "aws_cloudfront_origin_request_policy" "viewer_policy" {
49134
name = "${terraform.workspace}_BlockQueriesAndAllowViewer"
50135

0 commit comments

Comments
 (0)