[PRMP-1318] update SSM access policy references to use local variables 2

NogaNHS · NogaNHS · commit adcee05f08e1 · 2026-01-21T15:44:57.000Z
Signed-off-by: NogaNHS &lt;127490765+NogaNHS@users.noreply.github.com&gt;
diff --git a/infrastructure/lambda-back-channel-logout.tf b/infrastructure/lambda-back-channel-logout.tf
@@ -14,7 +14,7 @@ module "back_channel_logout_lambda" {
   name    = "BackChannelLogoutHandler"
   handler = "handlers.back_channel_logout_handler.lambda_handler"
   iam_role_policy_documents = [
-    local.ssm_access_policy_policy,
+    local.ssm_access_policy.policy,
     module.auth_session_dynamodb_table.dynamodb_read_policy_document,
     module.auth_session_dynamodb_table.dynamodb_write_policy_document,
     module.ndr-app-config.app_config_policy
diff --git a/infrastructure/lambda-bulk-upload.tf b/infrastructure/lambda-bulk-upload.tf
@@ -19,7 +19,7 @@ module "bulk-upload-lambda" {
     module.sqs-lg-bulk-upload-invalid-queue.sqs_write_policy_document,
     module.lg-bulk-upload-expedite-metadata-queue.sqs_write_policy_document,
     module.lg-bulk-upload-expedite-metadata-queue.sqs_read_policy_document,
-    local.ssm_access_policy_policy,
+    local.ssm_access_policy.policy,
     module.ndr-app-config.app_config_policy
   ]
   kms_deletion_window = var.kms_deletion_window
diff --git a/infrastructure/lambda-document-upload-check.tf b/infrastructure/lambda-document-upload-check.tf
@@ -7,7 +7,7 @@ module "document_upload_check_lambda" {
     module.ndr-bulk-staging-store.s3_write_policy_document,
     module.ndr-lloyd-george-store.s3_write_policy_document,
     module.pdm-document-store.s3_write_policy_document,
-    local.ssm_access_policy_policy,
+    local.ssm_access_policy.policy,
     module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
     module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
     data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
diff --git a/infrastructure/lambda-feature-flags.tf b/infrastructure/lambda-feature-flags.tf
@@ -57,7 +57,7 @@ module "feature-flags-lambda" {
   handler = "handlers.feature_flags_handler.lambda_handler"
   iam_role_policy_documents = [
     module.ndr-app-config.app_config_policy,
-    local.ssm_access_policy_policy,
+    local.ssm_access_policy.policy,
   ]
   kms_deletion_window = var.kms_deletion_window
   rest_api_id         = aws_api_gateway_rest_api.ndr_doc_store_api.id
diff --git a/infrastructure/lambda-get-document-review.tf b/infrastructure/lambda-get-document-review.tf
@@ -7,7 +7,7 @@ module "get_document_review_lambda" {
     module.cloudfront_edge_dynamodb_table.dynamodb_read_policy_document,
     module.cloudfront_edge_dynamodb_table.dynamodb_write_policy_document,
     module.document_upload_review_dynamodb_table.dynamodb_read_policy_document,
-    local.ssm_access_policy_policy,
+    local.ssm_access_policy.policy,
     module.ndr-document-pending-review-store.s3_read_policy_document
   ]
 
diff --git a/infrastructure/lambda-get-report-by-ods.tf b/infrastructure/lambda-get-report-by-ods.tf
@@ -54,7 +54,7 @@ module "get-report-by-ods-lambda" {
   name    = "GetReportByODS"
   handler = "handlers.get_report_by_ods_handler.lambda_handler"
   iam_role_policy_documents = [
-    local.ssm_access_policy_policy,
+    local.ssm_access_policy.policy,
     module.ndr-app-config.app_config_policy,
     module.statistical-reports-store.s3_write_policy_document,
     module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
diff --git a/infrastructure/lambda-login-redirect.tf b/infrastructure/lambda-login-redirect.tf
@@ -20,7 +20,7 @@ module "login_redirect_lambda" {
   name    = "LoginRedirectHandler"
   handler = "handlers.login_redirect_handler.lambda_handler"
   iam_role_policy_documents = [
-    local.ssm_access_policy_policy,
+    local.ssm_access_policy.policy,
     module.auth_state_dynamodb_table.dynamodb_read_policy_document,
     module.auth_state_dynamodb_table.dynamodb_write_policy_document,
     module.ndr-app-config.app_config_policy
diff --git a/infrastructure/lambda-manage-nrl-pointer.tf b/infrastructure/lambda-manage-nrl-pointer.tf
@@ -7,7 +7,7 @@ module "manage-nrl-pointer-lambda" {
     module.ndr-app-config.app_config_policy,
     module.sqs-nrl-queue.sqs_read_policy_document,
     module.sqs-nrl-queue.sqs_write_policy_document,
-    local.ssm_access_policy_policy
+    local.ssm_access_policy.policy
   ]
   kms_deletion_window = var.kms_deletion_window
   rest_api_id         = null
diff --git a/infrastructure/lambda-nhs-oauth-token-generator.tf b/infrastructure/lambda-nhs-oauth-token-generator.tf
@@ -4,7 +4,7 @@ module "nhs-oauth-token-generator-lambda" {
   handler        = "handlers.nhs_oauth_token_generator_handler.lambda_handler"
   lambda_timeout = 120
   iam_role_policy_documents = [
-    local.ssm_access_policy_policy,
+    local.ssm_access_policy.policy,
     module.ndr-app-config.app_config_policy
   ]
 
diff --git a/infrastructure/lambda-search-doc-references.tf b/infrastructure/lambda-search-doc-references.tf
@@ -64,7 +64,7 @@ module "search-document-references-lambda" {
     module.ndr-lloyd-george-store.s3_read_policy_document,
     module.ndr-document-store.s3_read_policy_document,
     module.ndr-app-config.app_config_policy,
-    local.ssm_access_policy_policy
+    local.ssm_access_policy.policy
   ]
   kms_deletion_window = var.kms_deletion_window
   rest_api_id         = aws_api_gateway_rest_api.ndr_doc_store_api.id
diff --git a/infrastructure/lambda-search-document-review.tf b/infrastructure/lambda-search-document-review.tf
@@ -5,7 +5,7 @@ module "search_document_review_lambda" {
   iam_role_policy_documents = [
     module.ndr-app-config.app_config_policy,
     module.document_upload_review_dynamodb_table.dynamodb_read_policy_document,
-    local.ssm_access_policy_policy
+    local.ssm_access_policy.policy
   ]
 
   rest_api_id                   = aws_api_gateway_rest_api.ndr_doc_store_api.id
diff --git a/infrastructure/lambda-update-doc-ref.tf b/infrastructure/lambda-update-doc-ref.tf
@@ -51,7 +51,7 @@ module "update-doc-ref-lambda" {
     module.ndr-document-store.s3_write_policy_document,
     module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
     module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
-    local.ssm_access_policy_policy,
+    local.ssm_access_policy.policy,
     module.ndr-app-config.app_config_policy,
   ]
   kms_deletion_window = var.kms_deletion_window
diff --git a/infrastructure/lambda-virus-scan-result.tf b/infrastructure/lambda-virus-scan-result.tf
@@ -59,7 +59,7 @@ module "virus_scan_result_lambda" {
     module.ndr-bulk-staging-store.s3_read_policy_document,
     module.ndr-bulk-staging-store.s3_write_policy_document,
     module.ndr-app-config.app_config_policy,
-    local.ssm_access_policy_policy,
+    local.ssm_access_policy.policy,
     module.document_reference_dynamodb_table.dynamodb_read_policy_document,
     module.document_reference_dynamodb_table.dynamodb_write_policy_document,
     module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,

Original file line number	Diff line number	Diff line change
`@@ -19,7 +19,7 @@ module "bulk-upload-lambda" {`
`19`	`19`	`module.sqs-lg-bulk-upload-invalid-queue.sqs_write_policy_document,`
`20`	`20`	`module.lg-bulk-upload-expedite-metadata-queue.sqs_write_policy_document,`
`21`	`21`	`module.lg-bulk-upload-expedite-metadata-queue.sqs_read_policy_document,`
`22`		`- local.ssm_access_policy_policy,`
	`22`	`+ local.ssm_access_policy.policy,`
`23`	`23`	`module.ndr-app-config.app_config_policy`
`24`	`24`	`]`
`25`	`25`	`kms_deletion_window = var.kms_deletion_window`
Original file line number	Diff line number	Diff line change
`@@ -57,7 +57,7 @@ module "feature-flags-lambda" {`
`57`	`57`	`handler = "handlers.feature_flags_handler.lambda_handler"`
`58`	`58`	`iam_role_policy_documents = [`
`59`	`59`	`module.ndr-app-config.app_config_policy,`
`60`		`- local.ssm_access_policy_policy,`
	`60`	`+ local.ssm_access_policy.policy,`
`61`	`61`	`]`
`62`	`62`	`kms_deletion_window = var.kms_deletion_window`
`63`	`63`	`rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id`
Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,7 @@ module "get_document_review_lambda" {`
`7`	`7`	`module.cloudfront_edge_dynamodb_table.dynamodb_read_policy_document,`
`8`	`8`	`module.cloudfront_edge_dynamodb_table.dynamodb_write_policy_document,`
`9`	`9`	`module.document_upload_review_dynamodb_table.dynamodb_read_policy_document,`
`10`		`- local.ssm_access_policy_policy,`
	`10`	`+ local.ssm_access_policy.policy,`
`11`	`11`	`module.ndr-document-pending-review-store.s3_read_policy_document`
`12`	`12`	`]`
`13`	`13`
Original file line number	Diff line number	Diff line change
`@@ -7,7 +7,7 @@ module "manage-nrl-pointer-lambda" {`
`7`	`7`	`module.ndr-app-config.app_config_policy,`
`8`	`8`	`module.sqs-nrl-queue.sqs_read_policy_document,`
`9`	`9`	`module.sqs-nrl-queue.sqs_write_policy_document,`
`10`		`- local.ssm_access_policy_policy`
	`10`	`+ local.ssm_access_policy.policy`
`11`	`11`	`]`
`12`	`12`	`kms_deletion_window = var.kms_deletion_window`
`13`	`13`	`rest_api_id = null`
Original file line number	Diff line number	Diff line change
`@@ -4,7 +4,7 @@ module "nhs-oauth-token-generator-lambda" {`
`4`	`4`	`handler = "handlers.nhs_oauth_token_generator_handler.lambda_handler"`
`5`	`5`	`lambda_timeout = 120`
`6`	`6`	`iam_role_policy_documents = [`
`7`		`- local.ssm_access_policy_policy,`
	`7`	`+ local.ssm_access_policy.policy,`
`8`	`8`	`module.ndr-app-config.app_config_policy`
`9`	`9`	`]`
`10`	`10`
Original file line number	Diff line number	Diff line change
`@@ -64,7 +64,7 @@ module "search-document-references-lambda" {`
`64`	`64`	`module.ndr-lloyd-george-store.s3_read_policy_document,`
`65`	`65`	`module.ndr-document-store.s3_read_policy_document,`
`66`	`66`	`module.ndr-app-config.app_config_policy,`
`67`		`- local.ssm_access_policy_policy`
	`67`	`+ local.ssm_access_policy.policy`
`68`	`68`	`]`
`69`	`69`	`kms_deletion_window = var.kms_deletion_window`
`70`	`70`	`rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id`