Skip to content

Commit b652fa7

Browse files
NogaNHSNogaNHS
authored
[PRMP-1286] DocumentReference/{id} NRL endpoint (#218)
* [PRMP-1286] add api key and stage * [PRMP-1286] add new lambda and gateway endpoint
1 parent 88ffa90 commit b652fa7

File tree

14 files changed

+168
-26
lines changed

14 files changed

+168
-26
lines changed

‎infrastructure/README.md‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@
7070
| <a name="module_generate-lloyd-george-stitch-alarm"></a> [generate-lloyd-george-stitch-alarm](#module\_generate-lloyd-george-stitch-alarm) | ./modules/lambda_alarms | n/a |
7171
| <a name="module_generate-lloyd-george-stitch-alarm-topic"></a> [generate-lloyd-george-stitch-alarm-topic](#module\_generate-lloyd-george-stitch-alarm-topic) | ./modules/sns | n/a |
7272
| <a name="module_generate-lloyd-george-stitch-lambda"></a> [generate-lloyd-george-stitch-lambda](#module\_generate-lloyd-george-stitch-lambda) | ./modules/lambda | n/a |
73+
| <a name="module_get-doc-nrl-lambda"></a> [get-doc-nrl-lambda](#module\_get-doc-nrl-lambda) | ./modules/lambda | n/a |
7374
| <a name="module_lambda-layer-core"></a> [lambda-layer-core](#module\_lambda-layer-core) | ./modules/lambda_layers | n/a |
7475
| <a name="module_lambda-layer-data"></a> [lambda-layer-data](#module\_lambda-layer-data) | ./modules/lambda_layers | n/a |
7576
| <a name="module_lloyd-george-stitch-gateway"></a> [lloyd-george-stitch-gateway](#module\_lloyd-george-stitch-gateway) | ./modules/gateway | n/a |
@@ -151,16 +152,22 @@
151152

152153
| Name | Type |
153154
|------|------|
155+
| [aws_api_gateway_api_key.apim](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_api_key) | resource |
154156
| [aws_api_gateway_authorizer.repo_authoriser](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_authorizer) | resource |
155157
| [aws_api_gateway_base_path_mapping.api_mapping](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_base_path_mapping) | resource |
156158
| [aws_api_gateway_deployment.ndr_api_deploy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_deployment) | resource |
157159
| [aws_api_gateway_domain_name.custom_api_domain](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_domain_name) | resource |
158160
| [aws_api_gateway_gateway_response.bad_gateway_response](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_gateway_response) | resource |
159161
| [aws_api_gateway_gateway_response.unauthorised_response](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_gateway_response) | resource |
162+
| [aws_api_gateway_method.get_document_reference](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method) | resource |
160163
| [aws_api_gateway_method.login_proxy_method](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_method) | resource |
161164
| [aws_api_gateway_resource.auth_resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_resource) | resource |
165+
| [aws_api_gateway_resource.get_document_reference](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_resource) | resource |
162166
| [aws_api_gateway_resource.login_resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_resource) | resource |
163167
| [aws_api_gateway_rest_api.ndr_doc_store_api](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_rest_api) | resource |
168+
| [aws_api_gateway_stage.ndr_api](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_stage) | resource |
169+
| [aws_api_gateway_usage_plan.apim](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_usage_plan) | resource |
170+
| [aws_api_gateway_usage_plan_key.apim](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_usage_plan_key) | resource |
164171
| [aws_backup_plan.cross_account_backup_schedule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_plan) | resource |
165172
| [aws_backup_plan.s3_continuous_backup](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_plan) | resource |
166173
| [aws_backup_selection.cross_account_backup_selection](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/backup_selection) | resource |
@@ -188,6 +195,7 @@
188195
| [aws_iam_policy.dynamodb_stream_stitch_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
189196
| [aws_iam_policy.kms_mns_lambda_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
190197
| [aws_iam_policy.lambda_audit_splunk_sqs_queue_send_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
198+
| [aws_iam_policy.s3_document_data_policy_for_get_doc_ref_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
191199
| [aws_iam_policy.s3_document_data_policy_for_manifest_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
192200
| [aws_iam_policy.s3_document_data_policy_for_stitch_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
193201
| [aws_iam_policy.s3_document_data_policy_put_only](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
@@ -201,18 +209,23 @@
201209
| [aws_iam_role.ecs_execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
202210
| [aws_iam_role.manifest_presign_url_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
203211
| [aws_iam_role.mesh_forwarder](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
212+
| [aws_iam_role.nrl_get_doc_presign_url_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
204213
| [aws_iam_role.ods_weekly_update_ecs_execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
205214
| [aws_iam_role.ods_weekly_update_task_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
206215
| [aws_iam_role.s3_backup_iam_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
207216
| [aws_iam_role.sns_failure_feedback_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
208217
| [aws_iam_role.splunk_sqs_forwarder](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
209218
| [aws_iam_role.stitch_presign_url_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
210219
| [aws_iam_role_policy_attachment.backup_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
220+
| [aws_iam_role_policy_attachment.create_post_presign_url](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
211221
| [aws_iam_role_policy_attachment.cross_account_backup_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
212222
| [aws_iam_role_policy_attachment.cross_account_copy_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
213223
| [aws_iam_role_policy_attachment.cross_account_restore_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
214224
| [aws_iam_role_policy_attachment.cross_account_s3_backup_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
215225
| [aws_iam_role_policy_attachment.lambda_stitch-lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
226+
| [aws_iam_role_policy_attachment.manifest_presign_url](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
227+
| [aws_iam_role_policy_attachment.nrl_get_doc_presign_url](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
228+
| [aws_iam_role_policy_attachment.ods_weekly_update_ecs_execution](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
216229
| [aws_iam_role_policy_attachment.policy_audit_search-patient-details-lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
217230
| [aws_iam_role_policy_attachment.policy_audit_token_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
218231
| [aws_iam_role_policy_attachment.policy_generate_manifest_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
@@ -222,6 +235,7 @@
222235
| [aws_iam_role_policy_attachment.s3_backup_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
223236
| [aws_iam_role_policy_attachment.s3_cross_account_restore_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
224237
| [aws_iam_role_policy_attachment.s3_restore_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
238+
| [aws_iam_role_policy_attachment.stitch_presign_url](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
225239
| [aws_lambda_event_source_mapping.bulk_upload_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
226240
| [aws_lambda_event_source_mapping.dynamodb_stream_manifest](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
227241
| [aws_lambda_event_source_mapping.dynamodb_stream_stitch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
@@ -253,6 +267,7 @@
253267
| [aws_ecr_repository.mesh_s3_forwarder](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ecr_repository) | data source |
254268
| [aws_elb_service_account.main](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/elb_service_account) | data source |
255269
| [aws_iam_policy_document.assume_role_policy_for_create_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
270+
| [aws_iam_policy_document.assume_role_policy_for_get_doc_ref_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
256271
| [aws_iam_policy_document.assume_role_policy_for_manifest_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
257272
| [aws_iam_policy_document.assume_role_policy_for_stitch_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
258273
| [aws_iam_policy_document.backup_assume_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
@@ -282,7 +297,7 @@
282297
|------|-------------|------|---------|:--------:|
283298
| <a name="input_auth_session_dynamodb_table_name"></a> [auth\_session\_dynamodb\_table\_name](#input\_auth\_session\_dynamodb\_table\_name) | The name of dynamodb table to store user login sessions | `string` | `"AuthSessionReferenceMetadata"` | no |
284299
| <a name="input_auth_state_dynamodb_table_name"></a> [auth\_state\_dynamodb\_table\_name](#input\_auth\_state\_dynamodb\_table\_name) | The name of dynamodb table to store the state values (for CIS2 authorisation) | `string` | `"AuthStateReferenceMetadata"` | no |
285-
| <a name="input_availability_zones"></a> [availability\_zones](#input\_availability\_zones) | This is a list that specifies all the Availability Zones that will have a pair of public and private subnets | `list(string)` | <pre>[<br/> "eu-west-2a",<br/> "eu-west-2b",<br/> "eu-west-2c"<br/>]</pre> | no |
300+
| <a name="input_availability_zones"></a> [availability\_zones](#input\_availability\_zones) | This is a list that specifies all the Availability Zones that will have a pair of public and private subnets | `list(string)` | <pre>[<br> "eu-west-2a",<br> "eu-west-2b",<br> "eu-west-2c"<br>]</pre> | no |
286301
| <a name="input_bulk_upload_report_dynamodb_table_name"></a> [bulk\_upload\_report\_dynamodb\_table\_name](#input\_bulk\_upload\_report\_dynamodb\_table\_name) | The name of dynamodb table to store bulk upload status | `string` | `"BulkUploadReport"` | no |
287302
| <a name="input_certificate_domain"></a> [certificate\_domain](#input\_certificate\_domain) | n/a | `string` | n/a | yes |
288303
| <a name="input_certificate_subdomain_name_prefix"></a> [certificate\_subdomain\_name\_prefix](#input\_certificate\_subdomain\_name\_prefix) | Prefix to add to subdomains on certification configurations, dev envs use api-{env}, prod envs use api.{env} | `string` | `"api-"` | no |

‎infrastructure/api.tf‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,6 @@ resource "aws_api_gateway_resource" "auth_resource" {
3737
# API Config
3838
resource "aws_api_gateway_deployment" "ndr_api_deploy" {
3939
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
40-
stage_name = var.environment
41-
4240
triggers = {
4341
redeployment = sha1(jsonencode([
4442
aws_api_gateway_rest_api.ndr_doc_store_api.body,
@@ -104,14 +102,21 @@ resource "aws_api_gateway_deployment" "ndr_api_deploy" {
104102
module.upload_confirm_result_gateway,
105103
module.upload_confirm_result_lambda,
106104
module.virus_scan_result_gateway,
107-
module.virus_scan_result_lambda
105+
module.virus_scan_result_lambda,
106+
module.get-doc-nrl-lambda
108107
]
109108

110109
lifecycle {
111110
create_before_destroy = true
112111
}
113112
}
114113

114+
resource "aws_api_gateway_stage" "ndr_api" {
115+
deployment_id = aws_api_gateway_deployment.ndr_api_deploy.id
116+
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
117+
stage_name = var.environment
118+
}
119+
115120
resource "aws_api_gateway_gateway_response" "unauthorised_response" {
116121
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
117122
response_type = "DEFAULT_4XX"

‎infrastructure/apim-nrl.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
resource "aws_api_gateway_usage_plan" "apim" {
2+
name = "${terraform.workspace}_apim-usage-plan"
3+
api_stages {
4+
api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
5+
stage = aws_api_gateway_stage.ndr_api.stage_name
6+
}
7+
}
8+
9+
resource "aws_api_gateway_api_key" "apim" {
10+
name = "${terraform.workspace}_apim-api-key"
11+
}
12+
13+
resource "aws_api_gateway_usage_plan_key" "apim" {
14+
key_id = aws_api_gateway_api_key.apim.id
15+
key_type = "API_KEY"
16+
usage_plan_id = aws_api_gateway_usage_plan.apim.id
17+
}

‎infrastructure/iam.tf‎

Lines changed: 60 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,13 @@ data "aws_iam_policy_document" "assume_role_policy_for_create_lambda" {
2727
}
2828

2929
resource "aws_iam_role" "create_post_presign_url_role" {
30-
name = "${terraform.workspace}_create_post_presign_url_role"
31-
assume_role_policy = data.aws_iam_policy_document.assume_role_policy_for_create_lambda.json
32-
managed_policy_arns = [aws_iam_policy.s3_document_data_policy_put_only.arn]
30+
name = "${terraform.workspace}_create_post_presign_url_role"
31+
assume_role_policy = data.aws_iam_policy_document.assume_role_policy_for_create_lambda.json
32+
}
33+
34+
resource "aws_iam_role_policy_attachment" "create_post_presign_url" {
35+
role = aws_iam_role.create_post_presign_url_role.name
36+
policy_arn = aws_iam_policy.s3_document_data_policy_put_only.arn
3337
}
3438

3539
resource "aws_iam_policy" "s3_document_data_policy_for_stitch_lambda" {
@@ -61,9 +65,13 @@ data "aws_iam_policy_document" "assume_role_policy_for_stitch_lambda" {
6165
}
6266

6367
resource "aws_iam_role" "stitch_presign_url_role" {
64-
name = "${terraform.workspace}_stitch_presign_url_role"
65-
assume_role_policy = data.aws_iam_policy_document.assume_role_policy_for_stitch_lambda.json
66-
managed_policy_arns = [aws_iam_policy.s3_document_data_policy_for_stitch_lambda.arn]
68+
name = "${terraform.workspace}_stitch_presign_url_role"
69+
assume_role_policy = data.aws_iam_policy_document.assume_role_policy_for_stitch_lambda.json
70+
}
71+
72+
resource "aws_iam_role_policy_attachment" "stitch_presign_url" {
73+
role = aws_iam_role.stitch_presign_url_role.name
74+
policy_arn = aws_iam_policy.s3_document_data_policy_for_stitch_lambda.arn
6775
}
6876

6977
resource "aws_iam_policy" "s3_document_data_policy_for_manifest_lambda" {
@@ -95,7 +103,50 @@ data "aws_iam_policy_document" "assume_role_policy_for_manifest_lambda" {
95103
}
96104

97105
resource "aws_iam_role" "manifest_presign_url_role" {
98-
name = "${terraform.workspace}_manifest_presign_url_role"
99-
assume_role_policy = data.aws_iam_policy_document.assume_role_policy_for_manifest_lambda.json
100-
managed_policy_arns = [aws_iam_policy.s3_document_data_policy_for_manifest_lambda.arn]
106+
name = "${terraform.workspace}_manifest_presign_url_role"
107+
assume_role_policy = data.aws_iam_policy_document.assume_role_policy_for_manifest_lambda.json
108+
}
109+
110+
resource "aws_iam_role_policy_attachment" "manifest_presign_url" {
111+
role = aws_iam_role.manifest_presign_url_role.name
112+
policy_arn = aws_iam_policy.s3_document_data_policy_for_manifest_lambda.arn
113+
}
114+
115+
116+
resource "aws_iam_policy" "s3_document_data_policy_for_get_doc_ref_lambda" {
117+
name = "${terraform.workspace}_get_document_only_policy_for_nrl_get_doc_lambda"
118+
119+
policy = jsonencode({
120+
"Version" : "2012-10-17",
121+
"Statement" : [
122+
{
123+
"Effect" : "Allow",
124+
"Action" : [
125+
"s3:GetObject",
126+
],
127+
"Resource" : ["${module.ndr-lloyd-george-store.bucket_arn}/*"]
128+
}
129+
]
130+
})
131+
}
132+
133+
data "aws_iam_policy_document" "assume_role_policy_for_get_doc_ref_lambda" {
134+
statement {
135+
actions = ["sts:AssumeRole"]
136+
137+
principals {
138+
type = "AWS"
139+
identifiers = [module.get-doc-nrl-lambda.lambda_execution_role_arn]
140+
}
141+
}
142+
}
143+
144+
resource "aws_iam_role" "nrl_get_doc_presign_url_role" {
145+
name = "${terraform.workspace}_nrl_get_doc_presign_url_role"
146+
assume_role_policy = data.aws_iam_policy_document.assume_role_policy_for_get_doc_ref_lambda.json
147+
}
148+
149+
resource "aws_iam_role_policy_attachment" "nrl_get_doc_presign_url" {
150+
role = aws_iam_role.nrl_get_doc_presign_url_role.name
151+
policy_arn = aws_iam_policy.s3_document_data_policy_for_get_doc_ref_lambda.arn
101152
}

0 commit comments

Comments
 (0)