Skip to content

Commit c9fac9e

Browse files
adamwhitingnhsadamwhitingnhs
committed
[PRMP-594] New lambda for get doc ref
1 parent f3a0621 commit c9fac9e

File tree

5 files changed

+99
-3
lines changed

5 files changed

+99
-3
lines changed

‎infrastructure/api.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ resource "aws_api_gateway_deployment" "ndr_api_deploy" {
6060
module.feature-flags-lambda,
6161
module.fhir_document_reference_gateway,
6262
module.get-doc-fhir-lambda,
63+
module.get-doc-ref-lambda,
6364
module.get-report-by-ods-gateway,
6465
module.get-report-by-ods-lambda,
6566
module.lloyd-george-stitch-gateway,

‎infrastructure/gateway-document-reference.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ module "document_reference_id_gateway" {
2626
source = "./modules/gateway"
2727
api_gateway_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
2828
parent_id = module.document_reference_gateway.gateway_resource_id
29-
http_methods = ["PUT"]
29+
http_methods = ["PUT", "GET"]
3030
authorization = "CUSTOM"
3131
gateway_path = "{id}"
3232
authorizer_id = aws_api_gateway_authorizer.repo_authoriser.id

‎infrastructure/iam.tf‎

Lines changed: 15 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -139,8 +139,11 @@ data "aws_iam_policy_document" "assume_role_policy_for_get_doc_ref_lambda" {
139139
actions = ["sts:AssumeRole"]
140140

141141
principals {
142-
type = "AWS"
143-
identifiers = [module.get-doc-fhir-lambda.lambda_execution_role_arn]
142+
type = "AWS"
143+
identifiers = [
144+
module.get-doc-fhir-lambda.lambda_execution_role_arn,
145+
module.get-doc-ref-lambda.lambda_execution_role_arn
146+
]
144147
}
145148
}
146149
}
@@ -266,3 +269,13 @@ resource "aws_iam_role_policy_attachment" "update_put_presign_url" {
266269
role = aws_iam_role.update_put_presign_url_role.name
267270
policy_arn = aws_iam_policy.s3_document_data_policy_put_only.arn
268271
}
272+
273+
resource "aws_iam_role" "get_doc_ref_presign_url_role" {
274+
name = "${terraform.workspace}_get_doc_ref_presign_url_role"
275+
assume_role_policy = data.aws_iam_policy_document.assume_role_policy_for_get_doc_ref_lambda.json
276+
}
277+
278+
resource "aws_iam_role_policy_attachment" "get_doc_ref_presign_url" {
279+
role = aws_iam_role.get_doc_ref_presign_url_role.name
280+
policy_arn = aws_iam_policy.s3_document_data_policy_for_get_doc_ref_lambda.arn
281+
}

‎infrastructure/lambda-get-doc-ref.tf‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
module "get_doc_ref_alarm" {
2+
source = "./modules/lambda_alarms"
3+
lambda_function_name = module.get_doc_ref_lambda.function_name
4+
lambda_timeout = module.get_doc_ref_lambda.timeout
5+
lambda_name = "get_document_reference_handler"
6+
namespace = "AWS/Lambda"
7+
alarm_actions = [module.get_doc_ref_alarm_topic.arn]
8+
ok_actions = [module.get_doc_ref_alarm_topic.arn]
9+
depends_on = [module.get_doc_ref_lambda, module.get_doc_ref_alarm_topic]
10+
}
11+
12+
module "get_doc_ref_alarm_topic" {
13+
source = "./modules/sns"
14+
sns_encryption_key_id = module.sns_encryption_key.id
15+
topic_name = "get_doc-alarms-topic"
16+
topic_protocol = "lambda"
17+
topic_endpoint = module.get_doc_ref_lambda.lambda_arn
18+
depends_on = [module.sns_encryption_key]
19+
delivery_policy = jsonencode({
20+
"Version" : "2012-10-17",
21+
"Statement" : [
22+
{
23+
"Effect" : "Allow",
24+
"Principal" : {
25+
"Service" : "cloudwatch.amazonaws.com"
26+
},
27+
"Action" : [
28+
"SNS:Publish",
29+
],
30+
"Condition" : {
31+
"ArnLike" : {
32+
"aws:SourceArn" : "arn:aws:cloudwatch:eu-west-2:${data.aws_caller_identity.current.account_id}:alarm:*"
33+
}
34+
}
35+
"Resource" : "*"
36+
}
37+
]
38+
})
39+
}
40+
41+
module "get_doc_ref_lambda" {
42+
source = "./modules/lambda"
43+
name = "GetDocRefLambda"
44+
handler = "handlers.get_document_reference_handler.lambda_handler"
45+
iam_role_policy_documents = [
46+
module.ndr-lloyd-george-store.s3_write_policy_document,
47+
module.ndr-lloyd-george-store.s3_read_policy_document,
48+
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
49+
module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
50+
aws_iam_policy.ssm_access_policy.policy,
51+
module.ndr-app-config.app_config_policy,
52+
]
53+
kms_deletion_window = var.kms_deletion_window
54+
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
55+
resource_id = module.document_reference_id_gateway.gateway_resource_id
56+
http_methods = ["GET"]
57+
memory_size = 512
58+
59+
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
60+
lambda_environment_variables = {
61+
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
62+
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
63+
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
64+
LLOYD_GEORGE_DYNAMODB_NAME = module.lloyd_george_reference_dynamodb_table.table_name
65+
PDS_FHIR_IS_STUBBED = local.is_sandbox
66+
WORKSPACE = terraform.workspace
67+
PRESIGNED_ASSUME_ROLE = aws_iam_role.get_doc_ref_presign_url_role.arn
68+
EDGE_REFERENCE_TABLE = module.cloudfront_edge_dynamodb_table.table_name
69+
CLOUDFRONT_URL = module.cloudfront-distribution-lg.cloudfront_url
70+
}
71+
depends_on = [
72+
module.document_reference_gateway,
73+
aws_api_gateway_rest_api.ndr_doc_store_api,
74+
module.lloyd_george_reference_dynamodb_table,
75+
module.ndr-lloyd-george-store,
76+
module.ndr-app-config,
77+
module.cloudfront-distribution-lg,
78+
module.cloudfront_edge_dynamodb_table,
79+
module.document_reference_id_gateway
80+
]
81+
}

‎infrastructure/modules/gateway/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ module "api_gateway_resource" {
7676
| <a name="input_http_methods"></a> [http\_methods](#input\_http\_methods) | List of allowed HTTP methods for the resource (e.g., ["GET", "POST"]). | `list(string)` | n/a | yes |
7777
| <a name="input_origin"></a> [origin](#input\_origin) | Allowed origin for CORS requests (e.g., '*', or specific domain). | `string` | `"'*'"` | no |
7878
| <a name="input_parent_id"></a> [parent\_id](#input\_parent\_id) | ID of the parent API Gateway resource (e.g., root path or another nested resource). | `string` | n/a | yes |
79+
| <a name="input_request_parameters"></a> [request\_parameters](#input\_request\_parameters) | Request parameters for the API Gateway method. | `map(string)` | `{}` | no |
7980
| <a name="input_require_credentials"></a> [require\_credentials](#input\_require\_credentials) | Sets the value of 'Access-Control-Allow-Credentials' which controls whether auth cookies are needed. | `bool` | n/a | yes |
8081
## Outputs
8182

0 commit comments

Comments
 (0)