Skip to content

Commit dccc4bc

Browse files
steph-torres-nhssteph-torres-nhs
authored
Merge branch 'main' into PRMP-1559
2 parents 62873ac + ce033e2 commit dccc4bc

File tree

4 files changed

+94
-10
lines changed

4 files changed

+94
-10
lines changed

‎infrastructure/cloudwatch_rum.tf‎

Lines changed: 83 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,83 @@
1+
locals {
2+
cognito_role_name = "${terraform.workspace}-cognito-unauth-role"
3+
}
4+
5+
resource "aws_iam_role" "cognito_unauthenticated" {
6+
count = local.is_production ? 0 : 1
7+
name = local.cognito_role_name
8+
9+
assume_role_policy = jsonencode({
10+
Version = "2012-10-17",
11+
Statement = [
12+
{
13+
Effect = "Allow",
14+
Principal : {
15+
Federated : "cognito-identity.amazonaws.com"
16+
},
17+
Action = "sts:AssumeRoleWithWebIdentity",
18+
Condition = {
19+
StringEquals = {
20+
"cognito-identity.amazonaws.com:aud" = aws_cognito_identity_pool.cloudwatch_rum[0].id
21+
},
22+
"ForAnyValue:StringLike" = {
23+
"cognito-identity.amazonaws.com:amr" = "unauthenticated"
24+
}
25+
}
26+
}
27+
]
28+
})
29+
}
30+
31+
resource "aws_iam_policy" "cloudwatch_rum_cognito_access" {
32+
count = local.is_production ? 0 : 1
33+
name = "${terraform.workspace}-cloudwatch-rum-cognito-access-policy"
34+
description = "Policy for unauthenticated Cognito identities"
35+
36+
policy = jsonencode(
37+
{
38+
"Version" : "2012-10-17",
39+
"Statement" : [
40+
{
41+
"Effect" : "Allow",
42+
"Action" : "rum:PutRumEvents",
43+
"Resource" : "arn:aws:rum:${local.current_region}:${local.current_account_id}:appmonitor/${aws_rum_app_monitor.ndr[0].id}"
44+
}
45+
]
46+
})
47+
}
48+
49+
resource "aws_iam_role_policy_attachment" "cloudwatch_rum_cognito_unauth" {
50+
count = local.is_production ? 0 : 1
51+
role = aws_iam_role.cognito_unauthenticated[0].name
52+
policy_arn = aws_iam_policy.cloudwatch_rum_cognito_access[0].arn
53+
}
54+
55+
resource "aws_cognito_identity_pool_roles_attachment" "cloudwatch_rum" {
56+
count = local.is_production ? 0 : 1
57+
identity_pool_id = aws_cognito_identity_pool.cloudwatch_rum[0].id
58+
59+
roles = {
60+
unauthenticated = aws_iam_role.cognito_unauthenticated[0].arn
61+
}
62+
}
63+
64+
resource "aws_cognito_identity_pool" "cloudwatch_rum" {
65+
count = local.is_production ? 0 : 1
66+
identity_pool_name = "${terraform.workspace}-cloudwatch-rum-identity-pool"
67+
allow_unauthenticated_identities = true
68+
}
69+
70+
resource "aws_rum_app_monitor" "ndr" {
71+
count = local.is_production ? 0 : 1
72+
name = "${terraform.workspace}-app-monitor"
73+
domain = "*.${var.domain}"
74+
cw_log_enabled = false
75+
76+
app_monitor_configuration {
77+
identity_pool_id = aws_cognito_identity_pool.cloudwatch_rum[0].id
78+
allow_cookies = true
79+
enable_xray = false
80+
session_sample_rate = 1.0
81+
telemetries = ["errors", "performance", "http"]
82+
}
83+
}

‎infrastructure/lambda-bulk-upload.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ module "bulk-upload-lambda" {
1212
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
1313
module.bulk_upload_report_dynamodb_table.dynamodb_read_policy_document,
1414
module.bulk_upload_report_dynamodb_table.dynamodb_write_policy_document,
15-
module.sqs-nrl-queue.sqs_write_policy_document,
15+
module.sqs-stitching-queue.sqs_write_policy_document,
1616
module.sqs-lg-bulk-upload-metadata-queue.sqs_read_policy_document,
1717
module.sqs-lg-bulk-upload-metadata-queue.sqs_write_policy_document,
1818
module.sqs-lg-bulk-upload-invalid-queue.sqs_read_policy_document,
@@ -35,7 +35,7 @@ module "bulk-upload-lambda" {
3535
METADATA_SQS_QUEUE_URL = module.sqs-lg-bulk-upload-metadata-queue.sqs_url
3636
INVALID_SQS_QUEUE_URL = module.sqs-lg-bulk-upload-invalid-queue.sqs_url
3737
PDS_FHIR_IS_STUBBED = local.is_sandbox
38-
NRL_SQS_URL = module.sqs-nrl-queue.sqs_url
38+
PDF_STITCHING_SQS_URL = module.sqs-stitching-queue.sqs_url
3939
APIM_API_URL = data.aws_ssm_parameter.apim_url.value
4040
}
4141

‎infrastructure/lambda-pdf-stitching.tf‎

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -5,25 +5,27 @@ module "pdf-stitching-lambda" {
55
memory_size = 1769
66
lambda_timeout = 900
77
iam_role_policy_documents = [
8-
module.ndr-lloyd-george-store.s3_read_policy_document,
98
module.sqs-nrl-queue.sqs_read_policy_document,
109
module.sqs-nrl-queue.sqs_write_policy_document,
1110
module.sqs-stitching-queue.sqs_read_policy_document,
1211
module.sqs-stitching-queue.sqs_write_policy_document,
1312
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
1413
module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
1514
module.unstitched_lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
16-
module.unstitched_lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document
15+
module.unstitched_lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
16+
module.ndr-lloyd-george-store.s3_read_policy_document,
17+
module.ndr-lloyd-george-store.s3_write_policy_document,
1718
]
1819
rest_api_id = null
1920
api_execution_arn = null
2021
is_invoked_from_gateway = false
2122
lambda_environment_variables = {
22-
STITCH_SQS_QUEUE_URL = module.sqs-stitching-queue.sqs_url
23-
NRL_SQS_QUEUE_URL = module.sqs-nrl-queue.sqs_url
24-
LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
25-
STITCH_METADATA_DYNAMODB_NAME = "${terraform.workspace}_${var.unstitched_lloyd_george_dynamodb_table_name}"
26-
WORKSPACE = terraform.workspace
23+
PDF_STITCHING_SQS_URL = module.sqs-stitching-queue.sqs_url
24+
NRL_SQS_URL = module.sqs-nrl-queue.sqs_url
25+
LLOYD_GEORGE_BUCKET_NAME = "${terraform.workspace}-${var.lloyd_george_bucket_name}"
26+
LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
27+
UNSTITCHED_LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.unstitched_lloyd_george_dynamodb_table_name}"
28+
WORKSPACE = terraform.workspace
2729
}
2830
}
2931

‎infrastructure/modules/cloudwatch/main.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ resource "aws_cloudwatch_log_group" "ndr_cloudwatch_log_group" {
1313
resource "aws_cloudwatch_log_stream" "log_stream" {
1414
name = "${terraform.workspace}_${var.cloudwatch_log_stream_name}_log_Stream"
1515
log_group_name = "aws_cloudwatch_log_group.ndr_cloudwatch_log_group"
16-
1716
tags = {
1817
Name = "${terraform.workspace}_${var.cloudwatch_log_stream_name}_log_stream"
1918
Owner = var.owner

0 commit comments

Comments
 (0)