Skip to content

Commit f30d977

Browse files
abid-nhsabid-nhs
authored
Merge branch 'main' into PRMP-1292
2 parents 3803a68 + 2772179 commit f30d977

18 files changed

+433
-42
lines changed

‎.github/workflows/terraform-daily-healthcheck-deploy-and-destroy.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,6 +165,7 @@ jobs:
165165
sandbox: ${{ needs.set_workspace.outputs.workspace }}
166166
environment: development
167167
python_version: "3.11"
168+
is_sandbox: true
168169
secrets:
169170
AWS_ASSUME_ROLE: ${{ secrets.AWS_ASSUME_ROLE }}
170171

‎.github/workflows/terraform-dev-to-main-ci.yml‎

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@ on:
99
branches:
1010
- main
1111

12+
1213
permissions:
1314
pull-requests: write
1415
id-token: write # This is required for requesting the JWT
@@ -75,24 +76,17 @@ jobs:
7576
name: Deploy Lambdas on NDR Functional Repo
7677
needs: ['terraform_process']
7778
if: github.ref == 'refs/heads/main'
78-
uses: nhsconnect/national-document-repository/.github/workflows/lambdas-deploy-feature-to-sandbox.yml@main
79-
with:
80-
build_branch: main
81-
sandbox: ndr-dev
82-
environment: development
79+
uses: nhsconnect/national-document-repository/.github/workflows/lambdas-dev-to-main-ci.yml@main
8380
secrets:
8481
AWS_ASSUME_ROLE: ${{ secrets.AWS_ASSUME_ROLE }}
8582

8683
run_main_repo_deploy_ui:
87-
name: Deploy Lambdas on NDR Functional Repo
84+
name: Deploy UI on NDR Functional Repo
8885
needs: ['terraform_process']
8986
if: github.ref == 'refs/heads/main'
90-
uses: nhsconnect/national-document-repository/.github/workflows/ui-deploy-feature-to-sandbox-manual.yml@main
91-
with:
92-
build_branch: main
93-
sandbox: ndr-dev
94-
environment: development
87+
uses: nhsconnect/national-document-repository/.github/workflows/ui-dev-to-main-ci.yml@main
9588
secrets:
9689
AWS_ASSUME_ROLE: ${{ secrets.AWS_ASSUME_ROLE }}
90+
9791

9892

‎infrastructure/README.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -87,6 +87,10 @@
8787
| <a name="module_manage-nrl-pointer-alarm"></a> [manage-nrl-pointer-alarm](#module\_manage-nrl-pointer-alarm) | ./modules/lambda_alarms | n/a |
8888
| <a name="module_manage-nrl-pointer-alarm-topic"></a> [manage-nrl-pointer-alarm-topic](#module\_manage-nrl-pointer-alarm-topic) | ./modules/sns | n/a |
8989
| <a name="module_manage-nrl-pointer-lambda"></a> [manage-nrl-pointer-lambda](#module\_manage-nrl-pointer-lambda) | ./modules/lambda | n/a |
90+
| <a name="module_mns-notification-alarm"></a> [mns-notification-alarm](#module\_mns-notification-alarm) | ./modules/lambda_alarms | n/a |
91+
| <a name="module_mns-notification-alarm-topic"></a> [mns-notification-alarm-topic](#module\_mns-notification-alarm-topic) | ./modules/sns | n/a |
92+
| <a name="module_mns-notification-lambda"></a> [mns-notification-lambda](#module\_mns-notification-lambda) | ./modules/lambda | n/a |
93+
| <a name="module_mns_encryption_key"></a> [mns\_encryption\_key](#module\_mns\_encryption\_key) | ./modules/kms | n/a |
9094
| <a name="module_ndr-app-config"></a> [ndr-app-config](#module\_ndr-app-config) | ./modules/app_config | n/a |
9195
| <a name="module_ndr-bulk-staging-store"></a> [ndr-bulk-staging-store](#module\_ndr-bulk-staging-store) | ./modules/s3/ | n/a |
9296
| <a name="module_ndr-docker-ecr-ui"></a> [ndr-docker-ecr-ui](#module\_ndr-docker-ecr-ui) | ./modules/ecr/ | n/a |
@@ -119,6 +123,7 @@
119123
| <a name="module_sns_encryption_key"></a> [sns\_encryption\_key](#module\_sns\_encryption\_key) | ./modules/kms | n/a |
120124
| <a name="module_sqs-lg-bulk-upload-invalid-queue"></a> [sqs-lg-bulk-upload-invalid-queue](#module\_sqs-lg-bulk-upload-invalid-queue) | ./modules/sqs | n/a |
121125
| <a name="module_sqs-lg-bulk-upload-metadata-queue"></a> [sqs-lg-bulk-upload-metadata-queue](#module\_sqs-lg-bulk-upload-metadata-queue) | ./modules/sqs | n/a |
126+
| <a name="module_sqs-mns-notification-queue"></a> [sqs-mns-notification-queue](#module\_sqs-mns-notification-queue) | ./modules/sqs | n/a |
122127
| <a name="module_sqs-nems-queue"></a> [sqs-nems-queue](#module\_sqs-nems-queue) | ./modules/sqs | n/a |
123128
| <a name="module_sqs-nrl-queue"></a> [sqs-nrl-queue](#module\_sqs-nrl-queue) | ./modules/sqs | n/a |
124129
| <a name="module_sqs-splunk-queue"></a> [sqs-splunk-queue](#module\_sqs-splunk-queue) | ./modules/sqs | n/a |
@@ -181,6 +186,7 @@
181186
| [aws_iam_policy.dynamodb_policy_scan_bulk_report](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
182187
| [aws_iam_policy.dynamodb_stream_manifest](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
183188
| [aws_iam_policy.dynamodb_stream_stitch_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
189+
| [aws_iam_policy.kms_mns_lambda_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
184190
| [aws_iam_policy.lambda_audit_splunk_sqs_queue_send_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
185191
| [aws_iam_policy.s3_document_data_policy_for_manifest_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
186192
| [aws_iam_policy.s3_document_data_policy_for_stitch_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
@@ -219,6 +225,7 @@
219225
| [aws_lambda_event_source_mapping.bulk_upload_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
220226
| [aws_lambda_event_source_mapping.dynamodb_stream_manifest](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
221227
| [aws_lambda_event_source_mapping.dynamodb_stream_stitch](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
228+
| [aws_lambda_event_source_mapping.mns_notification_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
222229
| [aws_lambda_event_source_mapping.nems_message_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
223230
| [aws_lambda_event_source_mapping.nrl_pointer_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
224231
| [aws_lambda_permission.bulk_upload_metadata_schedule_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
@@ -232,6 +239,7 @@
232239
| [aws_security_group.ndr_mesh_sg](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/security_group) | resource |
233240
| [aws_sns_topic.alarm_notifications_topic](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic) | resource |
234241
| [aws_sns_topic_subscription.alarm_notifications_sns_topic_subscription](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription) | resource |
242+
| [aws_sqs_queue_policy.mns_sqs_access](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy) | resource |
235243
| [aws_sqs_queue_policy.nems_events_subscription](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy) | resource |
236244
| [aws_ssm_parameter.nems_events_observability](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
237245
| [aws_ssm_parameter.nems_events_topic_arn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
@@ -264,6 +272,7 @@
264272
| [aws_ssm_parameter.backup_target_account](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
265273
| [aws_ssm_parameter.cloud_security_notification_email_list](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
266274
| [aws_ssm_parameter.end_user_ods_code](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
275+
| [aws_ssm_parameter.mns_lambda_role](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
267276
| [aws_ssm_parameter.splunk_trusted_principal](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
268277
| [aws_ssm_parameter.target_backup_vault_arn](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
269278

‎infrastructure/dynamo_db.tf‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,8 @@ module "document_reference_dynamodb_table" {
33
table_name = var.docstore_dynamodb_table_name
44
hash_key = "ID"
55
deletion_protection_enabled = local.is_production
6-
stream_enabled = false
6+
stream_enabled = true
7+
stream_view_type = "OLD_IMAGE"
78
ttl_enabled = true
89
ttl_attribute_name = "TTL"
910
point_in_time_recovery_enabled = !local.is_sandbox
@@ -66,7 +67,8 @@ module "lloyd_george_reference_dynamodb_table" {
6667
table_name = var.lloyd_george_dynamodb_table_name
6768
hash_key = "ID"
6869
deletion_protection_enabled = local.is_production
69-
stream_enabled = false
70+
stream_enabled = true
71+
stream_view_type = "OLD_IMAGE"
7072
ttl_enabled = true
7173
ttl_attribute_name = "TTL"
7274
point_in_time_recovery_enabled = !local.is_sandbox

‎infrastructure/ecs.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -90,10 +90,10 @@ module "ndr-ecs-fargate-ods-update" {
9090
"value" : terraform.workspace
9191
}
9292
]
93-
ecs_container_definition_memory = 512
94-
ecs_container_definition_cpu = 256
95-
ecs_task_definition_memory = 512
96-
ecs_task_definition_cpu = 256
93+
ecs_container_definition_memory = 5120
94+
ecs_container_definition_cpu = 1024
95+
ecs_task_definition_memory = 5120
96+
ecs_task_definition_cpu = 1024
9797
}
9898

9999
resource "aws_iam_role" "ods_weekly_update_task_role" {

‎infrastructure/kms_sns.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,5 +5,5 @@ module "sns_encryption_key" {
55
current_account_id = data.aws_caller_identity.current.account_id
66
environment = var.environment
77
owner = var.owner
8-
identifiers = ["sns.amazonaws.com", "cloudwatch.amazonaws.com"]
8+
service_identifiers = ["sns.amazonaws.com", "cloudwatch.amazonaws.com"]
99
}

‎infrastructure/lambda-data-collection.tf‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,12 @@ module "data-collection-alarm-topic" {
4141
}
4242

4343
module "data-collection-lambda" {
44-
source = "./modules/lambda"
45-
name = "DataCollectionLambda"
46-
handler = "handlers.data_collection_handler.lambda_handler"
47-
lambda_timeout = 900
44+
source = "./modules/lambda"
45+
name = "DataCollectionLambda"
46+
handler = "handlers.data_collection_handler.lambda_handler"
47+
lambda_timeout = 900
48+
lambda_ephemeral_storage = local.is_production ? 10240 : 1769
49+
memory_size = local.is_production ? 10240 : 1769
4850
iam_role_policy_documents = [
4951
module.ndr-app-config.app_config_policy,
5052
module.statistics_dynamodb_table.dynamodb_read_policy_document,

‎infrastructure/lambda-delete-doc-object.tf‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
module "delete-document-object-alarm" {
2+
source = "./modules/lambda_alarms"
3+
lambda_function_name = module.delete-document-object-lambda.function_name
4+
lambda_timeout = module.delete-document-object-lambda.timeout
5+
lambda_name = "delete_document_object_handler"
6+
namespace = "AWS/Lambda"
7+
alarm_actions = [module.delete-document-object-alarm-topic.arn]
8+
ok_actions = [module.delete-document-object-alarm-topic.arn]
9+
}
10+
11+
module "delete-document-object-alarm-topic" {
12+
source = "./modules/sns"
13+
sns_encryption_key_id = module.sns_encryption_key.id
14+
current_account_id = data.aws_caller_identity.current.account_id
15+
topic_name = "delete-document-object-topic"
16+
topic_protocol = "lambda"
17+
topic_endpoint = module.delete-document-object-lambda.lambda_arn
18+
delivery_policy = jsonencode({
19+
"Version" : "2012-10-17",
20+
"Statement" : [
21+
{
22+
"Effect" : "Allow",
23+
"Principal" : {
24+
"Service" : "cloudwatch.amazonaws.com"
25+
},
26+
"Action" : [
27+
"SNS:Publish",
28+
],
29+
"Condition" : {
30+
"ArnLike" : {
31+
"aws:SourceArn" : "arn:aws:cloudwatch:eu-west-2:${data.aws_caller_identity.current.account_id}:alarm:*"
32+
}
33+
}
34+
"Resource" : "*"
35+
}
36+
]
37+
})
38+
}
39+
40+
module "delete-document-object-lambda" {
41+
source = "./modules/lambda"
42+
name = "DeleteDocumentObjectS3"
43+
handler = "handlers.delete_document_object_handler.lambda_handler"
44+
lambda_timeout = 900
45+
iam_role_policy_documents = [
46+
module.document_reference_dynamodb_table.dynamodb_read_policy_document,
47+
module.document_reference_dynamodb_table.dynamodb_write_policy_document,
48+
module.ndr-document-store.s3_read_policy_document,
49+
module.ndr-document-store.s3_write_policy_document,
50+
module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
51+
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
52+
module.ndr-lloyd-george-store.s3_read_policy_document,
53+
module.ndr-lloyd-george-store.s3_write_policy_document,
54+
module.ndr-app-config.app_config_policy,
55+
aws_iam_policy.dynamodb_stream_delete_object_policy.policy
56+
]
57+
rest_api_id = null
58+
api_execution_arn = null
59+
lambda_environment_variables = {
60+
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
61+
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
62+
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
63+
WORKSPACE = terraform.workspace
64+
}
65+
is_gateway_integration_needed = false
66+
is_invoked_from_gateway = false
67+
}
68+
69+
resource "aws_iam_policy" "dynamodb_stream_delete_object_policy" {
70+
name = "${terraform.workspace}_dynamodb_stream_to_delete_records_policy"
71+
72+
policy = jsonencode({
73+
Version = "2012-10-17"
74+
Statement = [
75+
{
76+
Action = ["dynamodb:GetRecords", "dynamodb:GetShardIterator", "dynamodb:DescribeStream", "dynamodb:ListStreams"]
77+
Effect = "Allow"
78+
Resource = [
79+
module.lloyd_george_reference_dynamodb_table.dynamodb_stream_arn,
80+
module.document_reference_dynamodb_table.dynamodb_stream_arn
81+
]
82+
},
83+
]
84+
})
85+
}
86+
87+
resource "aws_lambda_event_source_mapping" "lloyd_george_dynamodb_stream" {
88+
event_source_arn = module.lloyd_george_reference_dynamodb_table.dynamodb_stream_arn
89+
function_name = module.delete-document-object-lambda.lambda_arn
90+
batch_size = 1
91+
starting_position = "LATEST"
92+
93+
filter_criteria {
94+
filter {
95+
pattern = jsonencode({
96+
"eventName" : [
97+
"REMOVE"
98+
]
99+
})
100+
}
101+
}
102+
}
103+
104+
resource "aws_lambda_event_source_mapping" "document_reference_dynamodb_stream" {
105+
event_source_arn = module.document_reference_dynamodb_table.dynamodb_stream_arn
106+
function_name = module.delete-document-object-lambda.lambda_arn
107+
batch_size = 1
108+
starting_position = "LATEST"
109+
110+
filter_criteria {
111+
filter {
112+
pattern = jsonencode({
113+
"eventName" : [
114+
"REMOVE"
115+
]
116+
})
117+
}
118+
}
119+
}

‎infrastructure/lambda-mns-notification.tf‎

Lines changed: 103 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,103 @@
1+
module "mns-notification-lambda" {
2+
count = local.is_sandbox ? 0 : 1
3+
source = "./modules/lambda"
4+
name = "MNSNotificationLambda"
5+
handler = "handlers.mns_notification_handler.lambda_handler"
6+
iam_role_policy_documents = [
7+
module.sqs-mns-notification-queue[0].sqs_read_policy_document,
8+
module.sqs-mns-notification-queue[0].sqs_write_policy_document,
9+
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
10+
module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
11+
aws_iam_policy.ssm_access_policy.policy,
12+
module.ndr-app-config.app_config_policy,
13+
aws_iam_policy.kms_mns_lambda_access[0].policy,
14+
]
15+
rest_api_id = null
16+
api_execution_arn = null
17+
18+
lambda_environment_variables = {
19+
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
20+
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
21+
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
22+
WORKSPACE = terraform.workspace
23+
LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
24+
MNS_NOTIFICATION_QUEUE_URL = module.sqs-mns-notification-queue[0].sqs_url
25+
PDS_FHIR_IS_STUBBED = local.is_sandbox
26+
}
27+
28+
is_gateway_integration_needed = false
29+
is_invoked_from_gateway = false
30+
lambda_timeout = 900
31+
reserved_concurrent_executions = local.mns_notification_lambda_concurrent_limit
32+
}
33+
34+
resource "aws_lambda_event_source_mapping" "mns_notification_lambda" {
35+
count = local.is_sandbox ? 0 : 1
36+
event_source_arn = module.sqs-mns-notification-queue[0].endpoint
37+
function_name = module.mns-notification-lambda[0].lambda_arn
38+
39+
scaling_config {
40+
maximum_concurrency = local.mns_notification_lambda_concurrent_limit
41+
}
42+
}
43+
44+
module "mns-notification-alarm" {
45+
count = local.is_sandbox ? 0 : 1
46+
source = "./modules/lambda_alarms"
47+
lambda_function_name = module.mns-notification-lambda[0].function_name
48+
lambda_timeout = module.mns-notification-lambda[0].timeout
49+
lambda_name = "mns_notification_handler"
50+
namespace = "AWS/Lambda"
51+
alarm_actions = [module.mns-notification-alarm-topic[0].arn]
52+
ok_actions = [module.mns-notification-alarm-topic[0].arn]
53+
}
54+
55+
module "mns-notification-alarm-topic" {
56+
count = local.is_sandbox ? 0 : 1
57+
source = "./modules/sns"
58+
sns_encryption_key_id = module.sns_encryption_key.id
59+
current_account_id = data.aws_caller_identity.current.account_id
60+
topic_name = "mns-notification-topic"
61+
topic_protocol = "lambda"
62+
topic_endpoint = module.mns-notification-lambda[0].lambda_arn
63+
delivery_policy = jsonencode({
64+
"Version" : "2012-10-17",
65+
"Statement" : [
66+
{
67+
"Effect" : "Allow",
68+
"Principal" : {
69+
"Service" : "cloudwatch.amazonaws.com"
70+
},
71+
"Action" : [
72+
"SNS:Publish",
73+
],
74+
"Condition" : {
75+
"ArnLike" : {
76+
"aws:SourceArn" : "arn:aws:cloudwatch:eu-west-2:${data.aws_caller_identity.current.account_id}:alarm:*"
77+
}
78+
}
79+
"Resource" : "*"
80+
}
81+
]
82+
})
83+
}
84+
85+
resource "aws_iam_policy" "kms_mns_lambda_access" {
86+
count = local.is_sandbox ? 0 : 1
87+
88+
name = "${terraform.workspace}_mns_notification_lambda_access_policy"
89+
description = "KMS policy to allow lambda to read MNS SQS messages"
90+
91+
policy = jsonencode({
92+
Version = "2012-10-17"
93+
Statement = [
94+
{
95+
Action = [
96+
"kms:Decrypt",
97+
]
98+
Effect = "Allow"
99+
Resource = module.mns_encryption_key[0].kms_arn
100+
},
101+
]
102+
})
103+
}

‎infrastructure/lambda-statistical-report.tf‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,12 @@ module "statistical-report-alarm-topic" {
4141
}
4242

4343
module "statistical-report-lambda" {
44-
source = "./modules/lambda"
45-
name = "StatisticalReportLambda"
46-
handler = "handlers.statistical_report_handler.lambda_handler"
47-
lambda_timeout = 900
44+
source = "./modules/lambda"
45+
name = "StatisticalReportLambda"
46+
handler = "handlers.statistical_report_handler.lambda_handler"
47+
lambda_timeout = 900
48+
lambda_ephemeral_storage = local.is_production ? 10240 : 1769
49+
memory_size = local.is_production ? 10240 : 1769
4850
iam_role_policy_documents = [
4951
module.ndr-app-config.app_config_policy,
5052
module.statistics_dynamodb_table.dynamodb_read_policy_document,

0 commit comments

Comments
 (0)