Skip to content

Commit f97f101

Browse files
NogaNHSNogaNHS
authored
PRMDR-366 Connect to Splunk Publisher (#90)
* [PRMDR-366] refactor sandbox variables * [PRMDR-366] migrate splunk access policy * [PRMDR-366] added sqs permission to lambdas
1 parent 24f2163 commit f97f101

File tree

13 files changed

+147
-23
lines changed

13 files changed

+147
-23
lines changed

‎infrastructure/README.md‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88

99
| Name | Version |
1010
|------|---------|
11-
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.16.0 |
11+
| <a name="provider_aws"></a> [aws](#provider\_aws) | 5.14.0 |
1212

1313
## Modules
1414

@@ -26,6 +26,7 @@
2626
| <a name="module_back_channel_logout_lambda"></a> [back\_channel\_logout\_lambda](#module\_back\_channel\_logout\_lambda) | ./modules/lambda | n/a |
2727
| <a name="module_bulk-upload-lambda"></a> [bulk-upload-lambda](#module\_bulk-upload-lambda) | ./modules/lambda | n/a |
2828
| <a name="module_bulk-upload-metadata-lambda"></a> [bulk-upload-metadata-lambda](#module\_bulk-upload-metadata-lambda) | ./modules/lambda | n/a |
29+
| <a name="module_bulk-upload-report-lambda"></a> [bulk-upload-report-lambda](#module\_bulk-upload-report-lambda) | ./modules/lambda | n/a |
2930
| <a name="module_bulk_upload_dynamodb_table"></a> [bulk\_upload\_dynamodb\_table](#module\_bulk\_upload\_dynamodb\_table) | ./modules/dynamo_db | n/a |
3031
| <a name="module_create-doc-ref-gateway"></a> [create-doc-ref-gateway](#module\_create-doc-ref-gateway) | ./modules/gateway | n/a |
3132
| <a name="module_create-doc-ref-lambda"></a> [create-doc-ref-lambda](#module\_create-doc-ref-lambda) | ./modules/lambda | n/a |
@@ -92,17 +93,28 @@
9293
| [aws_api_gateway_resource.auth_resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_resource) | resource |
9394
| [aws_api_gateway_resource.login_resource](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_resource) | resource |
9495
| [aws_api_gateway_rest_api.ndr_doc_store_api](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/api_gateway_rest_api) | resource |
96+
| [aws_cloudwatch_event_rule.bulk_upload_metadata_schedule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
97+
| [aws_cloudwatch_event_rule.bulk_upload_report_schedule](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_rule) | resource |
98+
| [aws_cloudwatch_event_target.bulk_upload_metadata_schedule_event](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
99+
| [aws_cloudwatch_event_target.bulk_upload_report_schedule_event](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_event_target) | resource |
95100
| [aws_cloudwatch_metric_alarm.repo_alarm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_metric_alarm) | resource |
101+
| [aws_iam_policy.dynamodb_policy_scan_bulk_report](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
102+
| [aws_iam_policy.lambda_audit_splunk_sqs_queue_send_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
96103
| [aws_iam_policy.ssm_policy_authoriser](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
97104
| [aws_iam_policy.ssm_policy_oidc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
98105
| [aws_iam_policy.ssm_policy_pds](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
99106
| [aws_iam_policy.ssm_policy_token](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
107+
| [aws_iam_role.splunk_sqs_forwarder](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
100108
| [aws_lambda_event_source_mapping.bulk_upload_lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_event_source_mapping) | resource |
109+
| [aws_lambda_permission.bulk_upload_metadata_schedule_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
110+
| [aws_lambda_permission.bulk_upload_report_schedule_permission](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_permission) | resource |
101111
| [aws_s3_bucket_lifecycle_configuration.doc-store-lifecycle-rules](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
102112
| [aws_s3_bucket_lifecycle_configuration.lg-lifecycle-rules](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_lifecycle_configuration) | resource |
103113
| [aws_wafv2_web_acl_association.web_acl_association](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/wafv2_web_acl_association) | resource |
104114
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
105115
| [aws_iam_policy_document.alarm_notification_kms_key_policy_doc](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
116+
| [aws_iam_policy_document.splunk_trust_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
117+
| [aws_ssm_parameter.splunk_trusted_principal](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/ssm_parameter) | data source |
106118

107119
## Inputs
108120

@@ -113,6 +125,7 @@
113125
| <a name="input_availability_zones"></a> [availability\_zones](#input\_availability\_zones) | This is a list that specifies all the Availability Zones that will have a pair of public and private subnets | `list(string)` | <pre>[<br> "eu-west-2a",<br> "eu-west-2b",<br> "eu-west-2c"<br>]</pre> | no |
114126
| <a name="input_bulk_upload_dynamodb_table_name"></a> [bulk\_upload\_dynamodb\_table\_name](#input\_bulk\_upload\_dynamodb\_table\_name) | The name of dynamodb table to store bulk upload status | `string` | `"BulkUploadReport"` | no |
115127
| <a name="input_certificate_domain"></a> [certificate\_domain](#input\_certificate\_domain) | n/a | `string` | n/a | yes |
128+
| <a name="input_cloud_only_service_instances"></a> [cloud\_only\_service\_instances](#input\_cloud\_only\_service\_instances) | n/a | `number` | `1` | no |
116129
| <a name="input_docstore_bucket_name"></a> [docstore\_bucket\_name](#input\_docstore\_bucket\_name) | The name of S3 bucket to store ARF documents | `string` | `"document-store"` | no |
117130
| <a name="input_docstore_dynamodb_table_name"></a> [docstore\_dynamodb\_table\_name](#input\_docstore\_dynamodb\_table\_name) | The name of dynamodb table to store the metadata of ARF documents | `string` | `"DocumentReferenceMetadata"` | no |
118131
| <a name="input_domain"></a> [domain](#input\_domain) | n/a | `string` | n/a | yes |

‎infrastructure/audit.tf‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
data "aws_ssm_parameter" "splunk_trusted_principal" {
2+
name = "/prs/user-input/external/splunk-trusted-principal"
3+
count = var.cloud_only_service_instances
4+
}
5+
6+
data "aws_iam_policy_document" "splunk_trust_policy" {
7+
statement {
8+
actions = ["sts:AssumeRole"]
9+
principals {
10+
type = "AWS"
11+
identifiers = var.cloud_only_service_instances > 0 ? split(",", data.aws_ssm_parameter.splunk_trusted_principal[0].value) : []
12+
}
13+
}
14+
}
15+
16+
resource "aws_iam_role" "splunk_sqs_forwarder" {
17+
count = local.is_sandbox ? 0 : 1
18+
name = "${terraform.workspace}_splunk_sqs_forwarder_role"
19+
description = "Role to allow ARF to integrate with Splunk"
20+
assume_role_policy = data.aws_iam_policy_document.splunk_trust_policy.json
21+
inline_policy {
22+
name = "${terraform.workspace}_splunk_access_policy"
23+
policy = jsonencode({
24+
Version = "2012-10-17"
25+
Statement = [
26+
{
27+
effect = "Allow"
28+
actions = [
29+
"sqs:GetQueueAttributes",
30+
"sqs:ListQueues",
31+
"sqs:ReceiveMessage",
32+
"sqs:GetQueueUrl",
33+
"sqs:SendMessage",
34+
"sqs:DeleteMessage"
35+
]
36+
resources = [
37+
module.sqs-splunk-queue.sqs_arn,
38+
module.sqs-nems-queue.sqs_arn
39+
]
40+
}
41+
]
42+
})
43+
}
44+
}
45+
46+
resource "aws_iam_policy" "lambda_audit_splunk_sqs_queue_send_policy" {
47+
policy = jsonencode({
48+
Version = "2012-10-17"
49+
Statement = [{
50+
"Sid" = "shsqsstatement",
51+
"Effect" = "Allow",
52+
"Action" = [
53+
"sqs:SendMessage",
54+
],
55+
"Resource" = [
56+
module.sqs-splunk-queue.sqs_arn
57+
]
58+
}] })
59+
}

‎infrastructure/buckets.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ module "ndr-document-store" {
55
enable_cors_configuration = true
66
environment = var.environment
77
owner = var.owner
8-
force_destroy = contains(["ndra", "ndrb", "ndrc", "ndrd", "ndr-test"], terraform.workspace)
8+
force_destroy = local.is_force_destroy
99
cors_rules = [
1010
{
1111
allowed_headers = ["*"]
@@ -28,7 +28,7 @@ module "ndr-zip-request-store" {
2828
enable_cors_configuration = true
2929
environment = var.environment
3030
owner = var.owner
31-
force_destroy = contains(["ndra", "ndrb", "ndrc", "ndrd", "ndr-test"], terraform.workspace)
31+
force_destroy = local.is_force_destroy
3232
cors_rules = [
3333
{
3434
allowed_methods = ["GET"]
@@ -44,7 +44,7 @@ module "ndr-lloyd-george-store" {
4444
enable_cors_configuration = true
4545
environment = var.environment
4646
owner = var.owner
47-
force_destroy = contains(["ndra", "ndrb", "ndrc", "ndrd", "ndr-test"], terraform.workspace)
47+
force_destroy = local.is_force_destroy
4848
cors_rules = [
4949
{
5050
allowed_headers = ["*"]
@@ -164,6 +164,6 @@ module "ndr-bulk-staging-store" {
164164
bucket_name = var.staging_store_bucket_name
165165
environment = var.environment
166166
owner = var.owner
167-
force_destroy = contains(["ndra", "ndrb", "ndrc", "ndrd", "ndr-test"], terraform.workspace)
167+
force_destroy = local.is_force_destroy
168168
enable_cors_configuration = false
169169
}

‎infrastructure/lambda-bulk-upload.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ module "bulk-upload-lambda" {
2323
BULK_UPLOAD_DYNAMODB_NAME = "${terraform.workspace}_${var.bulk_upload_dynamodb_table_name}"
2424
METADATA_SQS_QUEUE_URL = module.sqs-lg-bulk-upload-metadata-queue.sqs_url
2525
INVALID_SQS_QUEUE_URL = module.sqs-lg-bulk-upload-invalid-queue.sqs_url
26-
PDS_FHIR_IS_STUBBED = contains(["ndra", "ndrb", "ndrc", "ndrd"], terraform.workspace)
26+
PDS_FHIR_IS_STUBBED = local.is_sandbox
2727
}
2828

2929
is_gateway_integration_needed = false

‎infrastructure/lambda-document-manifest-by-nhs-number.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,7 @@ module "document-manifest-by-nhs-number-lambda" {
7272
module.ndr-lloyd-george-store.s3_object_access_policy,
7373
module.zip_store_reference_dynamodb_table.dynamodb_policy,
7474
module.ndr-zip-request-store.s3_object_access_policy,
75+
aws_iam_policy.lambda_audit_splunk_sqs_queue_send_policy.arn,
7576
"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
7677
"arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy"
7778
]
@@ -86,6 +87,8 @@ module "document-manifest-by-nhs-number-lambda" {
8687
LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
8788
ZIPPED_STORE_BUCKET_NAME = "${terraform.workspace}-${var.zip_store_bucket_name}"
8889
ZIPPED_STORE_DYNAMODB_NAME = "${terraform.workspace}_${var.zip_store_dynamodb_table_name}"
90+
SPLUNK_SQS_QUEUE_URL = module.sqs-splunk-queue.sqs_url
91+
8992
}
9093
depends_on = [
9194
aws_api_gateway_rest_api.ndr_doc_store_api,

‎infrastructure/lambda-lloyd-george-record-stitch.tf‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -68,15 +68,18 @@ module "lloyd-george-stitch-lambda" {
6868
module.lloyd_george_reference_dynamodb_table.dynamodb_policy,
6969
module.ndr-lloyd-george-store.s3_object_access_policy,
7070
"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
71-
"arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy"
71+
"arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy",
72+
aws_iam_policy.lambda_audit_splunk_sqs_queue_send_policy.arn
7273
]
7374
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
7475
resource_id = module.lloyd-george-stitch-gateway.gateway_resource_id
7576
http_method = "GET"
7677
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
7778
lambda_environment_variables = {
78-
LLOYD_GEORGE_BUCKET_NAME = "${terraform.workspace}-${var.lloyd_george_bucket_name}"
79-
LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}" }
79+
LLOYD_GEORGE_BUCKET_NAME = "${terraform.workspace}-${var.lloyd_george_bucket_name}"
80+
LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
81+
SPLUNK_SQS_QUEUE_URL = module.sqs-splunk-queue.sqs_url
82+
}
8083
depends_on = [
8184
aws_api_gateway_rest_api.ndr_doc_store_api,
8285
module.ndr-lloyd-george-store,

‎infrastructure/lambda-search-patient.tf‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -66,14 +66,16 @@ module "search-patient-details-lambda" {
6666
iam_role_policies = [
6767
"arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole",
6868
"arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy",
69-
aws_iam_policy.ssm_policy_pds.arn
69+
aws_iam_policy.ssm_policy_pds.arn,
70+
aws_iam_policy.lambda_audit_splunk_sqs_queue_send_policy.arn
7071
]
7172
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
7273
resource_id = module.search-patient-details-gateway.gateway_resource_id
7374
http_method = "GET"
7475
lambda_environment_variables = {
75-
"PDS_FHIR_IS_STUBBED" = contains(["ndra", "ndrb", "ndrc", "ndrd"], terraform.workspace)
76-
"SSM_PARAM_JWT_TOKEN_PUBLIC_KEY" = "jwt_token_public_key"
76+
SSM_PARAM_JWT_TOKEN_PUBLIC_KEY = "jwt_token_public_key"
77+
PDS_FHIR_IS_STUBBED = local.is_sandbox,
78+
SPLUNK_SQS_QUEUE_URL = module.sqs-splunk-queue.sqs_url
7779
}
7880
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
7981
depends_on = [

‎infrastructure/lambda-token.tf‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,8 @@ module "create-token-lambda" {
2828
"arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy",
2929
aws_iam_policy.ssm_policy_token.arn,
3030
module.auth_session_dynamodb_table.dynamodb_policy,
31-
module.auth_state_dynamodb_table.dynamodb_policy
31+
module.auth_state_dynamodb_table.dynamodb_policy,
32+
aws_iam_policy.lambda_audit_splunk_sqs_queue_send_policy.arn
3233
]
3334

3435
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
@@ -41,6 +42,8 @@ module "create-token-lambda" {
4142
OIDC_CALLBACK_URL = "https://${terraform.workspace}.${var.domain}/auth-callback"
4243
AUTH_STATE_TABLE_NAME = "${terraform.workspace}_${var.auth_state_dynamodb_table_name}"
4344
AUTH_SESSION_TABLE_NAME = "${terraform.workspace}_${var.auth_session_dynamodb_table_name}"
45+
SPLUNK_SQS_QUEUE_URL = module.sqs-splunk-queue.sqs_url
46+
4447
}
4548
depends_on = [
4649
aws_api_gateway_rest_api.ndr_doc_store_api,

‎infrastructure/modules/sqs/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,14 @@ No modules.
2626
| <a name="input_delay"></a> [delay](#input\_delay) | The time in seconds that the delivery of all messages in the queue will be delayed | `number` | `0` | no |
2727
| <a name="input_enable_deduplication"></a> [enable\_deduplication](#input\_enable\_deduplication) | Prevent content based duplication in queue | `bool` | `false` | no |
2828
| <a name="input_enable_fifo"></a> [enable\_fifo](#input\_enable\_fifo) | Attach first in first out policy to sqs | `bool` | `false` | no |
29+
| <a name="input_enable_in_sandbox"></a> [enable\_in\_sandbox](#input\_enable\_in\_sandbox) | n/a | `bool` | `true` | no |
2930
| <a name="input_enable_sse"></a> [enable\_sse](#input\_enable\_sse) | Enable server-side encryption (SSE) of message content with SQS-owned encryption keys, requires kms resource for queue | `bool` | `true` | no |
31+
| <a name="input_environment"></a> [environment](#input\_environment) | Tags | `string` | n/a | yes |
3032
| <a name="input_max_message"></a> [max\_message](#input\_max\_message) | Max message size in bytes before sqs rejects the message | `number` | `2048` | no |
3133
| <a name="input_max_visibility"></a> [max\_visibility](#input\_max\_visibility) | Time in seconds during which Amazon SQS prevents all consumers from receiving and processing the message | `number` | `30` | no |
3234
| <a name="input_message_retention"></a> [message\_retention](#input\_message\_retention) | Number of seconds sqs keeps a message | `number` | `86400` | no |
3335
| <a name="input_name"></a> [name](#input\_name) | n/a | `string` | n/a | yes |
36+
| <a name="input_owner"></a> [owner](#input\_owner) | n/a | `string` | n/a | yes |
3437
| <a name="input_receive_wait"></a> [receive\_wait](#input\_receive\_wait) | Number of seconds sqs will wait for a message when ReceiveMessage is received | `number` | `2` | no |
3538

3639
## Outputs

‎infrastructure/modules/sqs/main.tf‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
resource "aws_sqs_queue" "sqs_queue" {
2+
count = var.enable_in_sandbox ? 1 : 0
23
name = "${terraform.workspace}-${var.name}"
34
delay_seconds = var.delay
45
visibility_timeout_seconds = var.max_visibility
@@ -8,6 +9,12 @@ resource "aws_sqs_queue" "sqs_queue" {
89
sqs_managed_sse_enabled = var.enable_sse
910
fifo_queue = var.enable_fifo
1011
content_based_deduplication = var.enable_deduplication
12+
tags = {
13+
Name = "${terraform.workspace}-${var.name}"
14+
Owner = var.owner
15+
Environment = var.environment
16+
Workspace = terraform.workspace
17+
}
1118
}
1219

1320
resource "aws_iam_policy" "sqs_queue_policy" {
@@ -23,7 +30,7 @@ resource "aws_iam_policy" "sqs_queue_policy" {
2330
"sqs:GetQueueAttributes"
2431
],
2532
"Resource" = [
26-
aws_sqs_queue.sqs_queue.arn
33+
aws_sqs_queue.sqs_queue[0].arn
2734
]
2835
}] })
2936
}

0 commit comments

Comments
 (0)