Skip to content

Commit 221f80a

Browse files
nhsd-angel-pastornhsd-angel-pastor
committed
CMM-13767: move file scanner lambda
1 parent 5c029e9 commit 221f80a

35 files changed

+2390
-0
lines changed

‎infrastructure/terraform/components/dl/README.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ No requirements.
1616
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
1717
| <a name="input_component"></a> [component](#input\_component) | The variable encapsulating the name of this component | `string` | `"dl"` | no |
1818
| <a name="input_core_notify_url"></a> [core\_notify\_url](#input\_core\_notify\_url) | The URL used to send requests to Notify | `string` | `"https://sandbox.api.service.nhs.uk"` | no |
19+
| <a name="input_default_cloudwatch_event_bus_name"></a> [default\_cloudwatch\_event\_bus\_name](#input\_default\_cloudwatch\_event\_bus\_name) | The name of the default cloudwatch event bus. This is needed as GuardDuty Scan Result events are sent to the default bus | `string` | `"default"` | no |
1920
| <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
2021
| <a name="input_enable_dynamodb_delete_protection"></a> [enable\_dynamodb\_delete\_protection](#input\_enable\_dynamodb\_delete\_protection) | Enable DynamoDB Delete Protection on all Tables | `bool` | `true` | no |
2122
| <a name="input_enable_mock_mesh"></a> [enable\_mock\_mesh](#input\_enable\_mock\_mesh) | Enable mock mesh access (dev only). Grants lambda permission to read mock-mesh prefix in non-pii bucket. | `bool` | `false` | no |
@@ -48,17 +49,21 @@ No requirements.
4849
| <a name="module_lambda_lambda_apim_refresh_token"></a> [lambda\_lambda\_apim\_refresh\_token](#module\_lambda\_lambda\_apim\_refresh\_token) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
4950
| <a name="module_mesh_download"></a> [mesh\_download](#module\_mesh\_download) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5051
| <a name="module_mesh_poll"></a> [mesh\_poll](#module\_mesh\_poll) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
52+
| <a name="module_move_scanned_files"></a> [move\_scanned\_files](#module\_move\_scanned\_files) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5153
| <a name="module_pdm_mock"></a> [pdm\_mock](#module\_pdm\_mock) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5254
| <a name="module_pdm_poll"></a> [pdm\_poll](#module\_pdm\_poll) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5355
| <a name="module_pdm_uploader"></a> [pdm\_uploader](#module\_pdm\_uploader) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5456
| <a name="module_s3bucket_cf_logs"></a> [s3bucket\_cf\_logs](#module\_s3bucket\_cf\_logs) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
57+
| <a name="module_s3bucket_file_quarantine"></a> [s3bucket\_file\_quarantine](#module\_s3bucket\_file\_quarantine) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
58+
| <a name="module_s3bucket_file_safe"></a> [s3bucket\_file\_safe](#module\_s3bucket\_file\_safe) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
5559
| <a name="module_s3bucket_letters"></a> [s3bucket\_letters](#module\_s3bucket\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
5660
| <a name="module_s3bucket_non_pii_data"></a> [s3bucket\_non\_pii\_data](#module\_s3bucket\_non\_pii\_data) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
5761
| <a name="module_s3bucket_pii_data"></a> [s3bucket\_pii\_data](#module\_s3bucket\_pii\_data) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
5862
| <a name="module_s3bucket_static_assets"></a> [s3bucket\_static\_assets](#module\_s3bucket\_static\_assets) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
5963
| <a name="module_sqs_core_notifier"></a> [sqs\_core\_notifier](#module\_sqs\_core\_notifier) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
6064
| <a name="module_sqs_event_publisher_errors"></a> [sqs\_event\_publisher\_errors](#module\_sqs\_event\_publisher\_errors) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
6165
| <a name="module_sqs_mesh_download"></a> [sqs\_mesh\_download](#module\_sqs\_mesh\_download) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
66+
| <a name="module_sqs_move_scanned_files"></a> [sqs\_move\_scanned\_files](#module\_sqs\_move\_scanned\_files) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
6267
| <a name="module_sqs_pdm_poll"></a> [sqs\_pdm\_poll](#module\_sqs\_pdm\_poll) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
6368
| <a name="module_sqs_pdm_uploader"></a> [sqs\_pdm\_uploader](#module\_sqs\_pdm\_uploader) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
6469
| <a name="module_sqs_scanner"></a> [sqs\_scanner](#module\_sqs\_scanner) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |

‎infrastructure/terraform/components/dl/cloudwatch_event_rule_guardduty_scan_result.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
resource "aws_cloudwatch_event_rule" "guardduty_scan_result" {
2+
name = "${local.csi}-guardduty_scan_result"
3+
description = "guardduty Scan Result event rule"
4+
event_bus_name = var.default_cloudwatch_event_bus_name
5+
event_pattern = jsonencode({
6+
"source": ["aws.guardduty"]
7+
"detail" : {
8+
"resourceType": ["S3_OBJECT"],
9+
"s3ObjectDetails": {
10+
"bucketName": [ local.unscanned_files_bucket ],
11+
"objectKey": [{ "prefix": "${var.environment}/" }]
12+
}
13+
}
14+
})
15+
}
16+
17+
resource "aws_cloudwatch_event_target" "guardduty_scan_result_move_scanned_files" {
18+
rule = aws_cloudwatch_event_rule.guardduty_scan_result.name
19+
arn = module.sqs_move_scanned_files.sqs_queue_arn
20+
event_bus_name = var.default_cloudwatch_event_bus_name
21+
}

‎infrastructure/terraform/components/dl/lambda_event_source_mapping_move_scanned_files_lambda.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
resource "aws_lambda_event_source_mapping" "move_scanned_files_lambda" {
2+
event_source_arn = module.sqs_move_scanned_files.sqs_queue_arn
3+
function_name = module.move_scanned_files.function_arn
4+
batch_size = var.queue_batch_size
5+
maximum_batching_window_in_seconds = var.queue_batch_window_seconds
6+
7+
function_response_types = [
8+
"ReportBatchItemFailures"
9+
]
10+
}

‎infrastructure/terraform/components/dl/module_lambda_move_scanned_files.tf‎

Lines changed: 163 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,163 @@
1+
module "move_scanned_files" {
2+
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip"
3+
4+
function_name = "move-scanned-files"
5+
description = "A function to send messages to NOTE: update description"
6+
7+
aws_account_id = var.aws_account_id
8+
component = local.component
9+
environment = var.environment
10+
project = var.project
11+
region = var.region
12+
group = var.group
13+
14+
log_retention_in_days = var.log_retention_in_days
15+
kms_key_arn = module.kms.key_arn
16+
17+
iam_policy_document = {
18+
body = data.aws_iam_policy_document.move_scanned_files.json
19+
}
20+
21+
function_s3_bucket = local.acct.s3_buckets["lambda_function_artefacts"]["id"]
22+
function_code_base_path = local.aws_lambda_functions_dir_path
23+
function_code_dir = "move-scanned-files-lambda/dist"
24+
function_include_common = true
25+
handler_function_name = "handler"
26+
runtime = "nodejs22.x"
27+
memory = 128
28+
timeout = 60
29+
log_level = var.log_level
30+
31+
force_lambda_code_deploy = var.force_lambda_code_deploy
32+
enable_lambda_insights = false
33+
34+
log_destination_arn = local.log_destination_arn
35+
log_subscription_role_arn = local.acct.log_subscription_role_arn
36+
37+
lambda_env_vars = {
38+
"EVENT_PUBLISHER_EVENT_BUS_ARN" = aws_cloudwatch_event_bus.main.arn
39+
"EVENT_PUBLISHER_DLQ_URL" = module.sqs_event_publisher_errors.sqs_queue_url
40+
"ENVIRONMENT" = var.environment
41+
"KEY_PREFIX_UNSCANNED_FILES" = var.environment
42+
"UNSCANNED_FILE_S3_BUCKET_NAME" = local.unscanned_files_bucket
43+
"SAFE_FILE_S3_BUCKET_NAME" = module.s3bucket_file_safe.bucket
44+
"QUARANTINE_FILE_S3_BUCKET_NAME" = module.s3bucket_file_quarantine.bucket
45+
}
46+
}
47+
48+
data "aws_iam_policy_document" "move_scanned_files" {
49+
statement {
50+
sid = "AllowSSMParam"
51+
effect = "Allow"
52+
53+
actions = [
54+
"ssm:GetParameter",
55+
"ssm:GetParameters",
56+
"ssm:GetParametersByPath"
57+
]
58+
59+
resources = [
60+
"arn:aws:ssm:${var.region}:${var.aws_account_id}:parameter/${var.component}/${var.environment}/apim/*",
61+
]
62+
}
63+
64+
statement {
65+
sid = "KMSPermissions"
66+
effect = "Allow"
67+
68+
actions = [
69+
"kms:Decrypt",
70+
"kms:GenerateDataKey",
71+
]
72+
73+
resources = [
74+
module.kms.key_arn,
75+
]
76+
}
77+
78+
statement {
79+
sid = "SQSPermissionsFileScannerMoveScannedFiles"
80+
effect = "Allow"
81+
82+
actions = [
83+
"sqs:ReceiveMessage",
84+
"sqs:DeleteMessage",
85+
"sqs:GetQueueAttributes",
86+
"sqs:GetQueueUrl",
87+
]
88+
89+
resources = [
90+
module.sqs_move_scanned_files.sqs_queue_arn,
91+
]
92+
}
93+
94+
statement {
95+
sid = "PutEvents"
96+
effect = "Allow"
97+
98+
actions = [
99+
"events:PutEvents",
100+
]
101+
102+
resources = [
103+
aws_cloudwatch_event_bus.main.arn,
104+
]
105+
}
106+
107+
statement {
108+
sid = "SQSPermissionsDLQ"
109+
effect = "Allow"
110+
111+
actions = [
112+
"sqs:SendMessage",
113+
"sqs:SendMessageBatch",
114+
]
115+
116+
resources = [
117+
module.sqs_event_publisher_errors.sqs_queue_arn,
118+
]
119+
}
120+
121+
statement {
122+
sid = "PermissionsToUnscannedBucket"
123+
effect = "Allow"
124+
125+
actions = [
126+
"s3:GetObject",
127+
"s3:GetObjectVersion",
128+
"s3:DeleteObject",
129+
"s3:DeleteObjectVersion"
130+
]
131+
132+
resources = [
133+
"arn:aws:s3:::${local.unscanned_files_bucket}/*",
134+
]
135+
}
136+
137+
statement {
138+
sid = "PermissionsToSafeFileBucket"
139+
effect = "Allow"
140+
141+
actions = [
142+
"s3:PutObject",
143+
]
144+
145+
resources = [
146+
"${module.s3bucket_file_safe.arn}/*"
147+
]
148+
}
149+
150+
statement {
151+
sid = "PermissionsToQuarantineFileBucket"
152+
effect = "Allow"
153+
154+
actions = [
155+
"s3:PutObject",
156+
]
157+
158+
resources = [
159+
"${module.s3bucket_file_quarantine.arn}/*"
160+
]
161+
}
162+
163+
}

‎infrastructure/terraform/components/dl/module_s3bucket_file_quarantine.tf‎

Lines changed: 104 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,104 @@
1+
module "s3bucket_file_quarantine" {
2+
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip"
3+
4+
name = "file-quarantine"
5+
6+
aws_account_id = var.aws_account_id
7+
region = var.region
8+
project = var.project
9+
environment = var.environment
10+
component = local.component
11+
12+
kms_key_arn = module.kms.key_arn
13+
14+
policy_documents = [data.aws_iam_policy_document.s3bucket_file_quarantine.json]
15+
16+
force_destroy = var.force_destroy
17+
18+
lifecycle_rules = [
19+
{
20+
enabled = true
21+
22+
expiration = {
23+
days = "90"
24+
}
25+
26+
noncurrent_version_transition = [
27+
{
28+
noncurrent_days = "30"
29+
storage_class = "STANDARD_IA"
30+
}
31+
]
32+
33+
noncurrent_version_expiration = {
34+
noncurrent_days = "90"
35+
}
36+
37+
abort_incomplete_multipart_upload = {
38+
days = "1"
39+
}
40+
}
41+
]
42+
}
43+
44+
data "aws_iam_policy_document" "s3bucket_file_quarantine" {
45+
statement {
46+
sid = "AllowManagedAccountsToList"
47+
effect = "Allow"
48+
49+
actions = [
50+
"s3:ListBucket",
51+
]
52+
53+
resources = [
54+
module.s3bucket_file_quarantine.arn,
55+
]
56+
57+
principals {
58+
type = "AWS"
59+
identifiers = [
60+
"arn:aws:iam::${var.aws_account_id}:root"
61+
]
62+
}
63+
}
64+
65+
statement {
66+
sid = "AllowManagedAccountsToGet"
67+
effect = "Allow"
68+
69+
actions = [
70+
"s3:GetObject",
71+
]
72+
73+
resources = [
74+
"${module.s3bucket_file_quarantine.arn}/*",
75+
]
76+
77+
principals {
78+
type = "AWS"
79+
identifiers = [
80+
"arn:aws:iam::${var.aws_account_id}:root"
81+
]
82+
}
83+
}
84+
85+
statement {
86+
sid = "AllowManagedAccountsToPut"
87+
effect = "Allow"
88+
89+
actions = [
90+
"s3:PutObject",
91+
]
92+
93+
resources = [
94+
"${module.s3bucket_file_quarantine.arn}/*",
95+
]
96+
97+
principals {
98+
type = "AWS"
99+
identifiers = [
100+
"arn:aws:iam::${var.aws_account_id}:root"
101+
]
102+
}
103+
}
104+
}

0 commit comments

Comments
 (0)