Skip to content

Commit 963c085

Browse files
simonlabareresimonlabarere
committed
CCM-12615: APIM Authentication
1 parent 4601475 commit 963c085

File tree

6 files changed

+214
-0
lines changed

6 files changed

+214
-0
lines changed

‎infrastructure/terraform/components/dl/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ No requirements.
4040
| <a name="module_lambda_lambda_apim_refresh_token"></a> [lambda\_lambda\_apim\_refresh\_token](#module\_lambda\_lambda\_apim\_refresh\_token) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-lambda.zip | n/a |
4141
| <a name="module_mesh_poll"></a> [mesh\_poll](#module\_mesh\_poll) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip | n/a |
4242
| <a name="module_s3bucket_letters"></a> [s3bucket\_letters](#module\_s3bucket\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
43+
| <a name="module_s3bucket_static_assets"></a> [s3bucket\_static\_assets](#module\_s3bucket\_static\_assets) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-s3bucket.zip | n/a |
4344
| <a name="module_sqs_event_publisher_errors"></a> [sqs\_event\_publisher\_errors](#module\_sqs\_event\_publisher\_errors) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
4445
| <a name="module_sqs_ttl"></a> [sqs\_ttl](#module\_sqs\_ttl) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
4546
| <a name="module_sqs_ttl_handle_expiry_errors"></a> [sqs\_ttl\_handle\_expiry\_errors](#module\_sqs\_ttl\_handle\_expiry\_errors) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |

‎infrastructure/terraform/components/dl/acm_certificate_static_assets_hosting.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
resource "aws_acm_certificate" "static_assets_hosting" {
2+
provider = aws.us-east-1
3+
domain_name = local.root_domain_name
4+
validation_method = "DNS"
5+
6+
lifecycle {
7+
create_before_destroy = true
8+
}
9+
}
10+
11+
resource "aws_acm_certificate_validation" "static_assets_hosting" {
12+
provider = aws.us-east-1
13+
certificate_arn = aws_acm_certificate.static_assets_hosting.arn
14+
}

‎infrastructure/terraform/components/dl/cloudfront_distribution_static_assets_hosting.tf‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
resource "aws_cloudfront_distribution" "static_assets_hosting" {
2+
enabled = true
3+
is_ipv6_enabled = true
4+
comment = "Static asset hosting for Digital Letters"
5+
price_class = "PriceClass_100"
6+
7+
restrictions {
8+
geo_restriction {
9+
restriction_type = "whitelist"
10+
locations = ["GB"]
11+
}
12+
}
13+
14+
aliases = [local.root_domain_name]
15+
16+
viewer_certificate {
17+
cloudfront_default_certificate = false
18+
acm_certificate_arn = aws_acm_certificate.static_assets_hosting.arn
19+
minimum_protocol_version = "TLSv1.2_2021"
20+
ssl_support_method = "sni-only"
21+
}
22+
23+
logging_config {
24+
include_cookies = false
25+
bucket = module.s3bucket_cf_logs.bucket_regional_domain_name
26+
}
27+
28+
origin {
29+
domain_name = module.s3bucket_static_assets.bucket_regional_domain_name
30+
origin_id = "${local.csi}-origin-static-assets"
31+
s3_origin_config {
32+
origin_access_identity = aws_cloudfront_origin_access_identity.static_assets.cloudfront_access_identity_path
33+
}
34+
}
35+
36+
default_cache_behavior {
37+
allowed_methods = ["GET", "HEAD"]
38+
cached_methods = ["GET", "HEAD"]
39+
target_origin_id = "${local.csi}-origin-static-assets"
40+
41+
forwarded_values {
42+
query_string = false
43+
headers = ["Origin"]
44+
cookies {
45+
forward = "none"
46+
}
47+
}
48+
49+
viewer_protocol_policy = "redirect-to-https"
50+
min_ttl = 0
51+
default_ttl = 0
52+
max_ttl = 86400
53+
compress = true
54+
}
55+
}

‎infrastructure/terraform/components/dl/module_s3_bucket_static_assets.tf‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
module "s3bucket_static_assets" {
2+
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-s3bucket.zip"
3+
4+
name = "static-assets"
5+
6+
aws_account_id = var.aws_account_id
7+
region = "eu-west-2"
8+
project = var.project
9+
environment = var.environment
10+
component = var.component
11+
12+
acl = "private"
13+
force_destroy = var.force_destroy
14+
versioning = true
15+
16+
lifecycle_rules = [
17+
{
18+
enabled = true
19+
20+
noncurrent_version_transition = [
21+
{
22+
noncurrent_days = "30"
23+
storage_class = "STANDARD_IA"
24+
}
25+
]
26+
27+
noncurrent_version_expiration = {
28+
noncurrent_days = "90"
29+
}
30+
31+
abort_incomplete_multipart_upload = {
32+
days = "1"
33+
}
34+
}
35+
]
36+
37+
bucket_logging_target = {
38+
bucket = local.acct.s3_buckets["access_logs"]["id"]
39+
}
40+
41+
policy_documents = [
42+
data.aws_iam_policy_document.static_assets_bucket_policy.json
43+
]
44+
45+
public_access = {
46+
block_public_acls = true
47+
block_public_policy = true
48+
ignore_public_acls = true
49+
restrict_public_buckets = true
50+
}
51+
52+
53+
default_tags = {
54+
Name = "Digital Letters static assets bucket"
55+
}
56+
}
57+
58+
data "aws_iam_policy_document" "static_assets_bucket_policy" {
59+
statement {
60+
actions = ["s3:GetObject"]
61+
resources = [
62+
"${module.s3bucket_static_assets.arn}/*"
63+
]
64+
65+
principals {
66+
type = "AWS"
67+
identifiers = [aws_cloudfront_origin_access_identity.static_assets.iam_arn]
68+
}
69+
}
70+
71+
statement {
72+
actions = ["s3:ListBucket"]
73+
resources = [
74+
module.s3bucket_static_assets.arn
75+
]
76+
77+
principals {
78+
type = "AWS"
79+
identifiers = [aws_cloudfront_origin_access_identity.static_assets.iam_arn]
80+
}
81+
}
82+
83+
statement {
84+
effect = "Deny"
85+
actions = ["s3:*"]
86+
resources = [
87+
module.s3bucket_static_assets.arn,
88+
"${module.s3bucket_static_assets.arn}/*",
89+
]
90+
91+
principals {
92+
type = "AWS"
93+
identifiers = ["*"]
94+
}
95+
96+
condition {
97+
test = "Bool"
98+
variable = "aws:SecureTransport"
99+
values = [
100+
false
101+
]
102+
}
103+
}
104+
}
105+
106+
resource "aws_s3_bucket_cors_configuration" "static_assets" {
107+
bucket = module.s3bucket_static_assets.bucket
108+
109+
cors_rule {
110+
allowed_headers = ["Authorization"]
111+
allowed_methods = ["GET"]
112+
allowed_origins = ["*"]
113+
expose_headers = ["ETag"]
114+
max_age_seconds = 300
115+
}
116+
}
117+
118+
resource "aws_cloudfront_origin_access_identity" "static_assets" {
119+
comment = "Used to access the s3 content for the ${module.s3bucket_static_assets.bucket} bucket"
120+
}

‎infrastructure/terraform/components/dl/route53_record_acm_validation.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
resource "aws_route53_record" "acm_validation" {
2+
for_each = {
3+
for dvo in aws_acm_certificate.static_assets_hosting.domain_validation_options :
4+
dvo.domain_name => {
5+
name = dvo.resource_record_name
6+
record = dvo.resource_record_value
7+
type = dvo.resource_record_type
8+
} if dvo.domain_name == local.root_domain_name
9+
}
10+
11+
allow_overwrite = true
12+
name = each.value.name
13+
records = [each.value.record]
14+
type = each.value.type
15+
zone_id = local.root_domain_id
16+
ttl = 60
17+
}

‎infrastructure/terraform/components/dl/route53_record_static_assets_hosting.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
resource "aws_route53_record" "static_assets_hosting" {
2+
name = local.root_domain_name
3+
zone_id = local.root_domain_id
4+
type = "CNAME"
5+
ttl = 5
6+
records = [aws_cloudfront_distribution.static_assets_hosting.domain_name]
7+
}

0 commit comments

Comments
 (0)