Skip to content

Commit afcddd2

Browse files
nhsd-angel-pastornhsd-angel-pastor
committed
CCM-12858: infra changes to deploy lambda and sqs queue
1 parent 3d10c68 commit afcddd2

File tree

4 files changed

+190
-0
lines changed

4 files changed

+190
-0
lines changed

‎infrastructure/terraform/components/dl/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,11 @@ No requirements.
4040
| <a name="module_lambda_apim_key_generation"></a> [lambda\_apim\_key\_generation](#module\_lambda\_apim\_key\_generation) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip | n/a |
4141
| <a name="module_lambda_lambda_apim_refresh_token"></a> [lambda\_lambda\_apim\_refresh\_token](#module\_lambda\_lambda\_apim\_refresh\_token) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip | n/a |
4242
| <a name="module_mesh_poll"></a> [mesh\_poll](#module\_mesh\_poll) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip | n/a |
43+
| <a name="module_pdm_uploader"></a> [pdm\_uploader](#module\_pdm\_uploader) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip | n/a |
4344
| <a name="module_s3bucket_cf_logs"></a> [s3bucket\_cf\_logs](#module\_s3bucket\_cf\_logs) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
4445
| <a name="module_s3bucket_letters"></a> [s3bucket\_letters](#module\_s3bucket\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
4546
| <a name="module_s3bucket_static_assets"></a> [s3bucket\_static\_assets](#module\_s3bucket\_static\_assets) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
47+
| <a name="module_sqs_core_notifier"></a> [sqs\_core\_notifier](#module\_sqs\_core\_notifier) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
4648
| <a name="module_sqs_event_publisher_errors"></a> [sqs\_event\_publisher\_errors](#module\_sqs\_event\_publisher\_errors) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
4749
| <a name="module_sqs_ttl"></a> [sqs\_ttl](#module\_sqs\_ttl) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
4850
| <a name="module_sqs_ttl_handle_expiry_errors"></a> [sqs\_ttl\_handle\_expiry\_errors](#module\_sqs\_ttl\_handle\_expiry\_errors) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |

‎infrastructure/terraform/components/dl/cloudwatch_event_rule_core_notifier_pdm_resource_available.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
resource "aws_cloudwatch_event_rule" "pdm_resource_available" {
2+
name = "${local.csi}-pdm-resource-available"
3+
description = "PDM resource available event rule"
4+
event_bus_name = aws_cloudwatch_event_bus.main.name
5+
event_pattern = jsonencode({
6+
"detail" : {
7+
"type" : [
8+
"uk.nhs.notify.digital.letters.pdm.resource.available.v1"
9+
],
10+
}
11+
})
12+
}
13+
14+
resource "aws_cloudwatch_event_target" "core-notifier-target" {
15+
rule = aws_cloudwatch_event_rule.pdm_resource_available.name
16+
arn = module.sqs_core_notifier.sqs_queue_arn
17+
target_id = "core-notifier-target"
18+
event_bus_name = aws_cloudwatch_event_bus.main.name
19+
}

‎infrastructure/terraform/components/dl/module_lambda_core_notifier.tf‎

Lines changed: 131 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,131 @@
1+
module "pdm_uploader" {
2+
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip"
3+
4+
function_name = "core-notifier"
5+
description = "A function to upload documents to PDM"
6+
7+
aws_account_id = var.aws_account_id
8+
component = local.component
9+
environment = var.environment
10+
project = var.project
11+
region = var.region
12+
group = var.group
13+
14+
log_retention_in_days = var.log_retention_in_days
15+
kms_key_arn = module.kms.key_arn
16+
17+
iam_policy_document = {
18+
body = data.aws_iam_policy_document.pdm_uploader_lambda.json
19+
}
20+
21+
function_s3_bucket = local.acct.s3_buckets["lambda_function_artefacts"]["id"]
22+
function_code_base_path = local.aws_lambda_functions_dir_path
23+
function_code_dir = "core-notifier-lambda/dist"
24+
function_include_common = true
25+
handler_function_name = "handler"
26+
runtime = "nodejs22.x"
27+
memory = 128
28+
timeout = 60
29+
log_level = var.log_level
30+
31+
force_lambda_code_deploy = var.force_lambda_code_deploy
32+
enable_lambda_insights = false
33+
34+
send_to_firehose = true
35+
log_destination_arn = local.log_destination_arn
36+
log_subscription_role_arn = local.acct.log_subscription_role_arn
37+
38+
lambda_env_vars = {
39+
"APIM_BASE_URL" = var.apim_base_url
40+
"APIM_ACCESS_TOKEN_SSM_PARAMETER_NAME" = local.apim_access_token_ssm_parameter_name
41+
"EVENT_PUBLISHER_EVENT_BUS_ARN" = aws_cloudwatch_event_bus.main.arn
42+
"EVENT_PUBLISHER_DLQ_URL" = module.sqs_event_publisher_errors.sqs_queue_url
43+
}
44+
}
45+
46+
data "aws_iam_policy_document" "pdm_uploader_lambda" {
47+
statement {
48+
sid = "AllowSSMParam"
49+
effect = "Allow"
50+
51+
actions = [
52+
"ssm:GetParameter",
53+
"ssm:GetParameters",
54+
"ssm:GetParametersByPath"
55+
]
56+
57+
resources = [
58+
"arn:aws:ssm:${var.region}:${var.aws_account_id}:parameter/${var.component}/${var.environment}/apim/*"
59+
]
60+
}
61+
62+
statement {
63+
sid = "AllowS3Get"
64+
effect = "Allow"
65+
66+
actions = [
67+
"s3:GetObject"
68+
]
69+
70+
resources = [
71+
"${module.s3bucket_letters.arn}/*"
72+
]
73+
}
74+
75+
statement {
76+
sid = "KMSPermissions"
77+
effect = "Allow"
78+
79+
actions = [
80+
"kms:Decrypt",
81+
"kms:GenerateDataKey",
82+
]
83+
84+
resources = [
85+
module.kms.key_arn,
86+
]
87+
}
88+
89+
statement {
90+
sid = "SQSPermissionsUploadToPdmQueue"
91+
effect = "Allow"
92+
93+
actions = [
94+
"sqs:ReceiveMessage",
95+
"sqs:DeleteMessage",
96+
"sqs:GetQueueAttributes",
97+
"sqs:GetQueueUrl",
98+
]
99+
100+
resources = [
101+
module.sqs_core_notifier.sqs_queue_arn,
102+
]
103+
}
104+
105+
statement {
106+
sid = "PutEvents"
107+
effect = "Allow"
108+
109+
actions = [
110+
"events:PutEvents",
111+
]
112+
113+
resources = [
114+
aws_cloudwatch_event_bus.main.arn,
115+
]
116+
}
117+
118+
statement {
119+
sid = "SQSPermissionsEventPublisherDLQ"
120+
effect = "Allow"
121+
122+
actions = [
123+
"sqs:SendMessage",
124+
"sqs:SendMessageBatch",
125+
]
126+
127+
resources = [
128+
module.sqs_event_publisher_errors.sqs_queue_arn,
129+
]
130+
}
131+
}

‎infrastructure/terraform/components/dl/module_sqs_core_notifier.tf‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
module "sqs_core_notifier" {
2+
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip"
3+
4+
aws_account_id = var.aws_account_id
5+
component = local.component
6+
environment = var.environment
7+
project = var.project
8+
region = var.region
9+
name = "core-notifier"
10+
11+
sqs_kms_key_arn = module.kms.key_arn
12+
13+
visibility_timeout_seconds = 60
14+
15+
create_dlq = true
16+
17+
sqs_policy_overload = data.aws_iam_policy_document.sqs_core_notifier.json
18+
}
19+
20+
data "aws_iam_policy_document" "sqs_core_notifier" {
21+
statement {
22+
sid = "AllowEventBridgeToSendMessage"
23+
effect = "Allow"
24+
25+
principals {
26+
type = "Service"
27+
identifiers = ["events.amazonaws.com"]
28+
}
29+
30+
actions = [
31+
"sqs:SendMessage"
32+
]
33+
34+
resources = [
35+
"arn:aws:sqs:${var.region}:${var.aws_account_id}:${var.project}-${var.environment}-${local.component}-core-notifier-queue"
36+
]
37+
}
38+
}

0 commit comments

Comments
 (0)