Skip to content

Commit e71bb29

Browse files
gareth-allangareth-allan
committed
CCM-13278: Add Terraform for mesh-acknowledge lambda
1 parent 2f02232 commit e71bb29

File tree

8 files changed

+188
-0
lines changed

8 files changed

+188
-0
lines changed

‎infrastructure/terraform/components/dl/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ No requirements.
1717
| <a name="input_component"></a> [component](#input\_component) | The variable encapsulating the name of this component | `string` | `"dl"` | no |
1818
| <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
1919
| <a name="input_enable_dynamodb_delete_protection"></a> [enable\_dynamodb\_delete\_protection](#input\_enable\_dynamodb\_delete\_protection) | Enable DynamoDB Delete Protection on all Tables | `bool` | `true` | no |
20+
| <a name="input_enable_mock_mesh"></a> [enable\_mock\_mesh](#input\_enable\_mock\_mesh) | Enable mock mesh access (dev only). Grants lambda permission to read mock-mesh prefix in non-pii bucket. | `bool` | `false` | no |
2021
| <a name="input_enable_pdm_mock"></a> [enable\_pdm\_mock](#input\_enable\_pdm\_mock) | Flag indicating whether to deploy PDM mock API (should be false in production environments) | `bool` | `true` | no |
2122
| <a name="input_environment"></a> [environment](#input\_environment) | The name of the tfscaffold environment | `string` | n/a | yes |
2223
| <a name="input_force_destroy"></a> [force\_destroy](#input\_force\_destroy) | Flag to force deletion of S3 buckets | `bool` | `false` | no |
@@ -50,6 +51,7 @@ No requirements.
5051
| <a name="module_s3bucket_letters"></a> [s3bucket\_letters](#module\_s3bucket\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
5152
| <a name="module_s3bucket_static_assets"></a> [s3bucket\_static\_assets](#module\_s3bucket\_static\_assets) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
5253
| <a name="module_sqs_event_publisher_errors"></a> [sqs\_event\_publisher\_errors](#module\_sqs\_event\_publisher\_errors) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
54+
| <a name="module_sqs_mesh_acknowledge"></a> [sqs\_mesh\_acknowledge](#module\_sqs\_mesh\_acknowledge) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-sqs.zip | n/a |
5355
| <a name="module_sqs_pdm_uploader"></a> [sqs\_pdm\_uploader](#module\_sqs\_pdm\_uploader) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
5456
| <a name="module_sqs_ttl"></a> [sqs\_ttl](#module\_sqs\_ttl) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
5557
| <a name="module_sqs_ttl_handle_expiry_errors"></a> [sqs\_ttl\_handle\_expiry\_errors](#module\_sqs\_ttl\_handle\_expiry\_errors) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |

‎infrastructure/terraform/components/dl/cloudwatch_event_rule_mesh_inbox_message_downloaded.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,3 +25,10 @@ resource "aws_cloudwatch_event_target" "pdm-uploader-target" {
2525
target_id = "pdm-uploader-target"
2626
event_bus_name = aws_cloudwatch_event_bus.main.name
2727
}
28+
29+
resource "aws_cloudwatch_event_target" "mesh-acknowledge-target" {
30+
rule = aws_cloudwatch_event_rule.mesh_inbox_message_downloaded.name
31+
arn = module.sqs_mesh_acknowledge.sqs_queue_arn
32+
target_id = "mesh-acknowledge-target"
33+
event_bus_name = aws_cloudwatch_event_bus.main.name
34+
}

‎infrastructure/terraform/components/dl/lambda_event_source_mapping_mesh_acknowledge_lambda.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
resource "aws_lambda_event_source_mapping" "sqs_mesh_acknowledge_lambda" {
2+
event_source_arn = module.sqs_mesh_acknowledge.sqs_queue_arn
3+
function_name = module.mesh_acknowledge.function_name
4+
batch_size = var.queue_batch_size
5+
maximum_batching_window_in_seconds = var.queue_batch_window_seconds
6+
7+
function_response_types = [
8+
"ReportBatchItemFailures"
9+
]
10+
}

‎infrastructure/terraform/components/dl/locals.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ locals {
55
apim_api_key_ssm_parameter_name = "/${var.component}/${var.environment}/apim/api_key"
66
apim_private_key_ssm_parameter_name = "/${var.component}/${var.environment}/apim/private_key"
77
apim_keystore_s3_bucket = "nhs-${var.aws_account_id}-${var.region}-${var.environment}-${var.component}-static-assets"
8+
ssm_mesh_prefix = "/${var.component}/${var.environment}/mesh"
89
root_domain_name = "${var.environment}.${local.acct.route53_zone_names["digital-letters"]}"
910
root_domain_id = local.acct.route53_zone_ids["digital-letters"]
1011
ttl_shard_count = 3

‎infrastructure/terraform/components/dl/module_lambda_mesh_acknowledge.tf‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
module "mesh_acknowledge" {
2+
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip"
3+
4+
function_name = "mesh-acknowledge"
5+
description = "A lambda function for acknowledging MESH messages"
6+
aws_account_id = var.aws_account_id
7+
component = local.component
8+
environment = var.environment
9+
project = var.project
10+
region = var.region
11+
group = var.group
12+
13+
log_retention_in_days = var.log_retention_in_days
14+
kms_key_arn = module.kms.key_arn
15+
16+
iam_policy_document = {
17+
body = data.aws_iam_policy_document.mesh_acknowledge_lambda.json
18+
}
19+
20+
function_s3_bucket = local.acct.s3_buckets["lambda_function_artefacts"]["id"]
21+
function_code_base_path = local.aws_lambda_functions_dir_path
22+
function_code_dir = "mesh-acknowledge/target/dist"
23+
function_include_common = true
24+
function_module_name = "mesh_acknowledge"
25+
handler_function_name = "handler.handler"
26+
runtime = "python3.14"
27+
memory = 128
28+
timeout = 5
29+
log_level = var.log_level
30+
31+
force_lambda_code_deploy = var.force_lambda_code_deploy
32+
enable_lambda_insights = false
33+
34+
log_destination_arn = local.log_destination_arn
35+
log_subscription_role_arn = local.acct.log_subscription_role_arn
36+
37+
lambda_env_vars = {
38+
CERTIFICATE_EXPIRY_METRIC_NAME = "mesh-acknowledge-client-certificate-near-expiry"
39+
CERTIFICATE_EXPIRY_METRIC_NAMESPACE = "dl-mesh-acknowledge"
40+
ENVIRONMENT = var.environment
41+
EVENT_PUBLISHER_DLQ_URL = module.sqs_event_publisher_errors.sqs_queue_url
42+
EVENT_PUBLISHER_EVENT_BUS_ARN = aws_cloudwatch_event_bus.main.arn
43+
SSM_PREFIX = "${local.ssm_mesh_prefix}"
44+
USE_MESH_MOCK = var.enable_mock_mesh ? "true" : "false"
45+
}
46+
47+
}
48+
49+
data "aws_iam_policy_document" "mesh_acknowledge_lambda" {
50+
statement {
51+
sid = "KMSPermissions"
52+
effect = "Allow"
53+
54+
actions = [
55+
"kms:Decrypt",
56+
"kms:GenerateDataKey",
57+
]
58+
59+
resources = [
60+
module.kms.key_arn,
61+
]
62+
}
63+
64+
statement {
65+
sid = "SQSPermissions"
66+
effect = "Allow"
67+
68+
actions = [
69+
"sqs:ReceiveMessage",
70+
"sqs:DeleteMessage",
71+
"sqs:GetQueueAttributes",
72+
]
73+
74+
resources = [
75+
module.sqs_mesh_acknowledge.sqs_queue_arn,
76+
]
77+
}
78+
79+
statement {
80+
sid = "EventBridgePermissions"
81+
effect = "Allow"
82+
83+
actions = [
84+
"events:PutEvents",
85+
]
86+
87+
resources = [
88+
aws_cloudwatch_event_bus.main.arn,
89+
]
90+
}
91+
92+
statement {
93+
sid = "DLQPermissions"
94+
effect = "Allow"
95+
96+
actions = [
97+
"sqs:SendMessage",
98+
"sqs:SendMessageBatch",
99+
]
100+
101+
resources = [
102+
module.sqs_event_publisher_errors.sqs_queue_arn,
103+
]
104+
}
105+
106+
statement {
107+
sid = "SSMPermissions"
108+
effect = "Allow"
109+
110+
actions = [
111+
"ssm:GetParameter",
112+
"ssm:GetParametersByPath",
113+
]
114+
115+
resources = [
116+
"arn:aws:ssm:${var.region}:${var.aws_account_id}:parameter${local.ssm_mesh_prefix}/*"
117+
]
118+
}
119+
}

‎infrastructure/terraform/components/dl/module_sqs_mesh_acknowledge.tf‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
module "sqs_mesh_acknowledge" {
2+
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-sqs.zip"
3+
4+
aws_account_id = var.aws_account_id
5+
component = local.component
6+
environment = var.environment
7+
project = var.project
8+
region = var.region
9+
name = "mesh-acknowledge"
10+
11+
sqs_kms_key_arn = module.kms.key_arn
12+
13+
visibility_timeout_seconds = 60
14+
15+
create_dlq = true
16+
17+
sqs_policy_overload = data.aws_iam_policy_document.sqs_mesh_acknowledge.json
18+
}
19+
20+
data "aws_iam_policy_document" "sqs_mesh_acknowledge" {
21+
statement {
22+
sid = "AllowEventBridgeToSendMessage"
23+
effect = "Allow"
24+
25+
principals {
26+
type = "Service"
27+
identifiers = ["events.amazonaws.com"]
28+
}
29+
30+
actions = [
31+
"sqs:SendMessage"
32+
]
33+
34+
resources = [
35+
"arn:aws:sqs:${var.region}:${var.aws_account_id}:${var.project}-${var.environment}-${local.component}-mesh-acknowledge-queue"
36+
]
37+
}
38+
}

‎infrastructure/terraform/components/dl/pre.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,8 @@ npm ci
99
npm run generate-dependencies
1010

1111
npm run lambda-build --workspaces --if-present
12+
13+
# Build Python lambdas
14+
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../../../.." && pwd)"
15+
16+
make -C "$ROOT/lambdas/mesh-acknowledge" package

‎infrastructure/terraform/components/dl/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,12 @@ variable "mesh_poll_schedule" {
9292
default = "cron(0,30 8-16 ? * MON-FRI *)" # Every 30 minutes between 8am and 4:30pm Mon-Fri
9393
}
9494

95+
variable "enable_mock_mesh" {
96+
description = "Enable mock mesh access (dev only). Grants lambda permission to read mock-mesh prefix in non-pii bucket."
97+
type = bool
98+
default = false
99+
}
100+
95101
variable "queue_batch_size" {
96102
type = number
97103
description = "maximum number of queue items to process"

0 commit comments

Comments
 (0)