CCM-12995 Adding base eventPub Infra

aidenvaines-cgi · sidnhs · commit cbdb33dba7d5 · 2025-11-19T11:21:05.000Z
diff --git a/infrastructure/terraform/components/api/module_authorizer_lambda.tf b/infrastructure/terraform/components/api/module_authorizer_lambda.tf
@@ -1,5 +1,5 @@
 module "authorizer_lambda" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.25/terraform-lambda.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
 
   aws_account_id = var.aws_account_id
   component      = var.component
diff --git a/infrastructure/terraform/components/api/module_domain_truststore.tf b/infrastructure/terraform/components/api/module_domain_truststore.tf
@@ -1,5 +1,5 @@
 module "domain_truststore" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.25/terraform-s3bucket.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip"
 
   name           = "truststore"
   aws_account_id = var.aws_account_id
diff --git a/infrastructure/terraform/components/api/module_kms.tf b/infrastructure/terraform/components/api/module_kms.tf
@@ -1,5 +1,5 @@
 module "kms" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.25/terraform-kms.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-kms.zip"
 
   providers = {
     aws           = aws
diff --git a/infrastructure/terraform/components/api/module_lambda_get_letter.tf b/infrastructure/terraform/components/api/module_lambda_get_letter.tf
@@ -1,5 +1,5 @@
 module "get_letter" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.25/terraform-lambda.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
 
   function_name = "get_letter"
   description   = "Get letter status"
diff --git a/infrastructure/terraform/components/api/module_lambda_get_letter_data.tf b/infrastructure/terraform/components/api/module_lambda_get_letter_data.tf
@@ -1,5 +1,5 @@
 module "get_letter_data" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.25/terraform-lambda.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
 
   function_name = "get_letter_data"
   description   = "Get the letter data"
diff --git a/infrastructure/terraform/components/api/module_lambda_get_letters.tf b/infrastructure/terraform/components/api/module_lambda_get_letters.tf
@@ -1,5 +1,5 @@
 module "get_letters" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.25/terraform-lambda.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
 
   function_name = "get_letters"
   description   = "Get paginated letter ids"
diff --git a/infrastructure/terraform/components/api/module_lambda_letter_updates_transformer.tf b/infrastructure/terraform/components/api/module_lambda_letter_updates_transformer.tf
@@ -1,7 +1,7 @@
-module "letter_update" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.25/terraform-lambda.zip"
+module "letter_updates_transformer" {
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
 
-  function_name = "letter-update"
+  function_name = "letter-updates-transformer"
   description   = "Letter Update Filter/Producer"
 
   aws_account_id = var.aws_account_id
@@ -15,12 +15,12 @@ module "letter_update" {
   kms_key_arn           = module.kms.key_arn
 
   iam_policy_document = {
-    body = data.aws_iam_policy_document.letter_update_lambda.json
+    body = data.aws_iam_policy_document.letter_updates_transformer_lambda.json
   }
 
   function_s3_bucket      = local.acct.s3_buckets["lambda_function_artefacts"]["id"]
   function_code_base_path = local.aws_lambda_functions_dir_path
-  function_code_dir       = "letter-update/dist"
+  function_code_dir       = "letter-updates-transformer/dist"
   function_include_common = true
   handler_function_name   = "updateLetter"
   runtime                 = "nodejs22.x"
@@ -40,7 +40,7 @@ module "letter_update" {
   })
 }
 
-data "aws_iam_policy_document" "letter_update_lambda" {
+data "aws_iam_policy_document" "letter_updates_transformer_lambda" {
   statement {
     sid    = "KMSPermissions"
     effect = "Allow"
diff --git a/infrastructure/terraform/components/api/module_lambda_patch_letter.tf b/infrastructure/terraform/components/api/module_lambda_patch_letter.tf
@@ -1,5 +1,5 @@
 module "patch_letter" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.25/terraform-lambda.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
 
   function_name = "patch_letter"
   description   = "Update the status of a letter"
diff --git a/infrastructure/terraform/components/api/module_lambda_post_mi.tf b/infrastructure/terraform/components/api/module_lambda_post_mi.tf
@@ -1,5 +1,5 @@
 module "post_mi" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.25/terraform-lambda.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
 
   function_name = "post_mi"
   description   = "Add management information"
diff --git a/infrastructure/terraform/components/api/module_lambda_upsert_letter.tf b/infrastructure/terraform/components/api/module_lambda_upsert_letter.tf
@@ -1,5 +1,5 @@
 module "upsert_letter" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.25/terraform-lambda.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
 
   function_name = "upsert-letter"
   description   = "Update or Insert the letter data in the letters table"
diff --git a/infrastructure/terraform/components/api/module_logging_bucket.tf b/infrastructure/terraform/components/api/module_logging_bucket.tf
@@ -1,5 +1,5 @@
 module "logging_bucket" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.25/terraform-s3bucket.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip"
 
   name           = "bucket-logs"
   aws_account_id = var.aws_account_id
diff --git a/infrastructure/terraform/components/api/module_sqs_letter_updates.tf b/infrastructure/terraform/components/api/module_sqs_letter_updates.tf
@@ -1,5 +1,5 @@
 module "sqs_letter_updates" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.25/terraform-sqs.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-sqs.zip"
 
   aws_account_id = var.aws_account_id
   component      = var.component
diff --git a/infrastructure/terraform/components/api/module_supplier_ssl.tf b/infrastructure/terraform/components/api/module_supplier_ssl.tf
@@ -1,7 +1,7 @@
 module "supplier_ssl" {
   count = var.manually_configure_mtls_truststore ? 0 : 1
 
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.25/terraform-ssl.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-ssl.zip"
 
   name                = "sapi_trust"
   aws_account_id      = var.aws_account_id
diff --git a/infrastructure/terraform/components/api/modules_eventpub.tf b/infrastructure/terraform/components/api/modules_eventpub.tf
@@ -1,7 +1,7 @@
 module "eventpub" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.25/terraform-eventpub.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-eventpub.zip"
 
-  name = "event-publisher"
+  name = "eventpub"
 
   aws_account_id = var.aws_account_id
   component      = var.component
diff --git a/infrastructure/terraform/components/api/modules_eventsub.tf b/infrastructure/terraform/components/api/modules_eventsub.tf
@@ -1,7 +1,7 @@
 module "eventsub" {
   source = "../../modules/eventsub"
 
-  name = "event-subscriber"
+  name = "eventsub"
 
   aws_account_id = var.aws_account_id
   component      = var.component
diff --git a/infrastructure/terraform/components/api/s3_test_letters.tf b/infrastructure/terraform/components/api/s3_test_letters.tf
@@ -1,5 +1,5 @@
 module "s3bucket_test_letters" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.25/terraform-s3bucket.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip"
 
   name = "test-letters"
 
diff --git a/infrastructure/terraform/components/api/sqs_queue_policy_letter_updates.tf b/infrastructure/terraform/components/api/sqs_queue_policy_letter_updates.tf
@@ -28,4 +28,31 @@ data "aws_iam_policy_document" "letter_updates_queue_policy" {
       values   = [module.eventsub.sns_topic.arn]
     }
   }
+
+  statement {
+    sid    = "AllowSNSPermissions"
+    effect = "Allow"
+
+    principals {
+      type        = "Service"
+      identifiers = ["sns.amazonaws.com"]
+    }
+
+    actions = [
+      "sqs:SendMessage",
+      "sqs:ListQueueTags",
+      "sqs:GetQueueUrl",
+      "sqs:GetQueueAttributes",
+    ]
+
+    resources = [
+      module.sqs_letter_updates.sqs_queue_arn
+    ]
+
+    condition {
+      test     = "ArnEquals"
+      variable = "aws:SourceArn"
+      values   = [module.eventsub.sns_topic.arn]
+    }
+  }
 }
diff --git a/infrastructure/terraform/modules/eventsub/README.md b/infrastructure/terraform/modules/eventsub/README.md
@@ -28,6 +28,7 @@
 | <a name="input_name"></a> [name](#input\_name) | A unique name to distinguish this module invocation from others within the same CSI scope | `string` | n/a | yes |
 | <a name="input_project"></a> [project](#input\_project) | The name of the terraformscaffold project calling the module | `string` | n/a | yes |
 | <a name="input_region"></a> [region](#input\_region) | The AWS Region | `string` | n/a | yes |
+| <a name="input_shared_infra_account_id"></a> [shared\_infra\_account\_id](#input\_shared\_infra\_account\_id) | The AWS Account ID of the shared infrastructure account | `string` | `"000000000000"` | no |
 | <a name="input_sns_success_logging_sample_percent"></a> [sns\_success\_logging\_sample\_percent](#input\_sns\_success\_logging\_sample\_percent) | Enable SNS Delivery Successful Sample Percentage | `number` | `0` | no |
 ## Modules
 
diff --git a/infrastructure/terraform/modules/eventsub/sns_topic_policy.tf b/infrastructure/terraform/modules/eventsub/sns_topic_policy.tf
@@ -8,6 +8,14 @@ data "aws_iam_policy_document" "sns_topic_policy" {
   policy_id = "__default_policy_ID"
 
   statement {
+    sid = "AllowAllSNSActionsFromAccount"
+    effect = "Allow"
+
+    principals {
+      type        = "AWS"
+      identifiers = ["*"]
+    }
+
     actions = [
       "SNS:Subscribe",
       "SNS:SetTopicAttributes",
@@ -20,6 +28,10 @@ data "aws_iam_policy_document" "sns_topic_policy" {
       "SNS:AddPermission",
     ]
 
+    resources = [
+      aws_sns_topic.main.arn,
+    ]
+
     condition {
       test     = "StringEquals"
       variable = "AWS:SourceOwner"
@@ -28,46 +40,31 @@ data "aws_iam_policy_document" "sns_topic_policy" {
         var.aws_account_id,
       ]
     }
+  }
 
+  statement {
+    sid = "AllowAllSNSActionsFromSharedAccount"
     effect = "Allow"
+    actions = [
+      "SNS:Publish",
+    ]
 
     principals {
-      type        = "AWS"
-      identifiers = ["*"]
+      type        = "Service"
+      identifiers = ["events.amazonaws.com"]
     }
 
     resources = [
       aws_sns_topic.main.arn,
     ]
 
-    sid = "AllowAllSNSActionsFromAccount"
-  }
-
-  statement {
-    actions = [
-      "SNS:Publish",
-    ]
-
     condition {
-      test     = "ArnLike"
-      variable = "AWS:SourceArn"
+      test     = "StringEquals"
+      variable = "AWS:SourceAccount"
 
       values = [
-        "arn:aws:iam::${var.shared_infra_account_id}:role/nhs-*-core-to-supplier-events",
+        var.shared_infra_account_id
       ]
     }
-
-    effect = "Allow"
-
-    principals {
-      type        = "AWS"
-      identifiers = ["*"]
-    }
-
-    resources = [
-      aws_sns_topic.main.arn,
-    ]
-
-    sid = "AllowAllSNSActionsFromSharedAccount"
   }
-}
+}
diff --git a/lambdas/letter-updates-transformer/.eslintignore b/lambdas/letter-updates-transformer/.eslintignore
diff --git a/lambdas/letter-updates-transformer/.gitignore b/lambdas/letter-updates-transformer/.gitignore
diff --git a/lambdas/letter-updates-transformer/jest.config.ts b/lambdas/letter-updates-transformer/jest.config.ts
diff --git a/lambdas/letter-updates-transformer/package.json b/lambdas/letter-updates-transformer/package.json
@@ -10,7 +10,7 @@
     "jest-mock-extended": "^4.0.0",
     "typescript": "^5.8.3"
   },
-  "name": "nhs-notify-supplier-api-letter-update",
+  "name": "nhs-notify-supplier-api-letter-updates-transformer",
   "private": true,
   "scripts": {
     "lambda-build": "rm -rf dist && npx esbuild --bundle --minify --sourcemap --target=es2020 --platform=node --loader:.node=file --entry-names=[name] --outdir=dist src/index.ts",
diff --git a/lambdas/letter-updates-transformer/src/__tests__/index.test.ts b/lambdas/letter-updates-transformer/src/__tests__/index.test.ts
diff --git a/lambdas/letter-updates-transformer/src/index.ts b/lambdas/letter-updates-transformer/src/index.ts
diff --git a/lambdas/letter-updates-transformer/tsconfig.json b/lambdas/letter-updates-transformer/tsconfig.json
diff --git a/sandbox/.eslintrc.json b/sandbox/.eslintrc.json
@@ -1,5 +1,3 @@
-// Use this file as a starting point for your project's .eslintrc.
-// Copy this file, and add rule overrides as needed.
 {
   "extends": "airbnb-base",
   "rules": {
