nhs-notify-web-template-management/infrastructure/terraform/modules/backend-api/module_create_template_lambda.tf at aa9e33f962ac76b1a29a3402ca1f90c0e289d43f · NHSDigital/nhs-notify-web-template-management · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
module "create_template_lambda" {
  depends_on = [module.build_template_lambda, module.build_template_client]

  source      = "../lambda-function"
  description = "Create template API endpoint"

  function_name    = "${local.csi}-create-template"
  filename         = module.build_template_lambda.zips[local.backend_lambda_entrypoints.create_template].path
  source_code_hash = module.build_template_lambda.zips[local.backend_lambda_entrypoints.create_template].base64sha256
  runtime          = "nodejs20.x"
  handler          = "create.handler"

  log_retention_in_days = var.log_retention_in_days

  environment_variables = {
    TEMPLATES_TABLE_NAME = aws_dynamodb_table.templates.name
  }

  execution_role_policy_document = data.aws_iam_policy_document.create_template_lambda_policy.json
}

data "aws_iam_policy_document" "create_template_lambda_policy" {
  statement {
    sid    = "AllowDynamoAccess"
    effect = "Allow"

    actions = [
      "dynamodb:PutItem",
    ]

    resources = [
      aws_dynamodb_table.templates.arn,
    ]
  }

  statement {
    sid    = "AllowKMSAccess"
    effect = "Allow"

    actions = [
      "kms:Decrypt",
      "kms:DescribeKey",
      "kms:Encrypt",
      "kms:GenerateDataKey*",
      "kms:ReEncrypt*",
    ]

    resources = [
      local.dynamodb_kms_key_arn
    ]
  }
}