Skip to content

Commit 017bedd

Browse files
alexnuttallbhansell1harrim91
authored
CCM-9874: edge lambda auth (#474)
Co-authored-by: ben.hansell1 <[email protected]> Co-authored-by: Michael Harrison <[email protected]>
1 parent 4bb14c4 commit 017bedd

27 files changed

+1130
-468
lines changed

‎infrastructure/terraform/components/acct/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
| <a name="module_obs_datasource"></a> [obs\_datasource](#module\_obs\_datasource) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/obs-datasource | v2.0.3 |
3838
| <a name="module_s3bucket_access_logs"></a> [s3bucket\_access\_logs](#module\_s3bucket\_access\_logs) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.9 |
3939
| <a name="module_s3bucket_artefacts"></a> [s3bucket\_artefacts](#module\_s3bucket\_artefacts) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v2.0.2 |
40+
| <a name="module_s3bucket_artefacts_us_east_1"></a> [s3bucket\_artefacts\_us\_east\_1](#module\_s3bucket\_artefacts\_us\_east\_1) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v2.0.2 |
4041
| <a name="module_s3bucket_backup_reports"></a> [s3bucket\_backup\_reports](#module\_s3bucket\_backup\_reports) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.8 |
4142
| <a name="module_s3bucket_data_migration_backups"></a> [s3bucket\_data\_migration\_backups](#module\_s3bucket\_data\_migration\_backups) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v2.0.4 |
4243
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.19.0 |

‎infrastructure/terraform/components/acct/module_s3bucket_artefacts_us_east_1.tf‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
module "s3bucket_artefacts_us_east_1" {
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket?ref=v2.0.2"
3+
4+
providers = {
5+
aws = aws.us-east-1
6+
}
7+
8+
name = "artefacts"
9+
10+
aws_account_id = var.aws_account_id
11+
region = "us-east-1"
12+
project = var.project
13+
environment = var.environment
14+
component = var.component
15+
16+
acl = "private"
17+
force_destroy = false
18+
versioning = true
19+
20+
lifecycle_rules = [
21+
{
22+
prefix = ""
23+
enabled = true
24+
25+
noncurrent_version_transition = [
26+
{
27+
noncurrent_days = "30"
28+
storage_class = "STANDARD_IA"
29+
}
30+
]
31+
32+
noncurrent_version_expiration = {
33+
noncurrent_days = "90"
34+
}
35+
36+
abort_incomplete_multipart_upload = {
37+
days = "1"
38+
}
39+
}
40+
]
41+
42+
policy_documents = [
43+
data.aws_iam_policy_document.s3bucket_artefacts_us_east_1.json
44+
]
45+
46+
public_access = {
47+
block_public_acls = true
48+
block_public_policy = true
49+
ignore_public_acls = true
50+
restrict_public_buckets = true
51+
}
52+
53+
54+
default_tags = {
55+
Name = "Artefact bucket"
56+
}
57+
}
58+
59+
data "aws_iam_policy_document" "s3bucket_artefacts_us_east_1" {
60+
statement {
61+
sid = "DontAllowNonSecureConnection"
62+
effect = "Deny"
63+
64+
actions = [
65+
"s3:*",
66+
]
67+
68+
resources = [
69+
module.s3bucket_artefacts_us_east_1.arn,
70+
"${module.s3bucket_artefacts_us_east_1.arn}/*",
71+
]
72+
73+
principals {
74+
type = "AWS"
75+
76+
identifiers = [
77+
"*",
78+
]
79+
}
80+
81+
condition {
82+
test = "Bool"
83+
variable = "aws:SecureTransport"
84+
85+
values = [
86+
"false",
87+
]
88+
}
89+
}
90+
91+
statement {
92+
sid = "AllowManagedAccountsToList"
93+
effect = "Allow"
94+
95+
actions = [
96+
"s3:ListBucket",
97+
]
98+
99+
resources = [
100+
module.s3bucket_artefacts_us_east_1.arn,
101+
]
102+
103+
principals {
104+
type = "AWS"
105+
identifiers = [
106+
"arn:aws:iam::${var.aws_account_id}:root"
107+
]
108+
}
109+
}
110+
111+
statement {
112+
sid = "AllowManagedAccountsToGet"
113+
effect = "Allow"
114+
115+
actions = [
116+
"s3:GetObject",
117+
]
118+
119+
resources = [
120+
"${module.s3bucket_artefacts_us_east_1.arn}/*",
121+
]
122+
123+
principals {
124+
type = "AWS"
125+
identifiers = [
126+
"arn:aws:iam::${var.aws_account_id}:root"
127+
]
128+
}
129+
}
130+
}

‎infrastructure/terraform/components/acct/outputs.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,11 @@ output "s3_buckets" {
2222
bucket = module.s3bucket_artefacts.bucket
2323
id = module.s3bucket_artefacts.id
2424
}
25+
artefacts_us_east_1 = {
26+
arn = module.s3bucket_artefacts_us_east_1.arn
27+
bucket = module.s3bucket_artefacts_us_east_1.bucket
28+
id = module.s3bucket_artefacts_us_east_1.id
29+
}
2530
backup_reports = {
2631
arn = module.s3bucket_backup_reports.arn
2732
bucket = module.s3bucket_backup_reports.bucket

‎infrastructure/terraform/components/app/README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,8 +50,10 @@
5050
|------|--------|---------|
5151
| <a name="module_amplify_branch"></a> [amplify\_branch](#module\_amplify\_branch) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/amp_branch | v1.0.0 |
5252
| <a name="module_backend_api"></a> [backend\_api](#module\_backend\_api) | ../../modules/backend-api | n/a |
53+
| <a name="module_download_authorizer_lambda"></a> [download\_authorizer\_lambda](#module\_download\_authorizer\_lambda) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.2 |
5354
| <a name="module_eventpub"></a> [eventpub](#module\_eventpub) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/eventpub | v1.0.13 |
5455
| <a name="module_kms"></a> [kms](#module\_kms) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/kms | v1.0.8 |
56+
| <a name="module_kms_us_east_1"></a> [kms\_us\_east\_1](#module\_kms\_us\_east\_1) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/kms | v1.0.8 |
5557
| <a name="module_nhse_backup_vault"></a> [nhse\_backup\_vault](#module\_nhse\_backup\_vault) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/aws-backup-source | v1.0.8 |
5658
| <a name="module_s3bucket_cf_logs"></a> [s3bucket\_cf\_logs](#module\_s3bucket\_cf\_logs) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v2.0.2 |
5759
## Outputs

‎infrastructure/terraform/components/app/cloudfront_distribution_main.tf‎

Lines changed: 31 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ resource "aws_cloudfront_distribution" "main" {
44
enabled = true
55
is_ipv6_enabled = true
66
comment = "NHS Notify templates files CDN (${local.csi})"
7+
78
# https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-cloudfront-distribution-distributionconfig.html#cfn-cloudfront-distribution-distributionconfig-priceclass
89
price_class = "PriceClass_100"
910

@@ -34,6 +35,16 @@ resource "aws_cloudfront_distribution" "main" {
3435
domain_name = module.backend_api.download_bucket_regional_domain_name
3536
origin_access_control_id = aws_cloudfront_origin_access_control.s3.id
3637
origin_id = "S3-${local.csi}-download"
38+
39+
custom_header {
40+
name = "x-user-pool-id"
41+
value = jsondecode(aws_ssm_parameter.cognito_config.value)["USER_POOL_ID"]
42+
}
43+
44+
custom_header {
45+
name = "x-user-pool-client-id"
46+
value = jsondecode(aws_ssm_parameter.cognito_config.value)["USER_POOL_CLIENT_ID"]
47+
}
3748
}
3849

3950
default_cache_behavior {
@@ -48,19 +59,27 @@ resource "aws_cloudfront_distribution" "main" {
4859
]
4960
target_origin_id = "S3-${local.csi}-download"
5061

51-
forwarded_values {
52-
query_string = true
53-
headers = ["Origin"]
54-
55-
cookies {
56-
forward = "all"
57-
}
58-
}
59-
6062
viewer_protocol_policy = "redirect-to-https"
61-
min_ttl = 0
62-
default_ttl = 3600
63-
max_ttl = 86400
6463
compress = true
64+
65+
cache_policy_id = data.aws_cloudfront_cache_policy.caching_disabled.id
66+
origin_request_policy_id = aws_cloudfront_origin_request_policy.forward_cookies.id
67+
68+
69+
lambda_function_association {
70+
lambda_arn = module.download_authorizer_lambda.function_qualified_arn
71+
event_type = "origin-request"
72+
}
6573
}
6674
}
75+
76+
data "aws_cloudfront_cache_policy" "caching_disabled" {
77+
name = "Managed-CachingDisabled"
78+
}
79+
80+
resource "aws_cloudfront_origin_request_policy" "forward_cookies" {
81+
name = "${local.csi}-forward-cookies"
82+
cookies_config { cookie_behavior = "all" }
83+
headers_config { header_behavior = "none" }
84+
query_strings_config { query_string_behavior = "none" }
85+
}

‎infrastructure/terraform/components/app/locals.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
locals {
22
cloudfront_files_domain_name = "files.${local.root_domain_name}"
33
root_domain_name = "${var.environment}.${local.acct.dns_zone["name"]}"
4+
lambdas_source_code_dir = "../../../../lambdas"
45
}

‎infrastructure/terraform/components/app/module_download_authorizer_lambda.tf‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
module "download_authorizer_lambda" {
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda?ref=v2.0.2"
3+
4+
providers = {
5+
aws = aws.us-east-1
6+
}
7+
8+
function_name = "download-authorizer"
9+
description = "Download authorizer for s3 download bucket"
10+
11+
aws_account_id = var.aws_account_id
12+
component = var.component
13+
environment = var.environment
14+
project = var.project
15+
region = "us-east-1"
16+
group = var.group
17+
18+
log_retention_in_days = var.log_retention_in_days
19+
kms_key_arn = module.kms_us_east_1.key_arn
20+
21+
iam_policy_document = {
22+
body = data.aws_iam_policy_document.authorizer.json
23+
}
24+
25+
function_s3_bucket = local.acct.s3_buckets["artefacts_us_east_1"]["id"]
26+
function_code_base_path = local.lambdas_source_code_dir
27+
function_code_dir = "download-authorizer/dist"
28+
handler_function_name = "handler"
29+
runtime = "nodejs20.x"
30+
memory = 128
31+
timeout = 3
32+
lambda_at_edge = true
33+
enable_lambda_insights = false
34+
}
35+
36+
data "aws_iam_policy_document" "authorizer" {
37+
statement {
38+
sid = "KMSPermissions"
39+
effect = "Allow"
40+
41+
actions = [
42+
"kms:Decrypt",
43+
"kms:GenerateDataKey",
44+
]
45+
46+
resources = [
47+
module.kms_us_east_1.key_arn,
48+
]
49+
}
50+
}

‎infrastructure/terraform/components/app/module_kms_us_east_1.tf‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
module "kms_us_east_1" {
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/kms?ref=v1.0.8"
3+
4+
providers = {
5+
aws = aws.us-east-1
6+
}
7+
8+
aws_account_id = var.aws_account_id
9+
component = var.component
10+
environment = var.environment
11+
project = var.project
12+
region = "us-east-1"
13+
14+
name = "main"
15+
deletion_window = var.kms_deletion_window
16+
alias = "alias/${local.csi}"
17+
key_policy_documents = [data.aws_iam_policy_document.kms_us_east_1.json]
18+
iam_delegation = true
19+
}
20+
21+
data "aws_iam_policy_document" "kms_us_east_1" {
22+
# '*' resource scope is permitted in access policies as as the resource is itself
23+
# https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-services.html
24+
25+
statement {
26+
sid = "AllowCloudWatchEncrypt"
27+
effect = "Allow"
28+
29+
principals {
30+
type = "Service"
31+
32+
identifiers = [
33+
"logs.us-east-1.amazonaws.com",
34+
]
35+
}
36+
37+
actions = [
38+
"kms:Encrypt*",
39+
"kms:Decrypt*",
40+
"kms:ReEncrypt*",
41+
"kms:GenerateDataKey*",
42+
"kms:Describe*"
43+
]
44+
45+
resources = [
46+
"*",
47+
]
48+
}
49+
}

‎infrastructure/terraform/modules/backend-api/data_cloudwatch_event_bus_default.tf‎

Lines changed: 0 additions & 3 deletions
This file was deleted.

‎infrastructure/terraform/modules/backend-api/iam_role_guardduty_quarantine.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -73,10 +73,10 @@ data "aws_iam_policy_document" "guardduty_quarantine" {
7373
sid = "AllowPostScanTag"
7474
effect = "Allow"
7575
actions = [
76-
"S3:PutObjectTagging",
77-
"S3:GetObjectTagging",
78-
"S3:PutObjectVersionTagging",
79-
"S3:GetObjectVersionTagging"
76+
"s3:PutObjectTagging",
77+
"s3:GetObjectTagging",
78+
"s3:PutObjectVersionTagging",
79+
"s3:GetObjectVersionTagging"
8080
]
8181

8282
resources = [

0 commit comments

Comments
 (0)