Skip to content

Commit 0f798ba

Browse files
aidenvaines-cgiaidenvaines-cgi
committed
CCM-12481 migrating the S3 quarantine bucket up to the acct component
1 parent 92e5bc6 commit 0f798ba

17 files changed

+421
-393
lines changed

‎infrastructure/terraform/components/acct/data_iam_policy_document_kms.tf‎

Lines changed: 148 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,148 @@
1+
data "aws_iam_policy_document" "kms" {
2+
# '*' resource scope is permitted in access policies as as the resource is itself
3+
# https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-services.html
4+
5+
statement {
6+
sid = "AllowCloudWatchEncrypt"
7+
effect = "Allow"
8+
9+
principals {
10+
type = "Service"
11+
12+
identifiers = [
13+
"logs.${var.region}.amazonaws.com",
14+
]
15+
}
16+
17+
actions = [
18+
"kms:Encrypt*",
19+
"kms:Decrypt*",
20+
"kms:ReEncrypt*",
21+
"kms:GenerateDataKey*",
22+
"kms:Describe*"
23+
]
24+
25+
resources = [
26+
"*",
27+
]
28+
29+
condition {
30+
test = "ArnLike"
31+
variable = "kms:EncryptionContext:aws:logs:arn"
32+
33+
values = [
34+
"arn:aws:logs:${var.region}:${var.aws_account_id}:log-group:*",
35+
]
36+
}
37+
}
38+
39+
statement {
40+
sid = "AllowS3"
41+
effect = "Allow"
42+
43+
principals {
44+
type = "Service"
45+
46+
identifiers = [
47+
"s3.amazonaws.com",
48+
]
49+
}
50+
51+
actions = [
52+
"kms:Encrypt*",
53+
"kms:Decrypt*",
54+
"kms:ReEncrypt*",
55+
"kms:GenerateDataKey*",
56+
"kms:Describe*"
57+
]
58+
59+
resources = [
60+
"*",
61+
]
62+
}
63+
64+
statement {
65+
sid = "AllowSES"
66+
effect = "Allow"
67+
68+
principals {
69+
type = "Service"
70+
71+
identifiers = [
72+
"ses.amazonaws.com",
73+
]
74+
}
75+
76+
actions = [
77+
"kms:Encrypt*",
78+
"kms:Decrypt*",
79+
"kms:ReEncrypt*",
80+
"kms:GenerateDataKey*",
81+
"kms:Describe*"
82+
]
83+
84+
resources = [
85+
"*",
86+
]
87+
}
88+
89+
statement {
90+
sid = "AllowLogDeliveryEncrypt"
91+
effect = "Allow"
92+
93+
principals {
94+
type = "Service"
95+
96+
identifiers = [
97+
"delivery.logs.amazonaws.com"
98+
]
99+
}
100+
101+
actions = [
102+
"kms:Decrypt",
103+
"kms:GenerateDataKey*",
104+
]
105+
106+
resources = [
107+
"*",
108+
]
109+
110+
condition {
111+
test = "StringLike"
112+
variable = "kms:EncryptionContext:SourceArn"
113+
114+
values = [
115+
"arn:aws:logs:${var.region}:${var.aws_account_id}:*",
116+
]
117+
}
118+
}
119+
120+
statement {
121+
sid = "AllowEventBridgeAccessToLetterValidationQueue"
122+
effect = "Allow"
123+
124+
principals {
125+
type = "Service"
126+
identifiers = ["events.amazonaws.com"]
127+
}
128+
129+
actions = [
130+
"kms:GenerateDataKey*",
131+
"kms:Decrypt",
132+
]
133+
134+
resources = ["*"]
135+
136+
condition {
137+
test = "ArnLike"
138+
variable = "kms:EncryptionContext:aws:sqs:arn"
139+
values = ["arn:aws:sqs:${var.region}:${var.aws_account_id}:*-validate-letter-template-files-queue"]
140+
}
141+
142+
condition {
143+
test = "ArnLike"
144+
variable = "aws:SourceArn"
145+
values = ["arn:aws:events:${var.region}:${var.aws_account_id}:rule/*-quarantine-scan-passed-for-upload"]
146+
}
147+
}
148+
}

‎infrastructure/terraform/components/acct/module_kms.tf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
module "kms" {
2+
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-kms.zip"
3+
4+
providers = {
5+
aws = aws
6+
aws.us-east-1 = aws.us-east-1
7+
}
8+
9+
aws_account_id = var.aws_account_id
10+
component = var.component
11+
environment = var.environment
12+
project = var.project
13+
region = var.region
14+
15+
name = "main"
16+
deletion_window = var.kms_deletion_window
17+
alias = "alias/${local.csi}"
18+
key_policy_documents = [data.aws_iam_policy_document.kms.json]
19+
iam_delegation = true
20+
}

infrastructure/terraform/modules/backend-api/module_s3bucket_quarantine.tf renamed to infrastructure/terraform/components/acct/module_s3bucket_quarantine.tf

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
module "s3bucket_quarantine" {
2-
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-s3bucket.zip"
2+
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip"
33

44
name = "quarantine"
55

@@ -9,7 +9,7 @@ module "s3bucket_quarantine" {
99
environment = var.environment
1010
component = var.component
1111

12-
kms_key_arn = var.kms_key_arn
12+
kms_key_arn = module.kms.key_arn
1313

1414
notification_events = {
1515
eventbridge = true

‎infrastructure/terraform/components/acct/module_sandbox_kms.tf‎

Lines changed: 0 additions & 149 deletions
Original file line numberDiff line numberDiff line change
@@ -21,152 +21,3 @@ module "kms_sandbox" {
2121

2222
key_policy_documents = [data.aws_iam_policy_document.kms.json]
2323
}
24-
25-
data "aws_iam_policy_document" "kms" {
26-
# '*' resource scope is permitted in access policies as as the resource is itself
27-
# https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-services.html
28-
29-
statement {
30-
sid = "AllowCloudWatchEncrypt"
31-
effect = "Allow"
32-
33-
principals {
34-
type = "Service"
35-
36-
identifiers = [
37-
"logs.${var.region}.amazonaws.com",
38-
]
39-
}
40-
41-
actions = [
42-
"kms:Encrypt*",
43-
"kms:Decrypt*",
44-
"kms:ReEncrypt*",
45-
"kms:GenerateDataKey*",
46-
"kms:Describe*"
47-
]
48-
49-
resources = [
50-
"*",
51-
]
52-
53-
condition {
54-
test = "ArnLike"
55-
variable = "kms:EncryptionContext:aws:logs:arn"
56-
57-
values = [
58-
"arn:aws:logs:${var.region}:${var.aws_account_id}:log-group:*",
59-
]
60-
}
61-
}
62-
63-
statement {
64-
sid = "AllowS3"
65-
effect = "Allow"
66-
67-
principals {
68-
type = "Service"
69-
70-
identifiers = [
71-
"s3.amazonaws.com",
72-
]
73-
}
74-
75-
actions = [
76-
"kms:Encrypt*",
77-
"kms:Decrypt*",
78-
"kms:ReEncrypt*",
79-
"kms:GenerateDataKey*",
80-
"kms:Describe*"
81-
]
82-
83-
resources = [
84-
"*",
85-
]
86-
}
87-
88-
statement {
89-
sid = "AllowSES"
90-
effect = "Allow"
91-
92-
principals {
93-
type = "Service"
94-
95-
identifiers = [
96-
"ses.amazonaws.com",
97-
]
98-
}
99-
100-
actions = [
101-
"kms:Encrypt*",
102-
"kms:Decrypt*",
103-
"kms:ReEncrypt*",
104-
"kms:GenerateDataKey*",
105-
"kms:Describe*"
106-
]
107-
108-
resources = [
109-
"*",
110-
]
111-
}
112-
113-
statement {
114-
sid = "AllowLogDeliveryEncrypt"
115-
effect = "Allow"
116-
117-
principals {
118-
type = "Service"
119-
120-
identifiers = [
121-
"delivery.logs.amazonaws.com"
122-
]
123-
}
124-
125-
actions = [
126-
"kms:Decrypt",
127-
"kms:GenerateDataKey*",
128-
]
129-
130-
resources = [
131-
"*",
132-
]
133-
134-
condition {
135-
test = "StringLike"
136-
variable = "kms:EncryptionContext:SourceArn"
137-
138-
values = [
139-
"arn:aws:logs:${var.region}:${var.aws_account_id}:*",
140-
]
141-
}
142-
}
143-
144-
statement {
145-
sid = "AllowEventBridgeAccessToLetterValidationQueue"
146-
effect = "Allow"
147-
148-
principals {
149-
type = "Service"
150-
identifiers = ["events.amazonaws.com"]
151-
}
152-
153-
actions = [
154-
"kms:GenerateDataKey*",
155-
"kms:Decrypt",
156-
]
157-
158-
resources = ["*"]
159-
160-
condition {
161-
test = "ArnLike"
162-
variable = "kms:EncryptionContext:aws:sqs:arn"
163-
values = ["arn:aws:sqs:${var.region}:${var.aws_account_id}:*-validate-letter-template-files-queue"]
164-
}
165-
166-
condition {
167-
test = "ArnLike"
168-
variable = "aws:SourceArn"
169-
values = ["arn:aws:events:${var.region}:${var.aws_account_id}:rule/*-quarantine-scan-passed-for-upload"]
170-
}
171-
}
172-
}

‎infrastructure/terraform/components/acct/outputs.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,11 @@ output "s3_buckets" {
3232
bucket = module.s3bucket_backup_reports.bucket
3333
id = module.s3bucket_backup_reports.id
3434
}
35+
quarantine = {
36+
arn = module.s3bucket_quarantine.arn
37+
bucket = module.s3bucket_quarantine.bucket
38+
id = module.s3bucket_quarantine.id
39+
}
3540
}
3641
}
3742

‎infrastructure/terraform/components/app/module_backend_api.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ module "backend_api" {
1414
kms_key_arn = module.kms.key_arn
1515
parent_acct_environment = var.parent_acct_environment
1616
function_s3_bucket = local.acct.s3_buckets["artefacts"]["id"]
17+
quarantine_s3_bucket = local.acct.s3_buckets["quarantine"]["id"]
1718

1819
cloudfront_distribution_arn = aws_cloudfront_distribution.main.arn
1920

‎infrastructure/terraform/modules/backend-api/data_s3_bucket.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
data "aws_s3_bucket" "quarantine" {
2+
bucket = var.quarantine_s3_bucket
3+
}

‎infrastructure/terraform/modules/backend-api/guardduty_malware_protection_plan_quarantine.tf‎

Lines changed: 2 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,10 @@
11
resource "aws_guardduty_malware_protection_plan" "quarantine" {
2-
depends_on = [
3-
aws_iam_role_policy_attachment.guardduty_quarantine
4-
]
5-
62
role = aws_iam_role.guardduty_quarantine.arn
73

84
protected_resource {
95
s3_bucket {
10-
bucket_name = module.s3bucket_quarantine.id
11-
object_prefixes = ["pdf-template/", "test-data/", "proofs/"]
6+
bucket_name = data.aws_s3_bucket.quarantine.id
7+
object_prefixes = ["${local.csi}/pdf-template/", "${local.csi}/test-data/", "${local.csi}/proofs/"]
128
}
139
}
1410

‎infrastructure/terraform/modules/backend-api/locals.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ locals {
3838
TEMPLATE_SUBMITTED_SENDER_EMAIL_ADDRESS = var.template_submitted_sender_email_address
3939
TEMPLATES_DOWNLOAD_BUCKET_NAME = module.s3bucket_download.id
4040
TEMPLATES_INTERNAL_BUCKET_NAME = module.s3bucket_internal.id
41-
TEMPLATES_QUARANTINE_BUCKET_NAME = module.s3bucket_quarantine.id
41+
TEMPLATES_QUARANTINE_BUCKET_NAME = data.aws_s3_bucket.quarantine.id
4242
TEMPLATES_TABLE_NAME = aws_dynamodb_table.templates.name
4343
}
4444

0 commit comments

Comments
 (0)