CCM-9868: splunk subscription (#475)

sidnhs · web-flow · commit 2c0c7f52ec1a · 2025-05-15T10:18:44.000+01:00
diff --git a/infrastructure/terraform/components/app/module_backend_api.tf b/infrastructure/terraform/components/app/module_backend_api.tf
@@ -18,7 +18,10 @@ module "backend_api" {
 
   enable_backup = var.destination_vault_arn != null ? true : false
 
-  enable_letters   = var.enable_letters
-  enable_proofing  = var.enable_proofing
-  letter_suppliers = var.letter_suppliers
+  enable_letters                 = var.enable_letters
+  enable_proofing                = var.enable_proofing
+  letter_suppliers               = var.letter_suppliers
+  log_destination_arn = "arn:aws:logs:${var.region}:${var.observability_account_id}:destination:nhs-notify-main-acct-firehose-logs"
+  log_subscription_role_arn      = local.acct.log_subscription_role_arn
+
 }
diff --git a/infrastructure/terraform/modules/backend-api/README.md b/infrastructure/terraform/modules/backend-api/README.md
@@ -21,7 +21,9 @@ No requirements.
 | <a name="input_group"></a> [group](#input\_group) | The group variables are being inherited from (often synonmous with account short-name) | `string` | n/a | yes |
 | <a name="input_kms_key_arn"></a> [kms\_key\_arn](#input\_kms\_key\_arn) | KMS Key ARN | `string` | n/a | yes |
 | <a name="input_letter_suppliers"></a> [letter\_suppliers](#input\_letter\_suppliers) | Letter suppliers enabled in the environment | <pre>map(object({<br/>    enable_polling   = bool<br/>    default_supplier = optional(bool)<br/>  }))</pre> | n/a | yes |
+| <a name="input_log_destination_arn"></a> [log\_destination\_arn](#input\_log\_destination\_arn) | Destination ARN to use for the log subscription filter | `string` | `""` | no |
 | <a name="input_log_retention_in_days"></a> [log\_retention\_in\_days](#input\_log\_retention\_in\_days) | The retention period in days for the Cloudwatch Logs events to be retained, default of 0 is indefinite | `number` | `0` | no |
+| <a name="input_log_subscription_role_arn"></a> [log\_subscription\_role\_arn](#input\_log\_subscription\_role\_arn) | The ARN of the IAM role to use for the log subscription filter | `string` | `""` | no |
 | <a name="input_module"></a> [module](#input\_module) | The variable encapsulating the name of this module | `string` | `"api"` | no |
 | <a name="input_parent_acct_environment"></a> [parent\_acct\_environment](#input\_parent\_acct\_environment) | Name of the environment responsible for the acct resources used | `string` | n/a | yes |
 | <a name="input_project"></a> [project](#input\_project) | The name of the tfscaffold project | `string` | n/a | yes |
diff --git a/infrastructure/terraform/modules/backend-api/cloudwatch_log_group_api_gateway_access.tf b/infrastructure/terraform/modules/backend-api/cloudwatch_log_group_api_gateway_access.tf
@@ -2,3 +2,12 @@ resource "aws_cloudwatch_log_group" "api_gateway_access" {
   name              = "/aws/api-gateway/${aws_api_gateway_rest_api.main.id}/${var.environment}/access-logs"
   retention_in_days = var.log_retention_in_days
 }
+
+resource "aws_cloudwatch_log_subscription_filter" "api_gateway_access" {
+  count = var.log_destination_arn != "" ? 1 : 0
+  name            = replace(aws_cloudwatch_log_group.api_gateway_access.name, "/", "-")
+  log_group_name  = aws_cloudwatch_log_group.api_gateway_access.name
+  filter_pattern  = ""
+  destination_arn = var.log_destination_arn
+  role_arn        = var.log_subscription_role_arn
+}
diff --git a/infrastructure/terraform/modules/backend-api/cloudwatch_log_group_api_gateway_execution.tf b/infrastructure/terraform/modules/backend-api/cloudwatch_log_group_api_gateway_execution.tf
@@ -5,3 +5,12 @@ resource "aws_cloudwatch_log_group" "api_gateway_execution" {
   )
   retention_in_days = var.log_retention_in_days
 }
+
+resource "aws_cloudwatch_log_subscription_filter" "api_gateway_execution" {
+  count = var.log_destination_arn != "" ? 1 : 0
+  name            = replace(aws_cloudwatch_log_group.api_gateway_execution.name, "/", "-")
+  log_group_name  = aws_cloudwatch_log_group.api_gateway_execution.name
+  filter_pattern  = ""
+  destination_arn = var.log_destination_arn
+  role_arn        = var.log_subscription_role_arn
+}
diff --git a/infrastructure/terraform/modules/backend-api/module_authorizer_lambda.tf b/infrastructure/terraform/modules/backend-api/module_authorizer_lambda.tf
@@ -19,6 +19,8 @@ module "authorizer_lambda" {
     USER_POOL_ID        = var.cognito_config["USER_POOL_ID"],
     USER_POOL_CLIENT_ID = var.cognito_config["USER_POOL_CLIENT_ID"],
   }
+  log_destination_arn = var.log_destination_arn
+  log_subscription_role_arn      = var.log_subscription_role_arn
 }
 
 module "authorizer_build" {
diff --git a/infrastructure/terraform/modules/backend-api/module_create_letter_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_create_letter_template_lambda.tf
@@ -16,6 +16,8 @@ module "create_letter_template_lambda" {
   environment_variables = local.backend_lambda_environment_variables
 
   execution_role_policy_document = data.aws_iam_policy_document.create_letter_template_lambda_policy.json
+  log_destination_arn = var.log_destination_arn
+  log_subscription_role_arn      = var.log_subscription_role_arn
 }
 
 data "aws_iam_policy_document" "create_letter_template_lambda_policy" {
diff --git a/infrastructure/terraform/modules/backend-api/module_create_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_create_template_lambda.tf
@@ -15,6 +15,8 @@ module "create_template_lambda" {
   environment_variables = local.backend_lambda_environment_variables
 
   execution_role_policy_document = data.aws_iam_policy_document.create_template_lambda_policy.json
+  log_destination_arn = var.log_destination_arn
+  log_subscription_role_arn      = var.log_subscription_role_arn
 }
 
 data "aws_iam_policy_document" "create_template_lambda_policy" {
diff --git a/infrastructure/terraform/modules/backend-api/module_delete_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_delete_template_lambda.tf
@@ -15,6 +15,8 @@ module "delete_template_lambda" {
   environment_variables = local.backend_lambda_environment_variables
 
   execution_role_policy_document = data.aws_iam_policy_document.delete_template_lambda_policy.json
+  log_destination_arn = var.log_destination_arn
+  log_subscription_role_arn      = var.log_subscription_role_arn
 }
 
 data "aws_iam_policy_document" "delete_template_lambda_policy" {
diff --git a/infrastructure/terraform/modules/backend-api/module_get_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_get_template_lambda.tf
@@ -15,6 +15,8 @@ module "get_template_lambda" {
   environment_variables = local.backend_lambda_environment_variables
 
   execution_role_policy_document = data.aws_iam_policy_document.get_template_lambda_policy.json
+  log_destination_arn = var.log_destination_arn
+  log_subscription_role_arn      = var.log_subscription_role_arn
 }
 
 data "aws_iam_policy_document" "get_template_lambda_policy" {
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_copy_scanned_object_to_internal.tf b/infrastructure/terraform/modules/backend-api/module_lambda_copy_scanned_object_to_internal.tf
@@ -10,7 +10,9 @@ module "lambda_copy_scanned_object_to_internal" {
   log_retention_in_days          = var.log_retention_in_days
   source_code_hash               = module.build_template_lambda.zips[local.backend_lambda_entrypoints.copy_scanned_object_to_internal].base64sha256
 
-  environment_variables = local.backend_lambda_environment_variables
+  environment_variables          = local.backend_lambda_environment_variables
+  log_destination_arn = var.log_destination_arn
+  log_subscription_role_arn      = var.log_subscription_role_arn
 }
 
 data "aws_iam_policy_document" "copy_scanned_object_to_internal" {
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_delete_failed_scanned_object.tf b/infrastructure/terraform/modules/backend-api/module_lambda_delete_failed_scanned_object.tf
@@ -10,6 +10,8 @@ module "lambda_delete_failed_scanned_object" {
   log_retention_in_days          = var.log_retention_in_days
   source_code_hash               = module.build_template_lambda.zips[local.backend_lambda_entrypoints.delete_failed_scanned_object].base64sha256
   environment_variables          = local.backend_lambda_environment_variables
+  log_destination_arn = var.log_destination_arn
+  log_subscription_role_arn      = var.log_subscription_role_arn
 }
 
 data "aws_iam_policy_document" "delete_failed_scanned_object" {
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_process_proof.tf b/infrastructure/terraform/modules/backend-api/module_lambda_process_proof.tf
@@ -12,8 +12,10 @@ module "lambda_process_proof" {
 
   environment_variables = local.backend_lambda_environment_variables
 
-  timeout     = 30
-  memory_size = 512
+  timeout                        = 30
+  memory_size                    = 512
+  log_destination_arn = var.log_destination_arn
+  log_subscription_role_arn      = var.log_subscription_role_arn
 }
 
 data "aws_iam_policy_document" "process_proof" {
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_request_proof.tf b/infrastructure/terraform/modules/backend-api/module_lambda_request_proof.tf
@@ -16,6 +16,8 @@ module "request_proof_lambda" {
   environment_variables = local.backend_lambda_environment_variables
 
   execution_role_policy_document = data.aws_iam_policy_document.request_proof_lambda_policy.json
+  log_destination_arn = var.log_destination_arn
+  log_subscription_role_arn      = var.log_subscription_role_arn
 }
 
 data "aws_iam_policy_document" "request_proof_lambda_policy" {
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_send_letter_proof.tf b/infrastructure/terraform/modules/backend-api/module_lambda_send_letter_proof.tf
@@ -13,6 +13,8 @@ module "lambda_send_letter_proof" {
   log_retention_in_days = var.log_retention_in_days
 
   execution_role_policy_document = data.aws_iam_policy_document.send_letter_proof.json
+  log_destination_arn = var.log_destination_arn
+  log_subscription_role_arn      = var.log_subscription_role_arn
 
   environment_variables = {
     CREDENTIALS_TTL_SECONDS = 900
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_set_letter_file_virus_scan_status_for_upload.tf b/infrastructure/terraform/modules/backend-api/module_lambda_set_letter_file_virus_scan_status_for_upload.tf
@@ -12,8 +12,10 @@ module "lambda_set_file_virus_scan_status_for_upload" {
 
   environment_variables = local.backend_lambda_environment_variables
 
-  timeout     = 20
-  memory_size = 512
+  timeout                        = 20
+  memory_size                    = 512
+  log_destination_arn = var.log_destination_arn
+  log_subscription_role_arn      = var.log_subscription_role_arn
 }
 
 data "aws_iam_policy_document" "set_file_virus_scan_status_for_upload" {
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_sftp_poll.tf b/infrastructure/terraform/modules/backend-api/module_lambda_sftp_poll.tf
@@ -29,6 +29,8 @@ module "lambda_sftp_poll" {
     subnet_ids         = data.aws_subnets.account_vpc_private_subnets.ids
     security_group_ids = [data.aws_security_group.account_vpc_sg_allow_sftp_egress.id]
   }
+  log_destination_arn = var.log_destination_arn
+  log_subscription_role_arn      = var.log_subscription_role_arn
 }
 
 data "aws_iam_policy_document" "sftp_poll" {
diff --git a/infrastructure/terraform/modules/backend-api/module_lambda_validate_letter_template_files.tf b/infrastructure/terraform/modules/backend-api/module_lambda_validate_letter_template_files.tf
@@ -15,7 +15,9 @@ module "lambda_validate_letter_template_files" {
     sqs_queue_arn = module.sqs_validate_letter_template_files.sqs_queue_arn
     batch_size    = 1
   }
-  timeout = 10
+  timeout                        = 10
+  log_destination_arn = var.log_destination_arn
+  log_subscription_role_arn      = var.log_subscription_role_arn
 }
 
 data "aws_iam_policy_document" "validate_letter_template_files" {
diff --git a/infrastructure/terraform/modules/backend-api/module_list_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_list_template_lambda.tf
@@ -15,6 +15,8 @@ module "list_template_lambda" {
   environment_variables = local.backend_lambda_environment_variables
 
   execution_role_policy_document = data.aws_iam_policy_document.list_template_lambda_policy.json
+  log_destination_arn = var.log_destination_arn
+  log_subscription_role_arn      = var.log_subscription_role_arn
 }
 
 data "aws_iam_policy_document" "list_template_lambda_policy" {
diff --git a/infrastructure/terraform/modules/backend-api/module_submit_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_submit_template_lambda.tf
@@ -15,6 +15,8 @@ module "submit_template_lambda" {
   environment_variables = local.backend_lambda_environment_variables
 
   execution_role_policy_document = data.aws_iam_policy_document.submit_template_lambda_policy.json
+  log_destination_arn = var.log_destination_arn
+  log_subscription_role_arn      = var.log_subscription_role_arn
 }
 
 data "aws_iam_policy_document" "submit_template_lambda_policy" {
diff --git a/infrastructure/terraform/modules/backend-api/module_update_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_update_template_lambda.tf
@@ -15,6 +15,8 @@ module "update_template_lambda" {
   environment_variables = local.backend_lambda_environment_variables
 
   execution_role_policy_document = data.aws_iam_policy_document.update_template_lambda_policy.json
+  log_destination_arn = var.log_destination_arn
+  log_subscription_role_arn      = var.log_subscription_role_arn
 }
 
 data "aws_iam_policy_document" "update_template_lambda_policy" {
diff --git a/infrastructure/terraform/modules/backend-api/variables.tf b/infrastructure/terraform/modules/backend-api/variables.tf
@@ -104,3 +104,15 @@ variable "parent_acct_environment" {
   type        = string
   description = "Name of the environment responsible for the acct resources used"
 }
+
+variable "log_destination_arn" {
+  type        = string
+  description = "Destination ARN to use for the log subscription filter"
+  default     = ""
+}
+
+variable "log_subscription_role_arn" {
+  type        = string
+  description = "The ARN of the IAM role to use for the log subscription filter"
+  default     = ""
+}
diff --git a/infrastructure/terraform/modules/lambda-function/README.md b/infrastructure/terraform/modules/lambda-function/README.md
@@ -14,10 +14,13 @@ No requirements.
 | <a name="input_environment_variables"></a> [environment\_variables](#input\_environment\_variables) | Lambda environment variables | `map(string)` | `{}` | no |
 | <a name="input_execution_role_policy_document"></a> [execution\_role\_policy\_document](#input\_execution\_role\_policy\_document) | IAM Policy Document containing additional runtime permissions for the Lambda function beyond the basic execution policy | `string` | `""` | no |
 | <a name="input_filename"></a> [filename](#input\_filename) | Path to the function's deployment package within the local filesystem | `string` | n/a | yes |
+| <a name="input_filter_pattern"></a> [filter\_pattern](#input\_filter\_pattern) | Filter pattern to use for the log subscription filter | `string` | `""` | no |
 | <a name="input_function_name"></a> [function\_name](#input\_function\_name) | Unique name of the Lambda function | `string` | n/a | yes |
 | <a name="input_handler"></a> [handler](#input\_handler) | Function entrypoint in your code | `string` | n/a | yes |
 | <a name="input_layer_arns"></a> [layer\_arns](#input\_layer\_arns) | List of Lambda Layer Version ARNs (maximum of 5) to attach to your Lambda Function. | `list(string)` | `null` | no |
+| <a name="input_log_destination_arn"></a> [log\_destination\_arn](#input\_log\_destination\_arn) | Destination ARN to use for the log subscription filter | `string` | `""` | no |
 | <a name="input_log_retention_in_days"></a> [log\_retention\_in\_days](#input\_log\_retention\_in\_days) | Specifies the number of days you want to retain log events in the log group for this Lambda | `number` | `0` | no |
+| <a name="input_log_subscription_role_arn"></a> [log\_subscription\_role\_arn](#input\_log\_subscription\_role\_arn) | The ARN of the IAM role to use for the log subscription filter | `string` | `""` | no |
 | <a name="input_memory_size"></a> [memory\_size](#input\_memory\_size) | Lambda memory size | `number` | `128` | no |
 | <a name="input_runtime"></a> [runtime](#input\_runtime) | Identifier of the function's runtime | `string` | `"nodejs20.x"` | no |
 | <a name="input_source_code_hash"></a> [source\_code\_hash](#input\_source\_code\_hash) | Base64-encoded SHA256 hash of the package file specified by `filename` | `string` | n/a | yes |
diff --git a/infrastructure/terraform/modules/lambda-function/cloudwatch_log_subscription_filter_firehose.tf b/infrastructure/terraform/modules/lambda-function/cloudwatch_log_subscription_filter_firehose.tf
@@ -0,0 +1,8 @@
+resource "aws_cloudwatch_log_subscription_filter" "firehose" {
+  count = var.log_destination_arn != "" ? 1 : 0
+  name            = replace(aws_cloudwatch_log_group.lambda.name, "/", "-")
+  log_group_name  = aws_cloudwatch_log_group.lambda.name
+  filter_pattern  = var.filter_pattern
+  destination_arn = var.log_destination_arn
+  role_arn        = var.log_subscription_role_arn
+}
diff --git a/infrastructure/terraform/modules/lambda-function/variables.tf b/infrastructure/terraform/modules/lambda-function/variables.tf
@@ -94,3 +94,21 @@ variable "sqs_event_source_mapping" {
   })
   default = null
 }
+
+variable "filter_pattern" {
+  type        = string
+  description = "Filter pattern to use for the log subscription filter"
+  default     = ""
+}
+
+variable "log_destination_arn" {
+  type        = string
+  description = "Destination ARN to use for the log subscription filter"
+  default     = ""
+}
+
+variable "log_subscription_role_arn" {
+  type        = string
+  description = "The ARN of the IAM role to use for the log subscription filter"
+  default     = ""
+}

Original file line number	Diff line number	Diff line change
`@@ -5,3 +5,12 @@ resource "aws_cloudwatch_log_group" "api_gateway_execution" {`
`5`	`5`	`)`
`6`	`6`	`retention_in_days = var.log_retention_in_days`
`7`	`7`	`}`
	`8`	`+`
	`9`	`+resource "aws_cloudwatch_log_subscription_filter" "api_gateway_execution" {`
	`10`	`+ count = var.log_destination_arn != "" ? 1 : 0`
	`11`	`+ name = replace(aws_cloudwatch_log_group.api_gateway_execution.name, "/", "-")`
	`12`	`+ log_group_name = aws_cloudwatch_log_group.api_gateway_execution.name`
	`13`	`+ filter_pattern = ""`
	`14`	`+ destination_arn = var.log_destination_arn`
	`15`	`+ role_arn = var.log_subscription_role_arn`
	`16`	`+}`
Original file line number	Diff line number	Diff line change
`@@ -19,6 +19,8 @@ module "authorizer_lambda" {`
`19`	`19`	`USER_POOL_ID = var.cognito_config["USER_POOL_ID"],`
`20`	`20`	`USER_POOL_CLIENT_ID = var.cognito_config["USER_POOL_CLIENT_ID"],`
`21`	`21`	`}`
	`22`	`+ log_destination_arn = var.log_destination_arn`
	`23`	`+ log_subscription_role_arn = var.log_subscription_role_arn`
`22`	`24`	`}`
`23`	`25`
`24`	`26`	`module "authorizer_build" {`
Original file line number	Diff line number	Diff line change
`@@ -16,6 +16,8 @@ module "create_letter_template_lambda" {`
`16`	`16`	`environment_variables = local.backend_lambda_environment_variables`
`17`	`17`
`18`	`18`	`execution_role_policy_document = data.aws_iam_policy_document.create_letter_template_lambda_policy.json`
	`19`	`+ log_destination_arn = var.log_destination_arn`
	`20`	`+ log_subscription_role_arn = var.log_subscription_role_arn`
`19`	`21`	`}`
`20`	`22`
`21`	`23`	`data "aws_iam_policy_document" "create_letter_template_lambda_policy" {`
Original file line number	Diff line number	Diff line change
`@@ -15,6 +15,8 @@ module "create_template_lambda" {`
`15`	`15`	`environment_variables = local.backend_lambda_environment_variables`
`16`	`16`
`17`	`17`	`execution_role_policy_document = data.aws_iam_policy_document.create_template_lambda_policy.json`
	`18`	`+ log_destination_arn = var.log_destination_arn`
	`19`	`+ log_subscription_role_arn = var.log_subscription_role_arn`
`18`	`20`	`}`
`19`	`21`
`20`	`22`	`data "aws_iam_policy_document" "create_template_lambda_policy" {`
Original file line number	Diff line number	Diff line change
`@@ -15,6 +15,8 @@ module "delete_template_lambda" {`
`15`	`15`	`environment_variables = local.backend_lambda_environment_variables`
`16`	`16`
`17`	`17`	`execution_role_policy_document = data.aws_iam_policy_document.delete_template_lambda_policy.json`
	`18`	`+ log_destination_arn = var.log_destination_arn`
	`19`	`+ log_subscription_role_arn = var.log_subscription_role_arn`
`18`	`20`	`}`
`19`	`21`
`20`	`22`	`data "aws_iam_policy_document" "delete_template_lambda_policy" {`
Original file line number	Diff line number	Diff line change
`@@ -15,6 +15,8 @@ module "get_template_lambda" {`
`15`	`15`	`environment_variables = local.backend_lambda_environment_variables`
`16`	`16`
`17`	`17`	`execution_role_policy_document = data.aws_iam_policy_document.get_template_lambda_policy.json`
	`18`	`+ log_destination_arn = var.log_destination_arn`
	`19`	`+ log_subscription_role_arn = var.log_subscription_role_arn`
`18`	`20`	`}`
`19`	`21`
`20`	`22`	`data "aws_iam_policy_document" "get_template_lambda_policy" {`
Original file line number	Diff line number	Diff line change
`@@ -10,7 +10,9 @@ module "lambda_copy_scanned_object_to_internal" {`
`10`	`10`	`log_retention_in_days = var.log_retention_in_days`
`11`	`11`	`source_code_hash = module.build_template_lambda.zips[local.backend_lambda_entrypoints.copy_scanned_object_to_internal].base64sha256`
`12`	`12`
`13`		`- environment_variables = local.backend_lambda_environment_variables`
	`13`	`+ environment_variables = local.backend_lambda_environment_variables`
	`14`	`+ log_destination_arn = var.log_destination_arn`
	`15`	`+ log_subscription_role_arn = var.log_subscription_role_arn`
`14`	`16`	`}`
`15`	`17`
`16`	`18`	`data "aws_iam_policy_document" "copy_scanned_object_to_internal" {`