Skip to content

Commit 35d90e9

Browse files
chris-elliott-nhsdchris-elliott-nhsd
committed
CCM-8418: Lambda packaging
1 parent 632f64e commit 35d90e9

File tree

52 files changed

+768
-681
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

52 files changed

+768
-681
lines changed

‎infrastructure/terraform/components/acct/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
| <a name="module_kms_sandbox"></a> [kms\_sandbox](#module\_kms\_sandbox) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/kms | v1.0.8 |
3737
| <a name="module_obs_datasource"></a> [obs\_datasource](#module\_obs\_datasource) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/obs-datasource | v2.0.3 |
3838
| <a name="module_s3bucket_access_logs"></a> [s3bucket\_access\_logs](#module\_s3bucket\_access\_logs) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.9 |
39+
| <a name="module_s3bucket_artefacts"></a> [s3bucket\_artefacts](#module\_s3bucket\_artefacts) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.8 |
3940
| <a name="module_s3bucket_backup_reports"></a> [s3bucket\_backup\_reports](#module\_s3bucket\_backup\_reports) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.8 |
4041
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.19.0 |
4142
## Outputs

‎infrastructure/terraform/components/acct/module_obs_datasource.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,6 @@ module "obs_datasource" {
99
environment = var.environment
1010
component = var.component
1111

12-
oam_sink_id = var.oam_sink_id
13-
observability_account_id = var.observability_account_id
12+
oam_sink_id = var.oam_sink_id
13+
observability_account_id = var.observability_account_id
1414
}

‎infrastructure/terraform/components/acct/module_s3bucket_artefacts.tf‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
module "s3bucket_artefacts" {
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket?ref=v1.0.8"
3+
4+
name = "artefacts"
5+
6+
aws_account_id = var.aws_account_id
7+
region = var.region
8+
project = var.project
9+
environment = var.environment
10+
component = var.component
11+
12+
acl = "private"
13+
force_destroy = false
14+
versioning = true
15+
16+
lifecycle_rules = [
17+
{
18+
prefix = ""
19+
enabled = true
20+
21+
noncurrent_version_transition = [
22+
{
23+
noncurrent_days = "30"
24+
storage_class = "STANDARD_IA"
25+
}
26+
]
27+
28+
noncurrent_version_expiration = {
29+
noncurrent_days = "90"
30+
}
31+
32+
abort_incomplete_multipart_upload = {
33+
days = "1"
34+
}
35+
}
36+
]
37+
38+
policy_documents = [
39+
data.aws_iam_policy_document.s3bucket_artefacts.json
40+
]
41+
42+
bucket_logging_target = {
43+
bucket = module.s3bucket_access_logs.id
44+
}
45+
46+
public_access = {
47+
block_public_acls = true
48+
block_public_policy = true
49+
ignore_public_acls = true
50+
restrict_public_buckets = true
51+
}
52+
53+
54+
default_tags = {
55+
Name = "Artefact bucket"
56+
}
57+
}
58+
59+
data "aws_iam_policy_document" "s3bucket_artefacts" {
60+
statement {
61+
sid = "DontAllowNonSecureConnection"
62+
effect = "Deny"
63+
64+
actions = [
65+
"s3:*",
66+
]
67+
68+
resources = [
69+
module.s3bucket_artefacts.arn,
70+
"${module.s3bucket_artefacts.arn}/*",
71+
]
72+
73+
principals {
74+
type = "AWS"
75+
76+
identifiers = [
77+
"*",
78+
]
79+
}
80+
81+
condition {
82+
test = "Bool"
83+
variable = "aws:SecureTransport"
84+
85+
values = [
86+
"false",
87+
]
88+
}
89+
}
90+
91+
statement {
92+
sid = "AllowManagedAccountsToList"
93+
effect = "Allow"
94+
95+
actions = [
96+
"s3:ListBucket",
97+
]
98+
99+
resources = [
100+
module.s3bucket_artefacts.arn,
101+
]
102+
103+
principals {
104+
type = "AWS"
105+
identifiers = [
106+
"arn:aws:iam::${var.aws_account_id}:root"
107+
]
108+
}
109+
}
110+
111+
statement {
112+
sid = "AllowManagedAccountsToGet"
113+
effect = "Allow"
114+
115+
actions = [
116+
"s3:GetObject",
117+
]
118+
119+
resources = [
120+
"${module.s3bucket_artefacts.arn}/*",
121+
]
122+
123+
principals {
124+
type = "AWS"
125+
identifiers = [
126+
"arn:aws:iam::${var.aws_account_id}:root"
127+
]
128+
}
129+
}
130+
}

‎infrastructure/terraform/components/acct/module_sandbox_kms.tf‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,5 +13,45 @@ module "kms_sandbox" {
1313
deletion_window = var.kms_deletion_window
1414
alias = "alias/${local.csi}-sandbox"
1515
iam_delegation = true
16+
17+
key_policy_documents = [data.aws_iam_policy_document.kms.json]
1618
}
1719

20+
data "aws_iam_policy_document" "kms" {
21+
# '*' resource scope is permitted in access policies as as the resource is itself
22+
# https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-services.html
23+
24+
statement {
25+
sid = "AllowCloudWatchEncrypt"
26+
effect = "Allow"
27+
28+
principals {
29+
type = "Service"
30+
31+
identifiers = [
32+
"logs.${var.region}.amazonaws.com",
33+
]
34+
}
35+
36+
actions = [
37+
"kms:Encrypt*",
38+
"kms:Decrypt*",
39+
"kms:ReEncrypt*",
40+
"kms:GenerateDataKey*",
41+
"kms:Describe*"
42+
]
43+
44+
resources = [
45+
"*",
46+
]
47+
48+
condition {
49+
test = "ArnLike"
50+
variable = "kms:EncryptionContext:aws:logs:arn"
51+
52+
values = [
53+
"arn:aws:logs:${var.region}:${var.aws_account_id}:log-group:*",
54+
]
55+
}
56+
}
57+
}

‎infrastructure/terraform/components/acct/outputs.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,11 @@ output "s3_buckets" {
1717
bucket = module.s3bucket_backup_reports.bucket
1818
id = module.s3bucket_backup_reports.id
1919
}
20+
artefacts = {
21+
arn = module.s3bucket_artefacts.arn
22+
bucket = module.s3bucket_artefacts.bucket
23+
id = module.s3bucket_artefacts.id
24+
}
2025
}
2126
}
2227

‎infrastructure/terraform/components/app/module_backend_api.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@ module "backend_api" {
1313
log_retention_in_days = var.log_retention_in_days
1414
kms_key_arn = module.kms.key_arn
1515
parent_acct_environment = var.parent_acct_environment
16+
function_s3_bucket = local.acct.s3_buckets["artefacts"]["id"]
1617

1718
cognito_config = jsondecode(aws_ssm_parameter.cognito_config.value)
1819

‎infrastructure/terraform/components/app/pre.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,6 @@ npm ci
22

33
npm run generate-dependencies --workspaces --if-present
44

5+
npm run lambda-build --workspaces --if-present
6+
57
$(git rev-parse --show-toplevel)/lambdas/layers/pdfjs/build.sh

‎infrastructure/terraform/components/sandbox/locals.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
locals {
2+
parent_acct_environment = "main"
3+
}

‎infrastructure/terraform/components/sandbox/locals_remote_state.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
locals {
2+
acct = data.terraform_remote_state.acct.outputs
3+
}
4+
5+
data "terraform_remote_state" "acct" {
6+
backend = "s3"
7+
8+
config = {
9+
bucket = local.terraform_state_bucket
10+
11+
key = format(
12+
"%s/%s/%s/%s/acct.tfstate",
13+
var.project,
14+
var.aws_account_id,
15+
"eu-west-2",
16+
local.parent_acct_environment
17+
)
18+
19+
region = "eu-west-2"
20+
}
21+
}

‎infrastructure/terraform/components/sandbox/locals_tfscaffold.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,11 @@
11
locals {
2+
terraform_state_bucket = format(
3+
"%s-tfscaffold-%s-%s",
4+
var.project,
5+
var.aws_account_id,
6+
var.region,
7+
)
8+
29
csi = replace(
310
format(
411
"%s-%s-%s",

0 commit comments

Comments
 (0)