CCM-10048: do not deploy GuardDuty

bhansell1 · bhansell1 · commit 571b5f1988e5 · 2025-06-16T08:56:47.000+01:00
diff --git a/infrastructure/terraform/components/sandbox/outputs.tf b/infrastructure/terraform/components/sandbox/outputs.tf
@@ -14,10 +14,6 @@ output "download_bucket_name" {
   value = module.backend_api.download_bucket_name
 }
 
-output "guardduty_quarantine_arn" {
-  value = module.backend_api.guardduty_quarantine_arn
-}
-
 output "internal_bucket_name" {
   value = module.backend_api.internal_bucket_name
 }
diff --git a/infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_failed_for_proof.tf b/infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_failed_for_proof.tf
@@ -3,9 +3,9 @@ resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_failed_for_proof
   description = "Matches quarantine 'GuardDuty Malware Protection Object Scan Result' events where the scan result is not NO_THREATS_FOUND"
 
   event_pattern = jsonencode({
-    source      = compact(["aws.guardduty", var.test_environment_mock_guardduty_event_source])
+    source      = [local.guardduty_source]
     detail-type = ["GuardDuty Malware Protection Object Scan Result"]
-    resources   = [aws_guardduty_malware_protection_plan.quarantine.arn]
+    resources   = [local.guardduty_resource]
     detail = {
       s3ObjectDetails = {
         bucketName = [module.s3bucket_quarantine.id]
diff --git a/infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_failed_for_upload.tf b/infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_failed_for_upload.tf
@@ -3,9 +3,9 @@ resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_failed_for_uploa
   description = "Matches quarantine 'GuardDuty Malware Protection Object Scan Result' events where the scan result is not NO_THREATS_FOUND"
 
   event_pattern = jsonencode({
-    source      = compact(["aws.guardduty", var.test_environment_mock_guardduty_event_source])
+    source      = [local.guardduty_source]
     detail-type = ["GuardDuty Malware Protection Object Scan Result"]
-    resources   = [aws_guardduty_malware_protection_plan.quarantine.arn]
+    resources   = [local.guardduty_resource]
     detail = {
       s3ObjectDetails = {
         bucketName = [module.s3bucket_quarantine.id]
diff --git a/infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_passed_for_proof.tf b/infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_passed_for_proof.tf
@@ -3,9 +3,9 @@ resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_passed_for_proof
   description = "Matches quarantine 'GuardDuty Malware Protection Object Scan Result' events where the scan result is NO_THREATS_FOUND"
 
   event_pattern = jsonencode({
-    source      = compact(["aws.guardduty", var.test_environment_mock_guardduty_event_source])
+    source      = [local.guardduty_source]
     detail-type = ["GuardDuty Malware Protection Object Scan Result"]
-    resources   = [aws_guardduty_malware_protection_plan.quarantine.arn]
+    resources   = [local.guardduty_resource]
     detail = {
       s3ObjectDetails = {
         bucketName = [module.s3bucket_quarantine.id]
diff --git a/infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_passed_for_upload.tf b/infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_passed_for_upload.tf
@@ -3,9 +3,9 @@ resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_passed_for_uploa
   description = "Matches quarantine 'GuardDuty Malware Protection Object Scan Result' events where the scan result is NO_THREATS_FOUND"
 
   event_pattern = jsonencode({
-    source      = compact(["aws.guardduty", var.test_environment_mock_guardduty_event_source])
+    source      = [local.guardduty_source]
     detail-type = ["GuardDuty Malware Protection Object Scan Result"]
-    resources   = [aws_guardduty_malware_protection_plan.quarantine.arn]
+    resources   = [local.guardduty_resource]
     detail = {
       s3ObjectDetails = {
         bucketName = [module.s3bucket_quarantine.id]
diff --git a/infrastructure/terraform/modules/backend-api/guardduty_malware_protection_plan_quarantine.tf b/infrastructure/terraform/modules/backend-api/guardduty_malware_protection_plan_quarantine.tf
@@ -1,4 +1,6 @@
 resource "aws_guardduty_malware_protection_plan" "quarantine" {
+  count = var.enable_guardduty ? 1 : 0
+
   role = aws_iam_role.guardduty_quarantine.arn
 
   protected_resource {
diff --git a/infrastructure/terraform/modules/backend-api/locals.tf b/infrastructure/terraform/modules/backend-api/locals.tf
@@ -61,4 +61,8 @@ locals {
   ][0], "")
 
   sftp_environment = "${var.group}-${var.environment}-${var.component}"
+
+  guardduty_source = var.enable_guardduty ? "aws.guardduty" : "test.guardduty"
+
+  guardduty_resource = var.enable_guardduty ? aws_guardduty_malware_protection_plan.quarantine[0].arn : "test:guardduty"
 }
diff --git a/infrastructure/terraform/modules/backend-api/outputs.tf b/infrastructure/terraform/modules/backend-api/outputs.tf
@@ -10,10 +10,6 @@ output "download_bucket_regional_domain_name" {
   value = module.s3bucket_download.bucket_regional_domain_name
 }
 
-output "guardduty_quarantine_arn" {
-  value = aws_guardduty_malware_protection_plan.quarantine.arn
-}
-
 output "internal_bucket_name" {
   value = module.s3bucket_internal.id
 }
diff --git a/infrastructure/terraform/modules/backend-api/variables.tf b/infrastructure/terraform/modules/backend-api/variables.tf
@@ -71,6 +71,12 @@ variable "enable_backup" {
   default     = true
 }
 
+variable "enable_guardduty" {
+  type        = bool
+  description = "Enable GuardDuty"
+  default     = false
+}
+
 variable "enable_proofing" {
   type        = bool
   description = "Enable proofing feature flag"
diff --git a/run-e2e.sh b/run-e2e.sh
@@ -21,7 +21,7 @@ print_error() {
     echo -e "${RED}[ERROR]${NC} $1"
 }
 
-RANDOM_DIGITS=0056
+RANDOM_DIGITS=0082
 ENVIRONMENT_NAME="${RANDOM_DIGITS}flaky"
 TOTAL_RUNS=1
 export CI=1
@@ -64,14 +64,31 @@ for i in $(seq 1 $TOTAL_RUNS); do
       cp -r tests/test-team/playwright-report/* "$RUN_DIR/" 2>/dev/null || true
   fi
 
-  #  Destory environment
-  print_status "Destorying $ENVIRONMENT_NAME env... "
-  if ./scripts/destroy_backend_sandbox.sh "$ENVIRONMENT_NAME"; then
-      print_status "Environment destroyed successfully"
-  else
-      print_warning "Could not automagically destroy environment. You may need to clean up manually."
-      print_warning "Environment name: $ENVIRONMENT_NAME"
-  fi
+  echo
+  while true; do
+      read -p "Do you want to destroy the environment '$ENVIRONMENT_NAME'? [Y/n]: " choice
+
+      case $choice in
+          [Yy]* | "" )  # Default to Yes if user just presses Enter
+              print_status "Destorying environment '$ENVIRONMENT_NAME'..."
+              if ./scripts/destroy_backend_sandbox.sh "$ENVIRONMENT_NAME"; then
+                  print_status "Environment destroyed successfully"
+              else
+                  print_warning "Could not automaically destroy environment. You may need to clean up manually."
+                  print_warning "Environment name: $ENVIRONMENT_NAME"
+              fi
+              break
+              ;;
+          [Nn]* )
+              print_warning "Environment '$ENVIRONMENT_NAME' left running"
+              print_status "Remember to clean it up later to avoid unnecessary costs"
+              break
+              ;;
+          * )
+              echo "Please answer Y (yes) or n (no)"
+              ;;
+      esac
+  done
 done
 
 print_status "Script completed"
diff --git a/tests/test-team/helpers/eventbridge/eventbridge-helper.ts b/tests/test-team/helpers/eventbridge/eventbridge-helper.ts
@@ -40,15 +40,18 @@ export class EventBridgeHelper {
         }
       );
     }
+
+    return true;
   }
 
   private createGuardDutyEvent(
     s3ObjectKey: string,
     scanResultStatus: GuardDutyScanResult,
     versionId: string
   ) {
-    const SOURCE = 'test.guardduty';
     const DETAIL_TYPE = 'GuardDuty Malware Protection Object Scan Result';
+    const RESOURCE = 'test:guardduty';
+    const SOURCE = 'test.guardduty';
 
     return {
       Source: SOURCE,
@@ -61,11 +64,11 @@ export class EventBridgeHelper {
         s3ObjectDetails: {
           bucketName: process.env.TEMPLATES_QUARANTINE_BUCKET_NAME,
           objectKey: s3ObjectKey,
-          eTag: `test-etag-${Date.now()}`,
+          eTag: `etag-${Date.now()}`,
           versionId: versionId,
         },
       }),
-      Resources: [process.env.TEMPLATES_GUARDDUTY_RESOURCE_ARN],
+      Resources: [RESOURCE],
     };
   }
 }
diff --git a/tests/test-team/helpers/use-cases/simulate-guard-duty-scan.ts b/tests/test-team/helpers/use-cases/simulate-guard-duty-scan.ts
diff --git a/tests/test-team/template-mgmt-e2e-tests/template-mgmt-letter-file-validation.e2e.spec.ts b/tests/test-team/template-mgmt-e2e-tests/template-mgmt-letter-file-validation.e2e.spec.ts
@@ -61,12 +61,12 @@ test.describe('letter file validation', () => {
 
     templateStorageHelper.addAdHocTemplateKey(key);
 
-    assertPdfTemplateGuardDutyEvent({
+    await assertPdfTemplateGuardDutyEvent({
       key,
       scanResult: 'NO_THREATS_FOUND',
     });
 
-    assertTestDataGuardDutyEvent({
+    await assertTestDataGuardDutyEvent({
       key,
       scanResult: 'NO_THREATS_FOUND',
     });
@@ -158,16 +158,13 @@ test.describe('letter file validation', () => {
 
     templateStorageHelper.addAdHocTemplateKey(key);
 
-    assertPdfTemplateGuardDutyEvent({
+    await assertPdfTemplateGuardDutyEvent({
       key,
       scanResult: 'NO_THREATS_FOUND',
     });
 
     await expect(async () => {
-      const template = await templateStorageHelper.getTemplate({
-        id: templateId,
-        owner: user.userId,
-      });
+      const template = await templateStorageHelper.getTemplate(key);
 
       expect(template.files?.pdfTemplate?.virusScanStatus).toBe('PASSED');
       expect(template.templateStatus).toBe('PENDING_PROOF_REQUEST');
@@ -237,12 +234,12 @@ test.describe('letter file validation', () => {
 
     templateStorageHelper.addAdHocTemplateKey(key);
 
-    assertPdfTemplateGuardDutyEvent({
+    await assertPdfTemplateGuardDutyEvent({
       key,
       scanResult: 'NO_THREATS_FOUND',
     });
 
-    assertTestDataGuardDutyEvent({
+    await assertTestDataGuardDutyEvent({
       key,
       scanResult: 'THREATS_FOUND',
     });
@@ -410,12 +407,12 @@ test.describe('letter file validation', () => {
 
     templateStorageHelper.addAdHocTemplateKey(key);
 
-    assertPdfTemplateGuardDutyEvent({
+    await assertPdfTemplateGuardDutyEvent({
       key,
       scanResult: 'NO_THREATS_FOUND',
     });
 
-    assertTestDataGuardDutyEvent({
+    await assertTestDataGuardDutyEvent({
       key,
       scanResult: 'NO_THREATS_FOUND',
     });
@@ -470,12 +467,12 @@ test.describe('letter file validation', () => {
 
     templateStorageHelper.addAdHocTemplateKey(key);
 
-    assertPdfTemplateGuardDutyEvent({
+    await assertPdfTemplateGuardDutyEvent({
       key,
       scanResult: 'NO_THREATS_FOUND',
     });
 
-    assertTestDataGuardDutyEvent({
+    await assertTestDataGuardDutyEvent({
       key,
       scanResult: 'NO_THREATS_FOUND',
     });
@@ -529,7 +526,7 @@ test.describe('letter file validation', () => {
 
     templateStorageHelper.addAdHocTemplateKey(key);
 
-    assertPdfTemplateGuardDutyEvent({
+    await assertPdfTemplateGuardDutyEvent({
       key,
       scanResult: 'NO_THREATS_FOUND',
     });
@@ -579,7 +576,7 @@ test.describe('letter file validation', () => {
 
     templateStorageHelper.addAdHocTemplateKey(key);
 
-    assertPdfTemplateGuardDutyEvent({
+    await assertPdfTemplateGuardDutyEvent({
       key,
       scanResult: 'NO_THREATS_FOUND',
     });
@@ -633,12 +630,12 @@ test.describe('letter file validation', () => {
 
     templateStorageHelper.addAdHocTemplateKey(key);
 
-    assertPdfTemplateGuardDutyEvent({
+    await assertPdfTemplateGuardDutyEvent({
       key,
       scanResult: 'NO_THREATS_FOUND',
     });
 
-    assertTestDataGuardDutyEvent({
+    await assertTestDataGuardDutyEvent({
       key,
       scanResult: 'NO_THREATS_FOUND',
     });
@@ -659,6 +656,7 @@ test.describe('letter file validation', () => {
     await expect(page.getByTestId('preview-letter-template-cta')).toBeHidden();
   });
 
+  // Note: Skipping due to expect(template.templateStatus).toBe('VALIDATION_FAILED'); failing due to status being "PENDING_VALIDATION"
   test('validation fails if pdf has non-sensible parameters', async ({
     page,
   }) => {
@@ -695,12 +693,12 @@ test.describe('letter file validation', () => {
 
     templateStorageHelper.addAdHocTemplateKey(key);
 
-    assertPdfTemplateGuardDutyEvent({
+    await assertPdfTemplateGuardDutyEvent({
       key,
       scanResult: 'NO_THREATS_FOUND',
     });
 
-    assertTestDataGuardDutyEvent({
+    await assertTestDataGuardDutyEvent({
       key,
       scanResult: 'NO_THREATS_FOUND',
     });
diff --git a/tests/test-team/template-mgmt-e2e-tests/template-mgmt-letter-guardduty.steps.ts b/tests/test-team/template-mgmt-e2e-tests/template-mgmt-letter-guardduty.steps.ts

Original file line number	Diff line number	Diff line change
`@@ -14,10 +14,6 @@ output "download_bucket_name" {`
`14`	`14`	`value = module.backend_api.download_bucket_name`
`15`	`15`	`}`
`16`	`16`
`17`		`-output "guardduty_quarantine_arn" {`
`18`		`- value = module.backend_api.guardduty_quarantine_arn`
`19`		`-}`
`20`		`-`
`21`	`17`	`output "internal_bucket_name" {`
`22`	`18`	`value = module.backend_api.internal_bucket_name`
`23`	`19`	`}`
Original file line number	Diff line number	Diff line change
`@@ -61,4 +61,8 @@ locals {`
`61`	`61`	`][0], "")`
`62`	`62`
`63`	`63`	`sftp_environment = "${var.group}-${var.environment}-${var.component}"`
	`64`	`+`
	`65`	`+ guardduty_source = var.enable_guardduty ? "aws.guardduty" : "test.guardduty"`
	`66`	`+`
	`67`	`+ guardduty_resource = var.enable_guardduty ? aws_guardduty_malware_protection_plan.quarantine[0].arn : "test:guardduty"`
`64`	`68`	`}`
Original file line number	Diff line number	Diff line change
`@@ -10,10 +10,6 @@ output "download_bucket_regional_domain_name" {`
`10`	`10`	`value = module.s3bucket_download.bucket_regional_domain_name`
`11`	`11`	`}`
`12`	`12`
`13`		`-output "guardduty_quarantine_arn" {`
`14`		`- value = aws_guardduty_malware_protection_plan.quarantine.arn`
`15`		`-}`
`16`		`-`
`17`	`13`	`output "internal_bucket_name" {`
`18`	`14`	`value = module.s3bucket_internal.id`
`19`	`15`	`}`