Skip to content

Commit 5ac0e0b

Browse files
harrim91harrim91
committed
CCM-9874: us-east-1 resources for edge lambda
1 parent 8dd02f6 commit 5ac0e0b

File tree

7 files changed

+196
-5
lines changed

7 files changed

+196
-5
lines changed

‎infrastructure/terraform/components/acct/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,7 @@
3737
| <a name="module_obs_datasource"></a> [obs\_datasource](#module\_obs\_datasource) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/obs-datasource | v2.0.3 |
3838
| <a name="module_s3bucket_access_logs"></a> [s3bucket\_access\_logs](#module\_s3bucket\_access\_logs) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.9 |
3939
| <a name="module_s3bucket_artefacts"></a> [s3bucket\_artefacts](#module\_s3bucket\_artefacts) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v2.0.2 |
40+
| <a name="module_s3bucket_artefacts_us_east_1"></a> [s3bucket\_artefacts\_us\_east\_1](#module\_s3bucket\_artefacts\_us\_east\_1) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v2.0.2 |
4041
| <a name="module_s3bucket_backup_reports"></a> [s3bucket\_backup\_reports](#module\_s3bucket\_backup\_reports) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.8 |
4142
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.19.0 |
4243
## Outputs

‎infrastructure/terraform/components/acct/module_s3bucket_artefacts_us_east_1.tf‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
module "s3bucket_artefacts_us_east_1" {
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket?ref=v2.0.2"
3+
4+
providers = {
5+
aws = aws.us-east-1
6+
}
7+
8+
name = "artefacts"
9+
10+
aws_account_id = var.aws_account_id
11+
region = "us-east-1"
12+
project = var.project
13+
environment = var.environment
14+
component = var.component
15+
16+
acl = "private"
17+
force_destroy = false
18+
versioning = true
19+
20+
lifecycle_rules = [
21+
{
22+
prefix = ""
23+
enabled = true
24+
25+
noncurrent_version_transition = [
26+
{
27+
noncurrent_days = "30"
28+
storage_class = "STANDARD_IA"
29+
}
30+
]
31+
32+
noncurrent_version_expiration = {
33+
noncurrent_days = "90"
34+
}
35+
36+
abort_incomplete_multipart_upload = {
37+
days = "1"
38+
}
39+
}
40+
]
41+
42+
policy_documents = [
43+
data.aws_iam_policy_document.s3bucket_artefacts_us_east_1.json
44+
]
45+
46+
bucket_logging_target = {
47+
bucket = module.s3bucket_access_logs.id
48+
}
49+
50+
public_access = {
51+
block_public_acls = true
52+
block_public_policy = true
53+
ignore_public_acls = true
54+
restrict_public_buckets = true
55+
}
56+
57+
58+
default_tags = {
59+
Name = "Artefact bucket"
60+
}
61+
}
62+
63+
data "aws_iam_policy_document" "s3bucket_artefacts_us_east_1" {
64+
statement {
65+
sid = "DontAllowNonSecureConnection"
66+
effect = "Deny"
67+
68+
actions = [
69+
"s3:*",
70+
]
71+
72+
resources = [
73+
module.s3bucket_artefacts_us_east_1.arn,
74+
"${module.s3bucket_artefacts_us_east_1.arn}/*",
75+
]
76+
77+
principals {
78+
type = "AWS"
79+
80+
identifiers = [
81+
"*",
82+
]
83+
}
84+
85+
condition {
86+
test = "Bool"
87+
variable = "aws:SecureTransport"
88+
89+
values = [
90+
"false",
91+
]
92+
}
93+
}
94+
95+
statement {
96+
sid = "AllowManagedAccountsToList"
97+
effect = "Allow"
98+
99+
actions = [
100+
"s3:ListBucket",
101+
]
102+
103+
resources = [
104+
module.s3bucket_artefacts_us_east_1.arn,
105+
]
106+
107+
principals {
108+
type = "AWS"
109+
identifiers = [
110+
"arn:aws:iam::${var.aws_account_id}:root"
111+
]
112+
}
113+
}
114+
115+
statement {
116+
sid = "AllowManagedAccountsToGet"
117+
effect = "Allow"
118+
119+
actions = [
120+
"s3:GetObject",
121+
]
122+
123+
resources = [
124+
"${module.s3bucket_artefacts_us_east_1.arn}/*",
125+
]
126+
127+
principals {
128+
type = "AWS"
129+
identifiers = [
130+
"arn:aws:iam::${var.aws_account_id}:root"
131+
]
132+
}
133+
}
134+
}

‎infrastructure/terraform/components/acct/outputs.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,11 @@ output "s3_buckets" {
1717
bucket = module.s3bucket_artefacts.bucket
1818
id = module.s3bucket_artefacts.id
1919
}
20+
artefacts_us_east_1 = {
21+
arn = module.s3bucket_artefacts_us_east_1.arn
22+
bucket = module.s3bucket_artefacts_us_east_1.bucket
23+
id = module.s3bucket_artefacts_us_east_1.id
24+
}
2025
backup_reports = {
2126
arn = module.s3bucket_backup_reports.arn
2227
bucket = module.s3bucket_backup_reports.bucket

‎infrastructure/terraform/components/app/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@
5454
| <a name="module_download_authorizer_lambda"></a> [download\_authorizer\_lambda](#module\_download\_authorizer\_lambda) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.2 |
5555
| <a name="module_eventpub"></a> [eventpub](#module\_eventpub) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/eventpub | v1.0.13 |
5656
| <a name="module_kms"></a> [kms](#module\_kms) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/kms | v1.0.8 |
57+
| <a name="module_kms_us_east_1"></a> [kms\_us\_east\_1](#module\_kms\_us\_east\_1) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/kms | v1.0.8 |
5758
| <a name="module_nhse_backup_vault"></a> [nhse\_backup\_vault](#module\_nhse\_backup\_vault) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/aws-backup-source | v1.0.8 |
5859
| <a name="module_s3bucket_cf_logs"></a> [s3bucket\_cf\_logs](#module\_s3bucket\_cf\_logs) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v2.0.2 |
5960
## Outputs

‎infrastructure/terraform/components/app/module_download_authorizer_lambda.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,13 +16,13 @@ module "download_authorizer_lambda" {
1616
group = var.group
1717

1818
log_retention_in_days = var.log_retention_in_days
19-
kms_key_arn = module.kms.key_arn
19+
kms_key_arn = module.kms_us_east_1.key_arn
2020

2121
iam_policy_document = {
2222
body = data.aws_iam_policy_document.authorizer.json
2323
}
2424

25-
function_s3_bucket = local.acct.s3_buckets["artefacts"]["id"]
25+
function_s3_bucket = local.acct.s3_buckets["artefacts_us_east_1"]["id"]
2626
function_code_base_path = local.lambdas_source_code_dir
2727
function_code_dir = "download-authorizer/dist"
2828
handler_function_name = "handler"
@@ -45,7 +45,7 @@ data "aws_iam_policy_document" "authorizer" {
4545
]
4646

4747
resources = [
48-
module.kms.key_arn,
48+
module.kms_us_east_1.key_arn,
4949
]
5050
}
5151
}

‎infrastructure/terraform/components/app/module_kms.tf‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -66,11 +66,12 @@ data "aws_iam_policy_document" "kms" {
6666
"*",
6767
]
6868

69-
// TODO, tag conditions don't work
7069
condition {
7170
test = "StringLike"
7271
variable = "aws:SourceArn"
73-
values = ["arn:aws:cloudfront::${var.aws_account_id}:distribution/*"]
72+
values = [
73+
aws_cloudfront_distribution.main.arn
74+
]
7475
}
7576
}
7677
}

‎infrastructure/terraform/components/app/module_kms_us_east_1.tf‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
module "kms_us_east_1" {
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/kms?ref=v1.0.8"
3+
4+
providers = {
5+
aws = aws.us-east-1
6+
}
7+
8+
aws_account_id = var.aws_account_id
9+
component = var.component
10+
environment = var.environment
11+
project = var.project
12+
region = "us-east-1"
13+
14+
name = "main"
15+
deletion_window = var.kms_deletion_window
16+
alias = "alias/${local.csi}"
17+
key_policy_documents = [data.aws_iam_policy_document.kms_us_east_1.json]
18+
iam_delegation = true
19+
}
20+
21+
data "aws_iam_policy_document" "kms_us_east_1" {
22+
# '*' resource scope is permitted in access policies as as the resource is itself
23+
# https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-services.html
24+
25+
statement {
26+
sid = "AllowCloudWatchEncrypt"
27+
effect = "Allow"
28+
29+
principals {
30+
type = "Service"
31+
32+
identifiers = [
33+
"logs.${var.region}.amazonaws.com",
34+
]
35+
}
36+
37+
actions = [
38+
"kms:Encrypt*",
39+
"kms:Decrypt*",
40+
"kms:ReEncrypt*",
41+
"kms:GenerateDataKey*",
42+
"kms:Describe*"
43+
]
44+
45+
resources = [
46+
"*",
47+
]
48+
}
49+
}

0 commit comments

Comments
 (0)