Skip to content

Commit 64ae381

Browse files
chris-elliott-nhsdchris-elliott-nhsd
committed
CCM-9247: Add proofs to database entry
1 parent f309183 commit 64ae381

File tree

37 files changed

+11029
-10490
lines changed

37 files changed

+11029
-10490
lines changed

‎infrastructure/terraform/modules/backend-api/README.md‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,8 @@ No requirements.
4141
| <a name="module_lambda_copy_scanned_object_to_internal"></a> [lambda\_copy\_scanned\_object\_to\_internal](#module\_lambda\_copy\_scanned\_object\_to\_internal) | ../lambda-function | n/a |
4242
| <a name="module_lambda_delete_failed_scanned_object"></a> [lambda\_delete\_failed\_scanned\_object](#module\_lambda\_delete\_failed\_scanned\_object) | ../lambda-function | n/a |
4343
| <a name="module_lambda_send_letter_proof"></a> [lambda\_send\_letter\_proof](#module\_lambda\_send\_letter\_proof) | ../lambda-function | n/a |
44-
| <a name="module_lambda_set_file_virus_scan_status"></a> [lambda\_set\_file\_virus\_scan\_status](#module\_lambda\_set\_file\_virus\_scan\_status) | ../lambda-function | n/a |
44+
| <a name="module_lambda_set_file_virus_scan_status_proofs"></a> [lambda\_set\_file\_virus\_scan\_status\_proofs](#module\_lambda\_set\_file\_virus\_scan\_status\_proofs) | ../lambda-function | n/a |
45+
| <a name="module_lambda_set_file_virus_scan_status_uploads"></a> [lambda\_set\_file\_virus\_scan\_status\_uploads](#module\_lambda\_set\_file\_virus\_scan\_status\_uploads) | ../lambda-function | n/a |
4546
| <a name="module_lambda_sftp_poll"></a> [lambda\_sftp\_poll](#module\_lambda\_sftp\_poll) | ../lambda-function | n/a |
4647
| <a name="module_lambda_validate_letter_template_files"></a> [lambda\_validate\_letter\_template\_files](#module\_lambda\_validate\_letter\_template\_files) | ../lambda-function | n/a |
4748
| <a name="module_list_template_lambda"></a> [list\_template\_lambda](#module\_list\_template\_lambda) | ../lambda-function | n/a |
@@ -51,7 +52,8 @@ No requirements.
5152
| <a name="module_sqs_validate_letter_template_files"></a> [sqs\_validate\_letter\_template\_files](#module\_sqs\_validate\_letter\_template\_files) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v2.0.1 |
5253
| <a name="module_sqs_virus_scan_failed_delete_object_dlq"></a> [sqs\_virus\_scan\_failed\_delete\_object\_dlq](#module\_sqs\_virus\_scan\_failed\_delete\_object\_dlq) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v2.0.1 |
5354
| <a name="module_sqs_virus_scan_passed_copy_object_dlq"></a> [sqs\_virus\_scan\_passed\_copy\_object\_dlq](#module\_sqs\_virus\_scan\_passed\_copy\_object\_dlq) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v2.0.1 |
54-
| <a name="module_sqs_virus_scan_set_file_status_dlq"></a> [sqs\_virus\_scan\_set\_file\_status\_dlq](#module\_sqs\_virus\_scan\_set\_file\_status\_dlq) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v2.0.1 |
55+
| <a name="module_sqs_virus_scan_set_file_status_proofs_dlq"></a> [sqs\_virus\_scan\_set\_file\_status\_proofs\_dlq](#module\_sqs\_virus\_scan\_set\_file\_status\_proofs\_dlq) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v2.0.1 |
56+
| <a name="module_sqs_virus_scan_set_file_status_uploads_dlq"></a> [sqs\_virus\_scan\_set\_file\_status\_uploads\_dlq](#module\_sqs\_virus\_scan\_set\_file\_status\_uploads\_dlq) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v2.0.1 |
5557
| <a name="module_submit_template_lambda"></a> [submit\_template\_lambda](#module\_submit\_template\_lambda) | ../lambda-function | n/a |
5658
| <a name="module_update_template_lambda"></a> [update\_template\_lambda](#module\_update\_template\_lambda) | ../lambda-function | n/a |
5759
## Outputs

‎infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_failed_proofs.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_failed_proofs" {
2+
name = "${local.csi}-quarantine-scan-failed-proofs"
3+
description = "Matches quarantine 'GuardDuty Malware Protection Object Scan Result' events where the scan result is not NO_THREATS_FOUND"
4+
5+
event_pattern = jsonencode({
6+
source = ["aws.guardduty"]
7+
detail-type = ["GuardDuty Malware Protection Object Scan Result"]
8+
resources = [aws_guardduty_malware_protection_plan.quarantine.arn]
9+
detail = {
10+
s3ObjectDetails = {
11+
bucketName = [module.s3bucket_quarantine.id]
12+
objectKey = [{ prefix = "proofs/" }]
13+
}
14+
scanResultDetails = {
15+
scanResultStatus = [{ anything-but = "NO_THREATS_FOUND" }]
16+
}
17+
}
18+
})
19+
}
20+
21+
resource "aws_cloudwatch_event_target" "quarantine_scan_failed_set_file_status_proofs" {
22+
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_failed_proofs.name
23+
arn = module.lambda_set_file_virus_scan_status_proofs.function_arn
24+
role_arn = aws_iam_role.quarantine_scan_failed_proofs.arn
25+
}
26+
27+
resource "aws_cloudwatch_event_target" "quarantine_scan_failed_delete_object_proofs" {
28+
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_failed_proofs.name
29+
arn = module.lambda_delete_failed_scanned_object.function_arn
30+
role_arn = aws_iam_role.quarantine_scan_failed_proofs.arn
31+
}

infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_failed.tf renamed to infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_failed_uploads.tf

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_failed" {
2-
name = "${local.csi}-quarantine-scan-failed"
1+
resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_failed_uploads" {
2+
name = "${local.csi}-quarantine-scan-failed-uploads"
33
description = "Matches quarantine 'GuardDuty Malware Protection Object Scan Result' events where the scan result is not NO_THREATS_FOUND"
44

55
event_pattern = jsonencode({
@@ -18,14 +18,14 @@ resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_failed" {
1818
})
1919
}
2020

21-
resource "aws_cloudwatch_event_target" "quarantine_scan_failed_set_file_status" {
22-
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_failed.name
23-
arn = module.lambda_set_file_virus_scan_status.function_arn
24-
role_arn = aws_iam_role.quarantine_scan_failed.arn
21+
resource "aws_cloudwatch_event_target" "quarantine_scan_failed_set_file_status_uploads" {
22+
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_failed_uploads.name
23+
arn = module.lambda_set_file_virus_scan_status_uploads.function_arn
24+
role_arn = aws_iam_role.quarantine_scan_failed_uploads.arn
2525
}
2626

27-
resource "aws_cloudwatch_event_target" "quarantine_scan_failed_delete_object" {
28-
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_failed.name
27+
resource "aws_cloudwatch_event_target" "quarantine_scan_failed_delete_object_uploads" {
28+
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_failed_uploads.name
2929
arn = module.lambda_delete_failed_scanned_object.function_arn
30-
role_arn = aws_iam_role.quarantine_scan_failed.arn
30+
role_arn = aws_iam_role.quarantine_scan_failed_uploads.arn
3131
}

‎infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_passed_proofs.tf‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_passed_proofs" {
2+
name = "${local.csi}-quarantine-scan-passed-proofs"
3+
description = "Matches quarantine 'GuardDuty Malware Protection Object Scan Result' events where the scan result is NO_THREATS_FOUND"
4+
5+
event_pattern = jsonencode({
6+
source = ["aws.guardduty"]
7+
detail-type = ["GuardDuty Malware Protection Object Scan Result"]
8+
resources = [aws_guardduty_malware_protection_plan.quarantine.arn]
9+
detail = {
10+
s3ObjectDetails = {
11+
bucketName = [module.s3bucket_quarantine.id]
12+
objectKey = [{ prefix = "proofs/" }]
13+
}
14+
scanResultDetails = {
15+
scanResultStatus = ["NO_THREATS_FOUND"]
16+
}
17+
}
18+
})
19+
}
20+
21+
resource "aws_cloudwatch_event_target" "quarantine_scan_passed_set_file_status_proofs" {
22+
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed_proofs.name
23+
arn = module.lambda_set_file_virus_scan_status_proofs.function_arn
24+
role_arn = aws_iam_role.quarantine_scan_passed_proofs.arn
25+
}
26+
27+
resource "aws_cloudwatch_event_target" "quarantine_scan_passed_copy_object_proofs" {
28+
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed_proofs.name
29+
arn = module.lambda_copy_scanned_object_to_internal.function_arn
30+
role_arn = aws_iam_role.quarantine_scan_passed_proofs.arn
31+
}

infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_passed.tf renamed to infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_passed_uploads.tf

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_passed" {
2-
name = "${local.csi}-quarantine-scan-passed"
1+
resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_passed_uploads" {
2+
name = "${local.csi}-quarantine-scan-passed-uploads"
33
description = "Matches quarantine 'GuardDuty Malware Protection Object Scan Result' events where the scan result is NO_THREATS_FOUND"
44

55
event_pattern = jsonencode({
@@ -18,20 +18,20 @@ resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_passed" {
1818
})
1919
}
2020

21-
resource "aws_cloudwatch_event_target" "quarantine_scan_passed_set_file_status" {
22-
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed.name
23-
arn = module.lambda_set_file_virus_scan_status.function_arn
24-
role_arn = aws_iam_role.quarantine_scan_passed.arn
21+
resource "aws_cloudwatch_event_target" "quarantine_scan_passed_set_file_status_uploads" {
22+
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed_uploads.name
23+
arn = module.lambda_set_file_virus_scan_status_uploads.function_arn
24+
role_arn = aws_iam_role.quarantine_scan_passed_uploads.arn
2525
}
2626

27-
resource "aws_cloudwatch_event_target" "quarantine_scan_passed_copy_object" {
28-
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed.name
27+
resource "aws_cloudwatch_event_target" "quarantine_scan_passed_copy_object_uploads" {
28+
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed_uploads.name
2929
arn = module.lambda_copy_scanned_object_to_internal.function_arn
30-
role_arn = aws_iam_role.quarantine_scan_passed.arn
30+
role_arn = aws_iam_role.quarantine_scan_passed_uploads.arn
3131
}
3232

3333
resource "aws_cloudwatch_event_target" "quarantine_scan_passed_validate_files" {
34-
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed.name
34+
rule = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed_uploads.name
3535
arn = module.sqs_validate_letter_template_files.sqs_queue_arn
36-
role_arn = aws_iam_role.quarantine_scan_passed.arn
36+
role_arn = aws_iam_role.quarantine_scan_passed_uploads.arn
3737
}

‎infrastructure/terraform/modules/backend-api/dynamodb_table_templates.tf‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,4 +38,11 @@ resource "aws_dynamodb_table" "templates" {
3838
name, # To support backup and restore which will result in a new name otherwise
3939
]
4040
}
41+
42+
global_secondary_index {
43+
name = "QueryById"
44+
hash_key = "id"
45+
projection_type = "INCLUDE"
46+
non_key_attributes = ["owner"]
47+
}
4148
}

‎infrastructure/terraform/modules/backend-api/iam_role_quarantine_scan_failed.tf‎

Lines changed: 0 additions & 25 deletions
This file was deleted.

‎infrastructure/terraform/modules/backend-api/iam_role_quarantine_scan_failed_proofs.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
resource "aws_iam_role" "quarantine_scan_failed_proofs" {
2+
name = "${local.csi}-quarantine-scan-failed-proofs"
3+
description = "IAM Role for GuardDuty failure CloudWatch events to trigger follow up actions"
4+
assume_role_policy = data.aws_iam_policy_document.events_assume_role.json
5+
}
6+
7+
resource "aws_iam_role_policy" "quarantine_scan_failed_proofs" {
8+
name = "${local.csi}-quarantine-scan-failed-proofs"
9+
role = aws_iam_role.quarantine_scan_failed_proofs.id
10+
policy = data.aws_iam_policy_document.quarantine_scan_failed_proofs.json
11+
}
12+
13+
data "aws_iam_policy_document" "quarantine_scan_failed_proofs" {
14+
version = "2012-10-17"
15+
16+
statement {
17+
sid = "AllowLambdaInvoke"
18+
effect = "Allow"
19+
actions = ["lambda:InvokeFunction"]
20+
resources = [
21+
module.lambda_set_file_virus_scan_status_proofs.function_arn,
22+
module.lambda_delete_failed_scanned_object.function_arn
23+
]
24+
}
25+
}

‎infrastructure/terraform/modules/backend-api/iam_role_quarantine_scan_failed_uploads.tf‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
resource "aws_iam_role" "quarantine_scan_failed_uploads" {
2+
name = "${local.csi}-quarantine-scan-failed-uploads"
3+
description = "IAM Role for GuardDuty failure CloudWatch events to trigger follow up actions"
4+
assume_role_policy = data.aws_iam_policy_document.events_assume_role.json
5+
}
6+
7+
resource "aws_iam_role_policy" "quarantine_scan_failed_uploads" {
8+
name = "${local.csi}-quarantine-scan-failed-uploads"
9+
role = aws_iam_role.quarantine_scan_failed_uploads.id
10+
policy = data.aws_iam_policy_document.quarantine_scan_failed_uploads.json
11+
}
12+
13+
data "aws_iam_policy_document" "quarantine_scan_failed_uploads" {
14+
version = "2012-10-17"
15+
16+
statement {
17+
sid = "AllowLambdaInvoke"
18+
effect = "Allow"
19+
actions = ["lambda:InvokeFunction"]
20+
resources = [
21+
module.lambda_set_file_virus_scan_status_uploads.function_arn,
22+
module.lambda_delete_failed_scanned_object.function_arn
23+
]
24+
}
25+
}

‎infrastructure/terraform/modules/backend-api/iam_role_quarantine_scan_passed_proofs.tf‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
resource "aws_iam_role" "quarantine_scan_passed_proofs" {
2+
name = "${local.csi}-quarantine-scan-passed-proofs"
3+
assume_role_policy = data.aws_iam_policy_document.events_assume_role.json
4+
}
5+
6+
resource "aws_iam_role_policy" "quarantine_scan_passed_proofs" {
7+
name = "${local.csi}-quarantine-scan-passed-proofs"
8+
role = aws_iam_role.quarantine_scan_passed_proofs.id
9+
policy = data.aws_iam_policy_document.quarantine_scan_passed_proofs.json
10+
}
11+
12+
data "aws_iam_policy_document" "quarantine_scan_passed_proofs" {
13+
version = "2012-10-17"
14+
15+
statement {
16+
sid = "AllowLambdaInvoke"
17+
effect = "Allow"
18+
actions = ["lambda:InvokeFunction"]
19+
resources = [
20+
module.lambda_copy_scanned_object_to_internal.function_arn,
21+
module.lambda_set_file_virus_scan_status_proofs.function_arn,
22+
]
23+
}
24+
}

0 commit comments

Comments
 (0)