Skip to content

Commit 6d164bc

Browse files
aidenvaines-cgiaidenvaines-cgi
authored
Merge pull request #271 from NHSDigital/CCM-7890_TemplateMgmtBackups
CCM-7890 template mgmt backups
2 parents b25ca3e + 1a26acf commit 6d164bc

19 files changed

+335
-23
lines changed

‎.github/actions/tfsec/action.yaml‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -8,12 +8,13 @@ runs:
88
- name: "TFSec Scan - Components"
99
shell: bash
1010
run: |
11-
for component in $(find infrastructure/terraform/components -mindepth 1 -type d); do
12-
scripts/terraform/tfsec.sh $component
13-
done
14-
- name: "TFSec Scan - Modules"
15-
shell: bash
16-
run: |
17-
for module in $(find infrastructure/terraform/modules -mindepth 1 -type d); do
18-
scripts/terraform/tfsec.sh $module
19-
done
11+
components_exit_code=0
12+
modules_exit_code=0
13+
14+
./scripts/terraform/tfsec.sh ./infrastructure/terraform/components || components_exit_code=$?
15+
./scripts/terraform/tfsec.sh ./infrastructure/terraform/modules || modules_exit_code=$?
16+
17+
if [ $components_exit_code -ne 0 ] || [ $modules_exit_code -ne 0 ]; then
18+
echo "One or more TFSec scans failed."
19+
exit 1
20+
fi

‎.gitignore‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@
1111
!project.code-workspace
1212
.rej
1313
*.porig
14+
.vscode/launch.json
1415

1516
# Please, add your custom content below!
1617

@@ -67,17 +68,17 @@ terraform/*_output.json
6768
group_target-env.tfvars
6869
*tf_outputs.json
6970

71+
# Amplify
7072
amplify_outputs.json
73+
.amplify
74+
sandbox_cognito_auth_token.json
75+
frontend/public/testing
76+
frontend/amplify/functions/send-email/email-template.json
77+
auth.json
7178

7279
# playwright
7380
test-results/
7481
tests/test-team/test-results/
7582
tests/test-team/playwright-report/
7683
tests/test-team/blob-report/
7784
tests/test-team/playwright/.cache/
78-
79-
sandbox_cognito_auth_token.json
80-
81-
frontend/public/testing
82-
.vscode/launch.json
83-
auth.json

‎infrastructure/terraform/components/acct/iam_policy_github_deploy_overload.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ data "aws_iam_policy_document" "github_deploy" {
2121
"cloudformation:*",
2222
"cognito-idp:*",
2323
"ses:*",
24+
"sns:*",
2425
]
2526
resources = ["*"]
2627
}

‎infrastructure/terraform/components/acct/module_s3bucket_backup_reports.tf‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
module "s3bucket_backup_reports" {
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket?ref=v1.0.5"
3+
4+
name = "backup-reports"
5+
6+
aws_account_id = var.aws_account_id
7+
region = var.region
8+
project = var.project
9+
environment = var.environment
10+
component = var.component
11+
12+
acl = "private"
13+
force_destroy = false
14+
versioning = true
15+
16+
lifecycle_rules = [
17+
{
18+
prefix = ""
19+
enabled = true
20+
21+
noncurrent_version_transition = [
22+
{
23+
noncurrent_days = "30"
24+
storage_class = "STANDARD_IA"
25+
}
26+
]
27+
28+
noncurrent_version_expiration = {
29+
noncurrent_days = "90"
30+
}
31+
32+
abort_incomplete_multipart_upload = {
33+
days = "1"
34+
}
35+
}
36+
]
37+
38+
policy_documents = [
39+
data.aws_iam_policy_document.s3bucket_backup_reports.json
40+
]
41+
42+
public_access = {
43+
block_public_acls = true
44+
block_public_policy = true
45+
ignore_public_acls = true
46+
restrict_public_buckets = true
47+
}
48+
49+
50+
default_tags = {
51+
Name = "AWS Backup Reports for enabled environments"
52+
}
53+
}
54+
55+
data "aws_iam_policy_document" "s3bucket_backup_reports" {
56+
statement {
57+
sid = "DontAllowNonSecureConnection"
58+
effect = "Deny"
59+
60+
actions = [
61+
"s3:*",
62+
]
63+
64+
resources = [
65+
module.s3bucket_backup_reports.arn,
66+
"${module.s3bucket_backup_reports.arn}/*",
67+
]
68+
69+
principals {
70+
type = "AWS"
71+
72+
identifiers = [
73+
"*",
74+
]
75+
}
76+
77+
condition {
78+
test = "Bool"
79+
variable = "aws:SecureTransport"
80+
81+
values = [
82+
"false",
83+
]
84+
}
85+
}
86+
87+
statement {
88+
sid = "AllowManagedAccountsToList"
89+
effect = "Allow"
90+
91+
actions = [
92+
"s3:ListBucket",
93+
]
94+
95+
resources = [
96+
module.s3bucket_backup_reports.arn,
97+
]
98+
99+
principals {
100+
type = "AWS"
101+
identifiers = [
102+
"arn:aws:iam::${var.aws_account_id}:root"
103+
]
104+
}
105+
}
106+
107+
statement {
108+
sid = "AllowManagedAccountsToGet"
109+
effect = "Allow"
110+
111+
actions = [
112+
"s3:GetObject",
113+
]
114+
115+
resources = [
116+
"${module.s3bucket_backup_reports.arn}/*",
117+
]
118+
119+
principals {
120+
type = "AWS"
121+
identifiers = [
122+
"arn:aws:iam::${var.aws_account_id}:root"
123+
]
124+
}
125+
}
126+
127+
statement {
128+
effect = "Allow"
129+
actions = ["s3:PutObject"]
130+
resources = [
131+
"${module.s3bucket_backup_reports.arn}/*",
132+
]
133+
134+
principals {
135+
type = "AWS"
136+
identifiers = ["arn:aws:iam::${var.aws_account_id}:role/aws-service-role/reports.backup.amazonaws.com/AWSServiceRoleForBackupReports"]
137+
}
138+
condition {
139+
test = "StringEquals"
140+
variable = "s3:x-amz-acl"
141+
values = [
142+
"bucket-owner-full-control"
143+
]
144+
}
145+
}
146+
}

‎infrastructure/terraform/components/acct/outputs.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,3 +9,13 @@ output "dns_zone" {
99
output "github_pat_ssm_param_name" {
1010
value = aws_ssm_parameter.github_pat.name
1111
}
12+
13+
output "s3_buckets" {
14+
value = {
15+
backup_reports = {
16+
arn = module.s3bucket_backup_reports.arn
17+
bucket = module.s3bucket_backup_reports.bucket
18+
id = module.s3bucket_backup_reports.id
19+
}
20+
}
21+
}

‎infrastructure/terraform/components/app/amplify_app.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ resource "aws_amplify_app" "main" {
3535
NEXT_PUBLIC_DISABLE_CONTENT = var.disable_content
3636
AMPLIFY_MONOREPO_APP_ROOT = "frontend"
3737
API_BASE_URL = module.backend_api.api_base_url
38-
USER_POOL_ID = jsondecode(data.aws_ssm_parameter.cognito_config.value)["USER_POOL_ID"]
39-
USER_POOL_CLIENT_ID = jsondecode(data.aws_ssm_parameter.cognito_config.value)["USER_POOL_CLIENT_ID"]
38+
USER_POOL_ID = jsondecode(aws_ssm_parameter.cognito_config.value)["USER_POOL_ID"]
39+
USER_POOL_CLIENT_ID = jsondecode(aws_ssm_parameter.cognito_config.value)["USER_POOL_CLIENT_ID"]
4040
}
4141
}

‎infrastructure/terraform/components/app/module_backend_api.tf‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,5 @@
1+
# TODO: CCM-8418
2+
# tfsec:ignore:aws-iam-no-policy-wildcards
13
module "backend_api" {
24
source = "../../modules/backend-api"
35

@@ -10,5 +12,7 @@ module "backend_api" {
1012
log_retention_in_days = var.log_retention_in_days
1113
email_domain_name = local.root_domain_name
1214

13-
cognito_config = jsondecode(data.aws_ssm_parameter.cognito_config.value)
15+
cognito_config = jsondecode(aws_ssm_parameter.cognito_config.value)
16+
17+
enable_backup = var.destination_vault_arn != null ? true : false
1418
}

‎infrastructure/terraform/components/app/module_kms.tf‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
module "kms" {
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/kms?ref=v1.0.6"
3+
4+
aws_account_id = var.aws_account_id
5+
component = var.component
6+
environment = var.environment
7+
project = var.project
8+
region = var.region
9+
10+
name = "main"
11+
deletion_window = var.kms_deletion_window
12+
alias = "alias/${local.csi}"
13+
key_policy_documents = [data.aws_iam_policy_document.kms.json]
14+
iam_delegation = true
15+
}
16+
17+
data "aws_iam_policy_document" "kms" {
18+
# '*' resource scope is permitted in access policies as as the resource is itself
19+
# https://docs.aws.amazon.com/kms/latest/developerguide/key-policy-services.html
20+
21+
statement {
22+
sid = "AllowCloudWatchEncrypt"
23+
effect = "Allow"
24+
25+
principals {
26+
type = "Service"
27+
28+
identifiers = [
29+
"logs.${var.region}.amazonaws.com",
30+
"sns.amazonaws.com",
31+
]
32+
}
33+
34+
actions = [
35+
"kms:Encrypt*",
36+
"kms:Decrypt*",
37+
"kms:ReEncrypt*",
38+
"kms:GenerateDataKey*",
39+
"kms:Describe*"
40+
]
41+
42+
resources = [
43+
"*",
44+
]
45+
}
46+
}

‎infrastructure/terraform/components/app/module_nhse_backup_vault.tf‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
module "nhse_backup_vault" {
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/aws-backup-source?ref=v1.0.7"
3+
count = var.destination_vault_arn != null ? 1:0
4+
5+
component = var.component
6+
environment = var.environment
7+
project = var.project
8+
backup_copy_vault_account_id = data.aws_arn.destination_vault_arn[0].account
9+
backup_copy_vault_arn = data.aws_arn.destination_vault_arn[0].arn
10+
11+
reports_bucket = local.acct.s3_buckets["backup_reports"]["bucket"]
12+
notifications_target_email_address = var.backup_report_recipient
13+
notification_kms_key = module.kms.key_id
14+
15+
management_ci_role_arn = local.bootstrap.iam_github_deploy_role["arn"]
16+
principal_org_id = var.aws_principal_org_id
17+
18+
restore_testing_plan_scheduled_expression = "cron(0 4 ? * wed *)"
19+
restore_testing_plan_start_window = 1
20+
21+
backup_plan_config_dynamodb = {
22+
"compliance_resource_types": [
23+
"DynamoDB"
24+
],
25+
"rules": [
26+
{
27+
"name": "${local.csi}-backup-rule",
28+
"schedule": var.backup_schedule_cron,
29+
"copy_action": {
30+
"delete_after": var.retention_period
31+
},
32+
"lifecycle": {
33+
"delete_after": var.retention_period
34+
}
35+
}
36+
],
37+
"enable": true,
38+
"selection_tag": "NHSE-Enable-Dynamo-Backup"
39+
}
40+
}
41+
42+
data "aws_arn" "destination_vault_arn" {
43+
count = var.destination_vault_arn != null ? 1:0
44+
45+
arn = var.destination_vault_arn
46+
}

‎infrastructure/terraform/components/app/ssm_parameter_cognito_config.tf‎

Lines changed: 12 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,13 @@
1-
data "aws_ssm_parameter" "cognito_config" {
2-
name = "/${local.csi}/cognito_config"
1+
resource "aws_ssm_parameter" "cognito_config" {
2+
name = "/${local.csi}/cognito_config"
3+
type = "String"
4+
5+
value = jsonencode({
6+
"USER_POOL_ID":"unset",
7+
"USER_POOL_CLIENT_ID":"unset"
8+
})
9+
10+
lifecycle {
11+
ignore_changes = [value]
12+
}
313
}

0 commit comments

Comments
 (0)