Skip to content

Commit 78466c6

Browse files
harrim91harrim91
committed
Merge branch 'main' into feature/CCM-8744_prevent-concurrent-sessions
2 parents d982ffd + 0f0d94c commit 78466c6

23 files changed

+518
-78
lines changed

‎.github/actions/lint-terraform/action.yaml‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -7,8 +7,6 @@ inputs:
77
runs:
88
using: "composite"
99
steps:
10-
- uses: hashicorp/setup-terraform@v3
11-
- uses: asdf-vm/actions/setup@v3
1210
- name: "Check Terraform format"
1311
shell: bash
1412
run: |
@@ -18,5 +16,6 @@ runs:
1816
run: |
1917
stacks=${{ inputs.root-modules }}
2018
for dir in $(find infrastructure/environments -maxdepth 1 -mindepth 1 -type d; echo ${stacks//,/$'\n'}); do
19+
dir=$dir opts='-backend=false' make terraform-init
2120
dir=$dir make terraform-validate
2221
done

‎.github/actions/tfsec/action.yaml‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,6 @@ description: "Scan HCL using TFSec"
33
runs:
44
using: "composite"
55
steps:
6-
- uses: hashicorp/setup-terraform@v3
7-
- uses: asdf-vm/actions/setup@v3
86
- name: "TFSec Scan - Components"
97
shell: bash
108
run: |

‎.github/workflows/scheduled-repository-template-sync.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727

2828
- name: Run syncronisation script
2929
run: |
30-
./scripts/githooks/sync-template-repo.sh
30+
./nhs-notify-repository-template/scripts/githooks/sync-template-repo.sh
3131
rm -Rf ./nhs-notify-repository-template
3232
3333
- name: Create Pull Request

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@
55
*sbom*report*.json
66
*vulnerabilities*report*.json
77
*report*json.zip
8+
version.json
89
.version
910

1011
*.code-workspace

‎.gitleaksignore‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,3 +3,5 @@
33
cd9c0efec38c5d63053dd865e5d4e207c0760d91:docs/guides/Perform_static_analysis.md:generic-api-key:37
44
87312c6a627a7b0420956d49187fd15b130df170:src/__tests__/components/molecules/LoginStatus.test.tsx:jwt:23
55
37ca9f5670f4cd7d91869845ca27defbe6156bb9:src/__tests__/components/molecules/LoginStatus.test.tsx:jwt:23
6+
b19d88d1d92b0530f065feefcf25d8cdd82a876a:tests/test-team/auth/user.json:jwt:15
7+
b19d88d1d92b0530f065feefcf25d8cdd82a876a:tests/test-team/auth/user.json:jwt:25

‎.tool-versions‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
act 0.2.64
2-
gitleaks 8.18.4
2+
gitleaks 8.24.0
33
pre-commit 3.6.0
44
terraform 1.9.2
55
terraform-docs 0.19.0
@@ -13,7 +13,7 @@ nodejs 20.18.2
1313
# TODO: Move this section - consider using a different file for the repository template dependencies.
1414
# docker/ghcr.io/anchore/grype v0.69.1@sha256:d41fcb371d0af59f311e72123dff46900ebd6d0482391b5a830853ee4f9d1a76 # SEE: https://github.com/anchore/grype/pkgs/container/grype
1515
# docker/ghcr.io/anchore/syft v0.92.0@sha256:63c60f0a21efb13e80aa1359ab243e49213b6cc2d7e0f8179da38e6913b997e0 # SEE: https://github.com/anchore/syft/pkgs/container/syft
16-
# docker/ghcr.io/gitleaks/gitleaks v8.18.0@sha256:fd2b5cab12b563d2cc538b14631764a1c25577780e3b7dba71657d58da45d9d9 # SEE: https://github.com/gitleaks/gitleaks/pkgs/container/gitleaks
16+
# docker/ghcr.io/gitleaks/gitleaks v8.24.0@sha256:2bcceac45179b3a91bff11a824d0fb952585b429e54fc928728b1d4d5c3e5176 # SEE: https://github.com/gitleaks/gitleaks/pkgs/container/gitleaks
1717
# docker/ghcr.io/igorshubovych/markdownlint-cli v0.37.0@sha256:fb3e79946fce78e1cde84d6798c6c2a55f2de11fc16606a40d49411e281d950d # SEE: https://github.com/igorshubovych/markdownlint-cli/pkgs/container/markdownlint-cli
1818
# docker/ghcr.io/make-ops-tools/gocloc latest@sha256:6888e62e9ae693c4ebcfed9f1d86c70fd083868acb8815fe44b561b9a73b5032 # SEE: https://github.com/make-ops-tools/gocloc/pkgs/container/gocloc
1919
# docker/ghcr.io/nhs-england-tools/github-runner-image 20230909-321fd1e-rt@sha256:ce4fd6035dc450a50d3cbafb4986d60e77cb49a71ab60a053bb1b9518139a646 # SEE: https://github.com/nhs-england-tools/github-runner-image/pkgs/container/github-runner-image

‎infrastructure/terraform/bin/terraform.sh‎

Lines changed: 29 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88
##
99
# Set Script Version
1010
##
11-
readonly script_ver="1.8.0";
11+
readonly script_ver="1.8.1";
1212

1313
##
1414
# Standardised failure function
@@ -399,13 +399,16 @@ fi;
399399
pushd "${component_path}";
400400
readonly component_name=$(basename ${component_path});
401401

402-
# Check for presence of tfenv (https://github.com/kamatama41/tfenv)
403-
# and a .terraform-version file. If both present, ensure required
404-
# version of terraform for this component is installed automagically.
405-
tfenv_bin="$(which tfenv 2>/dev/null)";
406-
if [[ -n "${tfenv_bin}" && -x "${tfenv_bin}" && -f .terraform-version ]]; then
407-
${tfenv_bin} install;
408-
fi;
402+
# install terraform
403+
# verify terraform version matches .tool-versions
404+
echo ${PWD}
405+
tool_version=$(grep "terraform " .tool-versions | cut -d ' ' -f 2)
406+
asdf plugin-add terraform && asdf install terraform "${tool_version}"
407+
current_version=$(terraform --version | head -n 1 | cut -d 'v' -f 2)
408+
409+
if [ -z "${current_version}" ] || [ "${current_version}" != "${tool_version}" ]; then
410+
error_and_die "Terraform version mismatch. Expected: ${tool_version}, Actual: ${current_version}"
411+
fi
409412

410413
# Regardless of bootstrapping or not, we'll be using this string.
411414
# If bootstrapping, we will fill it with variables,
@@ -536,26 +539,24 @@ fi;
536539
[ -f "${dynamic_file_path}" ] && tf_var_file_paths+=("${dynamic_file_path}");
537540

538541
# Warn on duplication
539-
if [ ${#tf_var_file_paths[@]} -gt 0 ]; then
540-
duplicate_variables="$(cat "${tf_var_file_paths[@]}" | sed -n -e 's/\(^[a-zA-Z0-9_\-]\+\)\s*=.*$/\1/p' | sort | uniq -d)";
541-
[ -n "${duplicate_variables}" ] \
542-
&& echo -e "
543-
###################################################################
544-
# WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING #
545-
###################################################################
546-
The following input variables appear to be duplicated:
547-
548-
${duplicate_variables}
549-
550-
This could lead to unexpected behaviour. Overriding of variables
551-
has previously been unpredictable and is not currently supported,
552-
but it may work.
553-
554-
Recent changes to terraform might give you useful overriding and
555-
map-merging functionality, please use with caution and report back
556-
on your successes & failures.
557-
###################################################################";
558-
fi
542+
duplicate_variables="$(cat "${tf_var_file_paths[@]}" | sed -n -e 's/\(^[a-zA-Z0-9_\-]\+\)\s*=.*$/\1/p' | sort | uniq -d)";
543+
[ -n "${duplicate_variables}" ] \
544+
&& echo -e "
545+
###################################################################
546+
# WARNING WARNING WARNING WARNING WARNING WARNING WARNING WARNING #
547+
###################################################################
548+
The following input variables appear to be duplicated:
549+
550+
${duplicate_variables}
551+
552+
This could lead to unexpected behaviour. Overriding of variables
553+
has previously been unpredictable and is not currently supported,
554+
but it may work.
555+
556+
Recent changes to terraform might give you useful overriding and
557+
map-merging functionality, please use with caution and report back
558+
on your successes & failures.
559+
###################################################################";
559560

560561
# Build up the tfvars arguments for terraform command line
561562
for file_path in "${tf_var_file_paths[@]}"; do

‎infrastructure/terraform/components/acct/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626

2727
| Name | Source | Version |
2828
|------|--------|---------|
29+
| <a name="module_s3bucket_access_logs"></a> [s3bucket\_access\_logs](#module\_s3bucket\_access\_logs) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.8 |
2930
| <a name="module_s3bucket_backup_reports"></a> [s3bucket\_backup\_reports](#module\_s3bucket\_backup\_reports) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.8 |
3031
## Outputs
3132

‎infrastructure/terraform/components/acct/module_s3bucket_access_logs.tf‎

Lines changed: 146 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,146 @@
1+
module "s3bucket_access_logs" {
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket?ref=v1.0.8"
3+
4+
name = "access-logs"
5+
6+
aws_account_id = var.aws_account_id
7+
region = var.region
8+
project = var.project
9+
environment = var.environment
10+
component = var.component
11+
12+
acl = "private"
13+
force_destroy = false
14+
versioning = true
15+
16+
lifecycle_rules = [
17+
{
18+
enabled = true
19+
20+
noncurrent_version_transition = [
21+
{
22+
noncurrent_days = "30"
23+
storage_class = "STANDARD_IA"
24+
}
25+
]
26+
27+
noncurrent_version_expiration = {
28+
noncurrent_days = "90"
29+
}
30+
31+
abort_incomplete_multipart_upload = {
32+
days = "1"
33+
}
34+
}
35+
]
36+
37+
policy_documents = [
38+
data.aws_iam_policy_document.s3bucket_access_logs.json
39+
]
40+
41+
public_access = {
42+
block_public_acls = true
43+
block_public_policy = true
44+
ignore_public_acls = true
45+
restrict_public_buckets = true
46+
}
47+
48+
49+
default_tags = {
50+
Name = "S3 bucket access logs"
51+
}
52+
}
53+
54+
data "aws_iam_policy_document" "s3bucket_access_logs" {
55+
statement {
56+
sid = "DontAllowNonSecureConnection"
57+
effect = "Deny"
58+
59+
actions = [
60+
"s3:*",
61+
]
62+
63+
resources = [
64+
module.s3bucket_access_logs.arn,
65+
"${module.s3bucket_access_logs.arn}/*",
66+
]
67+
68+
principals {
69+
type = "AWS"
70+
71+
identifiers = [
72+
"*",
73+
]
74+
}
75+
76+
condition {
77+
test = "Bool"
78+
variable = "aws:SecureTransport"
79+
80+
values = [
81+
"false",
82+
]
83+
}
84+
}
85+
86+
statement {
87+
sid = "AllowManagedAccountsToList"
88+
effect = "Allow"
89+
90+
actions = [
91+
"s3:ListBucket",
92+
]
93+
94+
resources = [
95+
module.s3bucket_lambda_artefacts.arn,
96+
]
97+
98+
principals {
99+
type = "AWS"
100+
identifiers = [
101+
"arn:aws:iam::${var.aws_account_id}:root"
102+
]
103+
}
104+
}
105+
106+
statement {
107+
sid = "AllowManagedAccountsToGet"
108+
effect = "Allow"
109+
110+
actions = [
111+
"s3:GetObject",
112+
]
113+
114+
resources = [
115+
"${module.s3bucket_lambda_artefacts.arn}/*",
116+
]
117+
118+
principals {
119+
type = "AWS"
120+
identifiers = [
121+
"arn:aws:iam::${var.aws_account_id}:root"
122+
]
123+
}
124+
}
125+
126+
statement {
127+
sid = "AllowS3AccessLogging"
128+
effect = "Allow"
129+
130+
actions = [
131+
"s3:PutObject",
132+
]
133+
134+
resources = [
135+
"${module.s3bucket_access_logs.arn}/*",
136+
]
137+
138+
principals {
139+
type = "Service"
140+
141+
identifiers = [
142+
"logging.s3.amazonaws.com",
143+
]
144+
}
145+
}
146+
}

‎infrastructure/terraform/components/acct/module_s3bucket_backup_reports.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@ module "s3bucket_backup_reports" {
3838
data.aws_iam_policy_document.s3bucket_backup_reports.json
3939
]
4040

41+
bucket_logging_target = {
42+
bucket = module.s3bucket_access_logs.id
43+
}
44+
4145
public_access = {
4246
block_public_acls = true
4347
block_public_policy = true

0 commit comments

Comments
 (0)