Skip to content

Commit 8f2e425

Browse files
harrim91harrim91
committed
Merge branch 'main' into feature/CCM-8572_template-security-scan
2 parents e502064 + 0bbc25a commit 8f2e425

File tree

10 files changed

+112
-10
lines changed

10 files changed

+112
-10
lines changed

‎frontend/next.config.js‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -22,12 +22,6 @@ const nextConfig = (phase) => {
2222
quietDeps: true,
2323
},
2424

25-
experimental: {
26-
serverActions: {
27-
allowedOrigins: [domain, domain.replace('templates', 'web-gateway')],
28-
},
29-
},
30-
3125
async redirects() {
3226
return [
3327
{

‎infrastructure/terraform/components/acct/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
| <a name="input_initial_cli_secrets_provision_override"></a> [initial\_cli\_secrets\_provision\_override](#input\_initial\_cli\_secrets\_provision\_override) | A map of default value to intialise SSM secret values with. Only useful for initial setup of the account due to lifecycle rules. | `map(string)` | `{}` | no |
2121
| <a name="input_kms_deletion_window"></a> [kms\_deletion\_window](#input\_kms\_deletion\_window) | When a kms key is deleted, how long should it wait in the pending deletion state? | `string` | `"30"` | no |
2222
| <a name="input_log_retention_in_days"></a> [log\_retention\_in\_days](#input\_log\_retention\_in\_days) | The retention period in days for the Cloudwatch Logs events to be retained, default of 0 is indefinite | `number` | `0` | no |
23+
| <a name="input_observability_account_id"></a> [observability\_account\_id](#input\_observability\_account\_id) | The Observability Account ID that needs access | `string` | n/a | yes |
2324
| <a name="input_project"></a> [project](#input\_project) | The name of the tfscaffold project | `string` | n/a | yes |
2425
| <a name="input_region"></a> [region](#input\_region) | The AWS Region | `string` | n/a | yes |
2526
| <a name="input_root_domain_name"></a> [root\_domain\_name](#input\_root\_domain\_name) | The service's root DNS root nameespace, like nonprod.nhsnotify.national.nhs.uk | `string` | `"nonprod.nhsnotify.national.nhs.uk"` | no |

‎infrastructure/terraform/components/acct/cloudwatch_event_rule_aws_backup_errors.tf‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
resource "aws_cloudwatch_event_rule" "aws_backup_errors" {
2+
name = "${local.csi}-aws-backup-errors"
3+
description = "Forwards AWS Backup state changes to Custom Event Bus in Observability Account"
4+
5+
event_pattern = jsonencode({
6+
source = ["aws.backup"],
7+
"detail-type" = ["Backup Job State Change", "Restore Job State Change", "Copy Job State Change"],
8+
detail = {
9+
state = ["FAILED", "ABORTED"]
10+
}
11+
})
12+
}
13+
14+
resource "aws_cloudwatch_event_target" "aws_backup_errors" {
15+
rule = aws_cloudwatch_event_rule.aws_backup_errors.name
16+
arn = local.event_bus_arn
17+
role_arn = aws_iam_role.aws_backup_errors.arn
18+
}
19+
20+
resource "aws_iam_role" "aws_backup_errors" {
21+
name = "${local.csi}-aws-backup-errors"
22+
23+
assume_role_policy = jsonencode({
24+
Version = "2012-10-17",
25+
Statement = [{
26+
Effect = "Allow",
27+
Principal = {
28+
Service = "events.amazonaws.com"
29+
},
30+
Action = "sts:AssumeRole"
31+
}]
32+
})
33+
}
34+
35+
resource "aws_iam_policy" "aws_backup_errors" {
36+
name = "${local.csi}-aws-backup-errors"
37+
38+
policy = jsonencode({
39+
Version = "2012-10-17",
40+
Statement = [{
41+
Effect = "Allow",
42+
Action = "events:PutEvents",
43+
Resource = local.event_bus_arn
44+
}]
45+
})
46+
}
47+
48+
resource "aws_iam_role_policy_attachment" "aws_backup_errors" {
49+
role = aws_iam_role.aws_backup_errors.name
50+
policy_arn = aws_iam_policy.aws_backup_errors.arn
51+
}

‎infrastructure/terraform/components/acct/cloudwatch_event_rule_cloudwatch_alarms.tf‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
resource "aws_cloudwatch_event_rule" "cloudwatch_alarms" {
2+
name = "${local.csi}-cloudwatch-alarm-fowarding"
3+
description = "Forwards CloudWatch Alarm state changes to Custom Event Bus in Observability Account"
4+
5+
event_pattern = jsonencode({
6+
"source" = ["aws.cloudwatch"],
7+
"detail-type" = ["CloudWatch Alarm State Change"]
8+
})
9+
}
10+
11+
resource "aws_cloudwatch_event_target" "cloudwatch_alarms" {
12+
rule = aws_cloudwatch_event_rule.cloudwatch_alarms.name
13+
arn = local.event_bus_arn
14+
role_arn = aws_iam_role.cloudwatch_alarms.arn
15+
}
16+
17+
resource "aws_iam_role" "cloudwatch_alarms" {
18+
name = "${local.csi}-cloudwatch-alarms"
19+
20+
assume_role_policy = jsonencode({
21+
Version = "2012-10-17",
22+
Statement = [{
23+
Effect = "Allow",
24+
Principal = {
25+
Service = "events.amazonaws.com"
26+
},
27+
Action = "sts:AssumeRole"
28+
}]
29+
})
30+
}
31+
32+
resource "aws_iam_policy" "cloudwatch_alarms" {
33+
name = "${local.csi}-cloudwatch-alarms"
34+
35+
policy = jsonencode({
36+
Version = "2012-10-17",
37+
Statement = [{
38+
Effect = "Allow",
39+
Action = "events:PutEvents",
40+
Resource = local.event_bus_arn
41+
}]
42+
})
43+
}
44+
45+
resource "aws_iam_role_policy_attachment" "cloudwatch_alarms" {
46+
role = aws_iam_role.cloudwatch_alarms.name
47+
policy_arn = aws_iam_policy.cloudwatch_alarms.arn
48+
}

‎infrastructure/terraform/components/acct/locals.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
locals {
2+
event_bus_arn = "arn:aws:events:eu-west-2:${var.observability_account_id}:event-bus/nhs-notify-main-acct-alerts-bus"
3+
}

‎infrastructure/terraform/components/acct/variables.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,11 @@ variable "initial_cli_secrets_provision_override" {
7171
# ... -a apply -- -var initial_cli_secrets_provision_override={\"github_pat\":\"l0ngstr1ng"}
7272
}
7373

74+
variable "observability_account_id" {
75+
type = string
76+
description = "The Observability Account ID that needs access"
77+
}
78+
7479
variable "kms_deletion_window" {
7580
type = string
7681
description = "When a kms key is deleted, how long should it wait in the pending deletion state?"

‎infrastructure/terraform/components/app/amplify_app.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@ resource "aws_amplify_app" "main" {
3535
NEXT_PUBLIC_ENABLE_LETTERS = var.enable_letters
3636
NEXT_PUBLIC_PROMPT_SECONDS_BEFORE_LOGOUT = 120
3737
NEXT_PUBLIC_TIME_TILL_LOGOUT_SECONDS = 900
38-
NOTIFY_DOMAIN_NAME = local.root_domain_name
3938
NOTIFY_ENVIRONMENT = var.environment
4039
NOTIFY_GROUP = var.group
4140
USER_POOL_CLIENT_ID = jsondecode(aws_ssm_parameter.cognito_config.value)["USER_POOL_CLIENT_ID"]

‎infrastructure/terraform/components/app/iam_role_grafana_access.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
resource "aws_iam_role" "grafana_access" {
2-
name = replace("${local.csi}-grafana-cross-access-role", "-${var.component}", "")
2+
name = replace("${local.csi}-obs-cross-access-role", "-${var.component}", "")
33
assume_role_policy = data.aws_iam_policy_document.observability_grafana_role_assume_role_policy.json
44
}
55

@@ -18,7 +18,7 @@ data "aws_iam_policy_document" "observability_grafana_role_assume_role_policy" {
1818
variable = "aws:PrincipalArn"
1919

2020
values = [
21-
"arn:aws:iam::${var.observability_account_id}:role/*grafana-workspace-role"
21+
"arn:aws:iam::${var.observability_account_id}:role/*obs-workspace-role"
2222
]
2323
}
2424
}

‎infrastructure/terraform/components/app/module_backend_api.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,5 +17,4 @@ module "backend_api" {
1717
enable_backup = var.destination_vault_arn != null ? true : false
1818

1919
enable_letters = var.enable_letters
20-
2120
}

‎infrastructure/terraform/components/sandbox/module_backend_api.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,11 @@ module "backend_api" {
66
aws_account_id = var.aws_account_id
77
region = var.region
88
group = var.group
9+
component = var.component
910
csi = local.csi
1011
log_retention_in_days = var.log_retention_in_days
1112

13+
1214
cognito_config = {
1315
USER_POOL_ID = aws_cognito_user_pool.sandbox.id
1416
USER_POOL_CLIENT_ID = aws_cognito_user_pool_client.sandbox.id

0 commit comments

Comments
 (0)