CCM-9247: Link proofs to database entries (#448)

Author: chris-elliott-nhsd

infrastructure/terraform/components/sandbox/README.md

@@ -36,6 +36,7 @@ No requirements.
 | <a name="output_send_proof_queue_url"></a> [send\_proof\_queue\_url](#output\_send\_proof\_queue\_url) | n/a |
 | <a name="output_sftp_environment"></a> [sftp\_environment](#output\_sftp\_environment) | n/a |
 | <a name="output_sftp_mock_credential_path"></a> [sftp\_mock\_credential\_path](#output\_sftp\_mock\_credential\_path) | n/a |
+| <a name="output_sftp_poll_lambda_name"></a> [sftp\_poll\_lambda\_name](#output\_sftp\_poll\_lambda\_name) | n/a |
 | <a name="output_templates_table_name"></a> [templates\_table\_name](#output\_templates\_table\_name) | n/a |
 <!-- vale on -->
 <!-- markdownlint-enable -->

infrastructure/terraform/components/sandbox/outputs.tf

@@ -33,3 +33,7 @@ output "internal_bucket_name" {
 output "quarantine_bucket_name" {
   value = module.backend_api.quarantine_bucket_name
 }
+
+output "sftp_poll_lambda_name" {
+  value = module.backend_api.sftp_poll_lambda_name
+}

infrastructure/terraform/modules/backend-api/README.md

@@ -41,19 +41,21 @@ No requirements.
 | <a name="module_get_template_lambda"></a> [get\_template\_lambda](#module\_get\_template\_lambda) | ../lambda-function | n/a |
 | <a name="module_lambda_copy_scanned_object_to_internal"></a> [lambda\_copy\_scanned\_object\_to\_internal](#module\_lambda\_copy\_scanned\_object\_to\_internal) | ../lambda-function | n/a |
 | <a name="module_lambda_delete_failed_scanned_object"></a> [lambda\_delete\_failed\_scanned\_object](#module\_lambda\_delete\_failed\_scanned\_object) | ../lambda-function | n/a |
+| <a name="module_lambda_process_proof"></a> [lambda\_process\_proof](#module\_lambda\_process\_proof) | ../lambda-function | n/a |
 | <a name="module_lambda_send_letter_proof"></a> [lambda\_send\_letter\_proof](#module\_lambda\_send\_letter\_proof) | ../lambda-function | n/a |
-| <a name="module_lambda_set_file_virus_scan_status"></a> [lambda\_set\_file\_virus\_scan\_status](#module\_lambda\_set\_file\_virus\_scan\_status) | ../lambda-function | n/a |
+| <a name="module_lambda_set_file_virus_scan_status_for_upload"></a> [lambda\_set\_file\_virus\_scan\_status\_for\_upload](#module\_lambda\_set\_file\_virus\_scan\_status\_for\_upload) | ../lambda-function | n/a |
 | <a name="module_lambda_sftp_poll"></a> [lambda\_sftp\_poll](#module\_lambda\_sftp\_poll) | ../lambda-function | n/a |
 | <a name="module_lambda_validate_letter_template_files"></a> [lambda\_validate\_letter\_template\_files](#module\_lambda\_validate\_letter\_template\_files) | ../lambda-function | n/a |
 | <a name="module_list_template_lambda"></a> [list\_template\_lambda](#module\_list\_template\_lambda) | ../lambda-function | n/a |
 | <a name="module_request_proof_lambda"></a> [request\_proof\_lambda](#module\_request\_proof\_lambda) | ../lambda-function | n/a |
 | <a name="module_s3bucket_internal"></a> [s3bucket\_internal](#module\_s3bucket\_internal) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.8 |
 | <a name="module_s3bucket_quarantine"></a> [s3bucket\_quarantine](#module\_s3bucket\_quarantine) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.8 |
+| <a name="module_sqs_process_proof_dlq"></a> [sqs\_process\_proof\_dlq](#module\_sqs\_process\_proof\_dlq) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v2.0.1 |
 | <a name="module_sqs_sftp_upload"></a> [sqs\_sftp\_upload](#module\_sqs\_sftp\_upload) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v2.0.1 |
 | <a name="module_sqs_validate_letter_template_files"></a> [sqs\_validate\_letter\_template\_files](#module\_sqs\_validate\_letter\_template\_files) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v2.0.1 |
 | <a name="module_sqs_virus_scan_failed_delete_object_dlq"></a> [sqs\_virus\_scan\_failed\_delete\_object\_dlq](#module\_sqs\_virus\_scan\_failed\_delete\_object\_dlq) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v2.0.1 |
 | <a name="module_sqs_virus_scan_passed_copy_object_dlq"></a> [sqs\_virus\_scan\_passed\_copy\_object\_dlq](#module\_sqs\_virus\_scan\_passed\_copy\_object\_dlq) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v2.0.1 |
-| <a name="module_sqs_virus_scan_set_file_status_dlq"></a> [sqs\_virus\_scan\_set\_file\_status\_dlq](#module\_sqs\_virus\_scan\_set\_file\_status\_dlq) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v2.0.1 |
+| <a name="module_sqs_virus_scan_set_file_status_for_upload_dlq"></a> [sqs\_virus\_scan\_set\_file\_status\_for\_upload\_dlq](#module\_sqs\_virus\_scan\_set\_file\_status\_for\_upload\_dlq) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v2.0.1 |
 | <a name="module_submit_template_lambda"></a> [submit\_template\_lambda](#module\_submit\_template\_lambda) | ../lambda-function | n/a |
 | <a name="module_update_template_lambda"></a> [update\_template\_lambda](#module\_update\_template\_lambda) | ../lambda-function | n/a |
 ## Outputs
@@ -66,6 +68,7 @@ No requirements.
 | <a name="output_send_proof_queue_url"></a> [send\_proof\_queue\_url](#output\_send\_proof\_queue\_url) | n/a |
 | <a name="output_sftp_environment"></a> [sftp\_environment](#output\_sftp\_environment) | n/a |
 | <a name="output_sftp_mock_credential_path"></a> [sftp\_mock\_credential\_path](#output\_sftp\_mock\_credential\_path) | n/a |
+| <a name="output_sftp_poll_lambda_name"></a> [sftp\_poll\_lambda\_name](#output\_sftp\_poll\_lambda\_name) | n/a |
 | <a name="output_templates_table_name"></a> [templates\_table\_name](#output\_templates\_table\_name) | n/a |
 <!-- vale on -->
 <!-- markdownlint-enable -->

infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_failed_for_proof.tf

@@ -0,0 +1,31 @@
+resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_failed_for_proof" {
+  name        = "${local.csi}-quarantine-scan-failed-for-proof"
+  description = "Matches quarantine 'GuardDuty Malware Protection Object Scan Result' events where the scan result is not NO_THREATS_FOUND"
+
+  event_pattern = jsonencode({
+    source      = ["aws.guardduty"]
+    detail-type = ["GuardDuty Malware Protection Object Scan Result"]
+    resources   = [aws_guardduty_malware_protection_plan.quarantine.arn]
+    detail = {
+      s3ObjectDetails = {
+        bucketName = [module.s3bucket_quarantine.id]
+        objectKey  = [{ prefix = "proofs/" }]
+      }
+      scanResultDetails = {
+        scanResultStatus = [{ anything-but = "NO_THREATS_FOUND" }]
+      }
+    }
+  })
+}
+
+resource "aws_cloudwatch_event_target" "quarantine_scan_failed_process_proof" {
+  rule     = aws_cloudwatch_event_rule.guardduty_quarantine_scan_failed_for_proof.name
+  arn      = module.lambda_process_proof.function_arn
+  role_arn = aws_iam_role.quarantine_scan_failed_for_proof.arn
+}
+
+resource "aws_cloudwatch_event_target" "quarantine_scan_failed_delete_object_for_proof" {
+  rule     = aws_cloudwatch_event_rule.guardduty_quarantine_scan_failed_for_proof.name
+  arn      = module.lambda_delete_failed_scanned_object.function_arn
+  role_arn = aws_iam_role.quarantine_scan_failed_for_proof.arn
+}

…rule_guardduty_quarantine_scan_failed.tf …uty_quarantine_scan_failed_for_upload.tfinfrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_failed.tf renamed to infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_failed_for_upload.tf infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_failed.tf renamed to infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_failed_for_upload.tf

@@ -1,5 +1,5 @@
-resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_failed" {
-  name        = "${local.csi}-quarantine-scan-failed"
+resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_failed_for_upload" {
+  name        = "${local.csi}-quarantine-scan-failed-for-upload"
   description = "Matches quarantine 'GuardDuty Malware Protection Object Scan Result' events where the scan result is not NO_THREATS_FOUND"
 
   event_pattern = jsonencode({
@@ -18,14 +18,14 @@ resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_failed" {
   })
 }
 
-resource "aws_cloudwatch_event_target" "quarantine_scan_failed_set_file_status" {
-  rule     = aws_cloudwatch_event_rule.guardduty_quarantine_scan_failed.name
-  arn      = module.lambda_set_file_virus_scan_status.function_arn
-  role_arn = aws_iam_role.quarantine_scan_failed.arn
+resource "aws_cloudwatch_event_target" "quarantine_scan_failed_set_file_status_for_upload" {
+  rule     = aws_cloudwatch_event_rule.guardduty_quarantine_scan_failed_for_upload.name
+  arn      = module.lambda_set_file_virus_scan_status_for_upload.function_arn
+  role_arn = aws_iam_role.quarantine_scan_failed_for_upload.arn
 }
 
-resource "aws_cloudwatch_event_target" "quarantine_scan_failed_delete_object" {
-  rule     = aws_cloudwatch_event_rule.guardduty_quarantine_scan_failed.name
+resource "aws_cloudwatch_event_target" "quarantine_scan_failed_delete_object_for_upload" {
+  rule     = aws_cloudwatch_event_rule.guardduty_quarantine_scan_failed_for_upload.name
   arn      = module.lambda_delete_failed_scanned_object.function_arn
-  role_arn = aws_iam_role.quarantine_scan_failed.arn
+  role_arn = aws_iam_role.quarantine_scan_failed_for_upload.arn
 }

infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_passed_for_proof.tf

@@ -0,0 +1,25 @@
+resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_passed_for_proof" {
+  name        = "${local.csi}-quarantine-scan-passed-proofs"
+  description = "Matches quarantine 'GuardDuty Malware Protection Object Scan Result' events where the scan result is NO_THREATS_FOUND"
+
+  event_pattern = jsonencode({
+    source      = ["aws.guardduty"]
+    detail-type = ["GuardDuty Malware Protection Object Scan Result"]
+    resources   = [aws_guardduty_malware_protection_plan.quarantine.arn]
+    detail = {
+      s3ObjectDetails = {
+        bucketName = [module.s3bucket_quarantine.id]
+        objectKey  = [{ prefix = "proofs/" }]
+      }
+      scanResultDetails = {
+        scanResultStatus = ["NO_THREATS_FOUND"]
+      }
+    }
+  })
+}
+
+resource "aws_cloudwatch_event_target" "quarantine_scan_passed_process_proof" {
+  rule     = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed_for_proof.name
+  arn      = module.lambda_process_proof.function_arn
+  role_arn = aws_iam_role.quarantine_scan_passed_for_proof.arn
+}

…rule_guardduty_quarantine_scan_passed.tf …uty_quarantine_scan_passed_for_upload.tfinfrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_passed.tf renamed to infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_passed_for_upload.tf infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_passed.tf renamed to infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_guardduty_quarantine_scan_passed_for_upload.tf

@@ -1,5 +1,5 @@
-resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_passed" {
-  name        = "${local.csi}-quarantine-scan-passed"
+resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_passed_for_upload" {
+  name        = "${local.csi}-quarantine-scan-passed-for-upload"
   description = "Matches quarantine 'GuardDuty Malware Protection Object Scan Result' events where the scan result is NO_THREATS_FOUND"
 
   event_pattern = jsonencode({
@@ -18,20 +18,20 @@ resource "aws_cloudwatch_event_rule" "guardduty_quarantine_scan_passed" {
   })
 }
 
-resource "aws_cloudwatch_event_target" "quarantine_scan_passed_set_file_status" {
-  rule     = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed.name
-  arn      = module.lambda_set_file_virus_scan_status.function_arn
-  role_arn = aws_iam_role.quarantine_scan_passed.arn
+resource "aws_cloudwatch_event_target" "quarantine_scan_passed_set_file_status_for_upload" {
+  rule     = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed_for_upload.name
+  arn      = module.lambda_set_file_virus_scan_status_for_upload.function_arn
+  role_arn = aws_iam_role.quarantine_scan_passed_for_upload.arn
 }
 
-resource "aws_cloudwatch_event_target" "quarantine_scan_passed_copy_object" {
-  rule     = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed.name
+resource "aws_cloudwatch_event_target" "quarantine_scan_passed_copy_object_for_upload" {
+  rule     = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed_for_upload.name
   arn      = module.lambda_copy_scanned_object_to_internal.function_arn
-  role_arn = aws_iam_role.quarantine_scan_passed.arn
+  role_arn = aws_iam_role.quarantine_scan_passed_for_upload.arn
 }
 
 resource "aws_cloudwatch_event_target" "quarantine_scan_passed_validate_files" {
-  rule     = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed.name
+  rule     = aws_cloudwatch_event_rule.guardduty_quarantine_scan_passed_for_upload.name
   arn      = module.sqs_validate_letter_template_files.sqs_queue_arn
-  role_arn = aws_iam_role.quarantine_scan_passed.arn
+  role_arn = aws_iam_role.quarantine_scan_passed_for_upload.arn
 }

infrastructure/terraform/modules/backend-api/dynamodb_table_templates.tf

@@ -38,4 +38,11 @@ resource "aws_dynamodb_table" "templates" {
       name, # To support backup and restore which will result in a new name otherwise
     ]
   }
+
+  global_secondary_index {
+    name               = "QueryById"
+    hash_key           = "id"
+    projection_type    = "INCLUDE"
+    non_key_attributes = ["owner"]
+  }
 }

infrastructure/terraform/modules/backend-api/iam_role_quarantine_scan_failed.tf

@@ -0,0 +1,25 @@
+resource "aws_iam_role" "quarantine_scan_failed_for_proof" {
+  name               = "${local.csi}-quarantine-scan-failed-for-proof"
+  description        = "IAM Role for GuardDuty failure CloudWatch events to trigger follow up actions"
+  assume_role_policy = data.aws_iam_policy_document.events_assume_role.json
+}
+
+resource "aws_iam_role_policy" "quarantine_scan_failed_for_proof" {
+  name   = "${local.csi}-quarantine-scan-failed-for-proof"
+  role   = aws_iam_role.quarantine_scan_failed_for_proof.id
+  policy = data.aws_iam_policy_document.quarantine_scan_failed_for_proof.json
+}
+
+data "aws_iam_policy_document" "quarantine_scan_failed_for_proof" {
+  version = "2012-10-17"
+
+  statement {
+    sid     = "AllowLambdaInvoke"
+    effect  = "Allow"
+    actions = ["lambda:InvokeFunction"]
+    resources = [
+      module.lambda_process_proof.function_arn,
+      module.lambda_delete_failed_scanned_object.function_arn
+    ]
+  }
+}