Skip to content

Commit afc4890

Browse files
harrim91harrim91
committed
CCM-8574: refactor - remove pipe
1 parent 7f3e8cd commit afc4890

File tree

58 files changed

+2411
-6499
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

58 files changed

+2411
-6499
lines changed

‎infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_quarantine_scan_result.tf‎

Lines changed: 15 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
1-
resource "aws_cloudwatch_event_rule" "quarantine_scan_result" {
2-
name = "${local.csi}-quarantine-tags-added"
3-
description = "Forwards quarantine 'GuardDuty Malware Protection Object Scan Result' events for enrichment"
1+
resource "aws_cloudwatch_event_rule" "quarantine_guardduty_scan_result" {
2+
name = "${local.csi}-quarantine-scan"
3+
description = "Matches quarantine 'GuardDuty Malware Protection Object Scan Result' events"
44

55
event_pattern = jsonencode({
66
source = ["aws.guardduty"]
@@ -15,40 +15,30 @@ resource "aws_cloudwatch_event_rule" "quarantine_scan_result" {
1515
})
1616
}
1717

18-
resource "aws_cloudwatch_event_target" "quarantine_scan_to_enrichment" {
19-
rule = aws_cloudwatch_event_rule.quarantine_scan_result.name
20-
arn = module.sqs_quarantine_scan_enrichment.sqs_queue_arn
21-
role_arn = aws_iam_role.quarantine_scan_to_enrichment.arn
18+
resource "aws_cloudwatch_event_target" "quarantine_scan_to_update_status" {
19+
rule = aws_cloudwatch_event_rule.quarantine_guardduty_scan_result.name
20+
arn = module.lambda_set_file_virus_scan_status.function_arn
21+
role_arn = aws_iam_role.quarantine_scan_to_update_status.arn
2222
}
2323

24-
resource "aws_iam_role" "quarantine_scan_to_enrichment" {
24+
resource "aws_iam_role" "quarantine_scan_to_update_status" {
2525
name = "${local.csi}-quarantine-scan-to-enrichment"
2626
assume_role_policy = data.aws_iam_policy_document.events_assume_role.json
2727
}
2828

29-
resource "aws_iam_role_policy" "quarantine_scan_to_enrichment" {
29+
resource "aws_iam_role_policy" "quarantine_scan_to_update_status" {
3030
name = "${local.csi}-quarantine-scan-to-enrichment"
31-
role = aws_iam_role.quarantine_scan_to_enrichment.id
32-
policy = data.aws_iam_policy_document.quarantine_scan_to_enrichment.json
31+
role = aws_iam_role.quarantine_scan_to_update_status.id
32+
policy = data.aws_iam_policy_document.quarantine_scan_to_update_status.json
3333
}
3434

35-
data "aws_iam_policy_document" "quarantine_scan_to_enrichment" {
35+
data "aws_iam_policy_document" "quarantine_scan_to_update_status" {
3636
version = "2012-10-17"
3737

3838
statement {
39-
sid = "AllowSQSSendMessage"
39+
sid = "AllowLambdaInvoke"
4040
effect = "Allow"
41-
actions = ["sqs:SendMessage"]
42-
resources = [module.sqs_quarantine_scan_enrichment.sqs_queue_arn]
43-
}
44-
45-
statement {
46-
sid = "AllowKMS"
47-
effect = "Allow"
48-
actions = [
49-
"kms:Decrypt",
50-
"kms:GenerateDataKey"
51-
]
52-
resources = [var.kms_key_arn]
41+
actions = ["lambda:InvokeFunction"]
42+
resources = [module.lambda_set_file_virus_scan_status.function_arn]
5343
}
5444
}

‎infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_virus_scan_failed.tf‎

Lines changed: 4 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,12 @@
11
resource "aws_cloudwatch_event_rule" "virus_scan_failed" {
22
name = "${local.csi}-virus-scan-failed"
3-
description = "Forwards enriched events from quarantine bucket where GuardDuty virus scan has failed"
3+
description = "Forwards 'template-file-scanned' domain events where virus scan has failed"
44

55
event_pattern = jsonencode({
6-
source = ["templates.${var.environment}.${var.project}"]
7-
detail-type = ["quarantine-scan-result-enriched"]
6+
source = [local.event_source]
7+
detail-type = ["template-file-scanned"]
88
detail = {
9-
s3ObjectDetails = {
10-
bucketName = [module.s3bucket_quarantine.id]
11-
objectKey = [{ prefix = "pdf-template/" }, { prefix = "test-data/" }]
12-
}
13-
scanResultDetails = {
14-
scanResultStatus = [{ anything-but = "NO_THREATS_FOUND" }]
15-
}
9+
virusScanStatus = ["FAILED"]
1610
}
1711
})
1812
}
@@ -23,12 +17,6 @@ resource "aws_cloudwatch_event_target" "scan_failed_delete_object" {
2317
role_arn = aws_iam_role.handle_scan_failed.arn
2418
}
2519

26-
resource "aws_cloudwatch_event_target" "scan_failed_set_file_status" {
27-
rule = aws_cloudwatch_event_rule.virus_scan_failed.name
28-
arn = module.lambda_set_file_virus_scan_status.function_arn
29-
role_arn = aws_iam_role.handle_scan_failed.arn
30-
}
31-
3220
resource "aws_iam_role" "handle_scan_failed" {
3321
name = "${local.csi}-virus-scan-failed"
3422
assume_role_policy = data.aws_iam_policy_document.events_assume_role.json
@@ -49,7 +37,6 @@ data "aws_iam_policy_document" "handle_scan_failed" {
4937
actions = ["lambda:InvokeFunction"]
5038
resources = [
5139
module.lambda_delete_failed_scanned_object.function_arn,
52-
module.lambda_set_file_virus_scan_status.function_arn,
5340
]
5441
}
5542
}

‎infrastructure/terraform/modules/backend-api/cloudwatch_event_rule_virus_scan_passed.tf‎

Lines changed: 4 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,12 @@
11
resource "aws_cloudwatch_event_rule" "virus_scan_passed" {
22
name = "${local.csi}-virus-scan-passed"
3-
description = "Forwards enriched events from quarantine bucket where GuardDuty virus scan has passed with no threats"
3+
description = "Forwards 'template-file-scanned' domain events where virus scan has passed with no threats"
44

55
event_pattern = jsonencode({
6-
source = ["templates.${var.environment}.${var.project}"]
7-
detail-type = ["quarantine-scan-result-enriched"]
6+
source = [local.event_source]
7+
detail-type = ["template-file-scanned"]
88
detail = {
9-
s3ObjectDetails = {
10-
bucketName = [module.s3bucket_quarantine.id]
11-
objectKey = [{ prefix = "pdf-template/" }, { prefix = "test-data/" }]
12-
}
13-
scanResultDetails = {
14-
scanResultStatus = ["NO_THREATS_FOUND"]
15-
}
9+
virusScanStatus = ["PASSED"]
1610
}
1711
})
1812
}
@@ -23,12 +17,6 @@ resource "aws_cloudwatch_event_target" "scan_passed_copy_object" {
2317
role_arn = aws_iam_role.handle_scan_passed.arn
2418
}
2519

26-
resource "aws_cloudwatch_event_target" "scan_passed_set_file_status" {
27-
rule = aws_cloudwatch_event_rule.virus_scan_passed.name
28-
arn = module.lambda_set_file_virus_scan_status.function_arn
29-
role_arn = aws_iam_role.handle_scan_passed.arn
30-
}
31-
3220
resource "aws_iam_role" "handle_scan_passed" {
3321
name = "${local.csi}-virus-scan-passed"
3422
assume_role_policy = data.aws_iam_policy_document.events_assume_role.json
@@ -49,7 +37,6 @@ data "aws_iam_policy_document" "handle_scan_passed" {
4937
actions = ["lambda:InvokeFunction"]
5038
resources = [
5139
module.lambda_copy_scanned_object_to_internal.function_arn,
52-
module.lambda_set_file_virus_scan_status.function_arn,
5340
]
5441
}
5542
}

‎infrastructure/terraform/modules/backend-api/locals.tf‎

Lines changed: 22 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,29 @@ locals {
1515
})
1616

1717
backend_lambda_entrypoints = {
18-
create_template = "src/templates/create.ts"
19-
create_letter_template = "src/templates/create-letter.ts"
20-
get_template = "src/templates/get.ts"
21-
update_template = "src/templates/update.ts"
22-
list_template = "src/templates/list.ts"
23-
set_file_virus_scan_status = "src/templates/set-letter-file-virus-scan-status.ts"
24-
template_client = "src/index.ts"
18+
create_template = "src/templates/create.ts"
19+
create_letter_template = "src/templates/create-letter.ts"
20+
get_template = "src/templates/get.ts"
21+
update_template = "src/templates/update.ts"
22+
list_template = "src/templates/list.ts"
23+
set_file_virus_scan_status = "src/templates/set-letter-file-virus-scan-status.ts"
24+
copy_scanned_object_to_internal = "src/templates/copy-scanned-object-to-internal.ts"
25+
delete_failed_scanned_object = "src/templates/delete-failed-scanned-object.ts"
26+
template_client = "src/index.ts"
27+
}
28+
29+
backend_lambda_environment_variables = {
30+
ENABLE_LETTERS_BACKEND = var.enable_letters
31+
ENVIRONMENT = var.environment
32+
NODE_OPTIONS = "--enable-source-maps"
33+
TEMPLATES_QUARANTINE_BUCKET_NAME = module.s3bucket_quarantine.id
34+
TEMPLATES_INTERNAL_BUCKET_NAME = module.s3bucket_internal.id
35+
TEMPLATES_EVENT_BUS_NAME = data.aws_cloudwatch_event_bus.default.name
36+
TEMPLATES_EVENT_SOURCE = local.event_source
37+
TEMPLATES_TABLE_NAME = aws_dynamodb_table.templates.name
2538
}
2639

2740
dynamodb_kms_key_arn = var.dynamodb_kms_key_arn == "" ? aws_kms_key.dynamo[0].arn : var.dynamodb_kms_key_arn
41+
42+
event_source = "templates.${var.environment}.${var.project}"
2843
}

‎infrastructure/terraform/modules/backend-api/module_build_template_lambda.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,8 @@ module "build_template_lambda" {
99
local.backend_lambda_entrypoints.update_template,
1010
local.backend_lambda_entrypoints.list_template,
1111
local.backend_lambda_entrypoints.set_file_virus_scan_status,
12+
local.backend_lambda_entrypoints.copy_scanned_object_to_internal,
13+
local.backend_lambda_entrypoints.delete_failed_scanned_object,
1214
]
1315
}
1416

‎infrastructure/terraform/modules/backend-api/module_build_virus_scan_lambdas.tf‎

Lines changed: 0 additions & 11 deletions
This file was deleted.

‎infrastructure/terraform/modules/backend-api/module_create_letter_template_lambda.tf‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -13,11 +13,7 @@ module "create_letter_template_lambda" {
1313

1414
log_retention_in_days = var.log_retention_in_days
1515

16-
environment_variables = {
17-
TEMPLATES_TABLE_NAME = aws_dynamodb_table.templates.name
18-
QUARANTINE_BUCKET_NAME = module.s3bucket_quarantine.bucket
19-
ENABLE_LETTERS_BACKEND = var.enable_letters
20-
}
16+
environment_variables = local.backend_lambda_environment_variables
2117

2218
execution_role_policy_document = data.aws_iam_policy_document.create_letter_template_lambda_policy.json
2319
}

‎infrastructure/terraform/modules/backend-api/module_create_template_lambda.tf‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,9 +12,7 @@ module "create_template_lambda" {
1212

1313
log_retention_in_days = var.log_retention_in_days
1414

15-
environment_variables = {
16-
TEMPLATES_TABLE_NAME = aws_dynamodb_table.templates.name
17-
}
15+
environment_variables = local.backend_lambda_environment_variables
1816

1917
execution_role_policy_document = data.aws_iam_policy_document.create_template_lambda_policy.json
2018
}

‎infrastructure/terraform/modules/backend-api/module_get_template_lambda.tf‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,7 @@ module "get_template_lambda" {
1212

1313
log_retention_in_days = var.log_retention_in_days
1414

15-
environment_variables = {
16-
TEMPLATES_TABLE_NAME = aws_dynamodb_table.templates.name
17-
ENABLE_LETTERS_BACKEND = var.enable_letters
18-
}
15+
environment_variables = local.backend_lambda_environment_variables
1916

2017
execution_role_policy_document = data.aws_iam_policy_document.get_template_lambda_policy.json
2118
}

‎infrastructure/terraform/modules/backend-api/module_lambda_copy_scanned_object_to_internal.tf‎

Lines changed: 3 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,13 @@ module "lambda_copy_scanned_object_to_internal" {
44

55
dead_letter_target_arn = module.sqs_virus_scan_passed_copy_object_dlq.sqs_queue_arn
66
execution_role_policy_document = data.aws_iam_policy_document.copy_scanned_object_to_internal.json
7-
filename = module.build_virus_scan_lambdas.zips["src/copy-scanned-object-to-internal.ts"].path
7+
filename = module.build_template_lambda.zips[local.backend_lambda_entrypoints.copy_scanned_object_to_internal].path
88
function_name = "${local.csi}-copy-scanned-file"
99
handler = "copy-scanned-object-to-internal.handler"
1010
log_retention_in_days = var.log_retention_in_days
11-
source_code_hash = module.build_virus_scan_lambdas.zips["src/copy-scanned-object-to-internal.ts"].base64sha256
11+
source_code_hash = module.build_template_lambda.zips[local.backend_lambda_entrypoints.copy_scanned_object_to_internal].base64sha256
1212

13-
environment_variables = {
14-
TEMPLATES_INTERNAL_S3_BUCKET_NAME = module.s3bucket_internal.id
15-
}
13+
environment_variables = local.backend_lambda_environment_variables
1614
}
1715

1816
data "aws_iam_policy_document" "copy_scanned_object_to_internal" {
@@ -34,9 +32,7 @@ data "aws_iam_policy_document" "copy_scanned_object_to_internal" {
3432

3533
actions = [
3634
"s3:GetObject",
37-
"s3:GetObjectVersion",
3835
"s3:GetObjectTagging",
39-
"s3:GetObjectVersionTagging",
4036
]
4137

4238
resources = ["${module.s3bucket_quarantine.arn}/*"]
@@ -48,9 +44,7 @@ data "aws_iam_policy_document" "copy_scanned_object_to_internal" {
4844

4945
actions = [
5046
"s3:PutObject",
51-
"s3:PutObjectVersion",
5247
"s3:PutObjectTagging",
53-
"s3:PutObjectVersionTagging",
5448
]
5549

5650
resources = ["${module.s3bucket_internal.arn}/*"]

0 commit comments

Comments
 (0)