CCM-10283: Fixes

chris-elliott-nhsd · chris-elliott-nhsd · commit b123d2057635 · 2025-06-27T11:24:05.000+01:00
diff --git a/infrastructure/terraform/components/acct/module_sandbox_kms.tf b/infrastructure/terraform/components/acct/module_sandbox_kms.tf
@@ -55,6 +55,40 @@ data "aws_iam_policy_document" "kms" {
     }
   }
 
+  statement {
+    sid    = "AllowSES"
+    effect = "Allow"
+
+    principals {
+      type = "Service"
+
+      identifiers = [
+        "ses..amazonaws.com",
+      ]
+    }
+
+    actions = [
+      "kms:Encrypt*",
+      "kms:Decrypt*",
+      "kms:ReEncrypt*",
+      "kms:GenerateDataKey*",
+      "kms:Describe*"
+    ]
+
+    resources = [
+      "*",
+    ]
+
+    condition {
+      test     = "ArnLike"
+      variable = "aws:SourceArn"
+
+      values = [
+        "arn:aws:ses:${var.region}:${var.aws_account_id}:receipt-rule-set:*",
+      ]
+    }
+  }
+
   statement {
     sid    = "AllowLogDeliveryEncrypt"
     effect = "Allow"
diff --git a/infrastructure/terraform/components/app/module_backend_api.tf b/infrastructure/terraform/components/app/module_backend_api.tf
@@ -28,8 +28,7 @@ module "backend_api" {
 
   send_to_firehose = true
 
-  email_domain             = local.root_domain_name
-  ses_domain_identity_arns = module.ses.domain_identity_arns
+  email_domain = module.ses.domain
 
   mock_letter_supplier_name     = local.mock_letter_supplier_name
   use_sftp_letter_supplier_mock = lookup(var.letter_suppliers, local.mock_letter_supplier_name, null) != null
diff --git a/infrastructure/terraform/components/sandbox/README.md b/infrastructure/terraform/components/sandbox/README.md
@@ -15,7 +15,7 @@ No requirements.
 | <a name="input_environment"></a> [environment](#input\_environment) | The name of the tfscaffold environment | `string` | n/a | yes |
 | <a name="input_group"></a> [group](#input\_group) | The group variables are being inherited from (often synonymous with account short-name) | `string` | n/a | yes |
 | <a name="input_kms_deletion_window"></a> [kms\_deletion\_window](#input\_kms\_deletion\_window) | When a kms key is deleted, how long should it wait in the pending deletion state? | `string` | `"30"` | no |
-| <a name="input_letter_suppliers"></a> [letter\_suppliers](#input\_letter\_suppliers) | Letter suppliers enabled in the environment | <pre>map(object({<br/>    email_addresses  = list(string)<br/>    enable_polling   = bool<br/>    default_supplier = optional(bool)<br/>  }))</pre> | <pre>{<br/>  "WTMMOCK": {<br/>    "default_supplier": true,<br/>    "email_addresses": [<br/>      "template-submitted-recipient@dev.nhsnotify.national.nhs.uk"<br/>    ],<br/>    "enable_polling": true<br/>  }<br/>}</pre> | no |
+| <a name="input_letter_suppliers"></a> [letter\_suppliers](#input\_letter\_suppliers) | Letter suppliers enabled in the environment | <pre>map(object({<br/>    email_addresses  = list(string)<br/>    enable_polling   = bool<br/>    default_supplier = optional(bool)<br/>  }))</pre> | <pre>{<br/>  "WTMMOCK": {<br/>    "default_supplier": true,<br/>    "email_addresses": [<br/>      "template-submitted-recipient@sandbox.templates.dev.nhsnotify.national.nhs.uk"<br/>    ],<br/>    "enable_polling": true<br/>  }<br/>}</pre> | no |
 | <a name="input_log_retention_in_days"></a> [log\_retention\_in\_days](#input\_log\_retention\_in\_days) | The retention period in days for the Cloudwatch Logs events to be retained, default of 0 is indefinite | `number` | `0` | no |
 | <a name="input_parent_acct_environment"></a> [parent\_acct\_environment](#input\_parent\_acct\_environment) | Name of the environment responsible for the acct resources used, affects things like DNS zone. Useful for named dev environments | `string` | `"main"` | no |
 | <a name="input_project"></a> [project](#input\_project) | The name of the tfscaffold project | `string` | n/a | yes |
diff --git a/infrastructure/terraform/components/sandbox/module_backend_api.tf b/infrastructure/terraform/components/sandbox/module_backend_api.tf
@@ -27,12 +27,7 @@ module "backend_api" {
   enable_event_stream = true
 
   email_domain             = "sandbox.${local.acct.dns_zone["name"]}"
-  ses_domain_identity_arns = [data.aws_ses_domain_identity.sandbox_ses.arn]
 
   mock_letter_supplier_name     = local.mock_letter_supplier_name
   use_sftp_letter_supplier_mock = lookup(var.letter_suppliers, local.mock_letter_supplier_name, null) != null
 }
-
-data "aws_ses_domain_identity" "sandbox_ses" {
-  domain = "sandbox.${local.acct.dns_zone["name"]}"
-}
diff --git a/infrastructure/terraform/components/sandbox/variables.tf b/infrastructure/terraform/components/sandbox/variables.tf
@@ -72,7 +72,7 @@ variable "letter_suppliers" {
 
   default = {
     "WTMMOCK" = {
-      email_addresses  = ["template-submitted-recipient@dev.nhsnotify.national.nhs.uk"]
+      email_addresses  = ["template-submitted-recipient@sandbox.templates.dev.nhsnotify.national.nhs.uk"]
       enable_polling   = true
       default_supplier = true
     }
diff --git a/infrastructure/terraform/modules/backend-api/README.md b/infrastructure/terraform/modules/backend-api/README.md
@@ -32,7 +32,6 @@ No requirements.
 | <a name="input_project"></a> [project](#input\_project) | The name of the tfscaffold project | `string` | n/a | yes |
 | <a name="input_region"></a> [region](#input\_region) | The AWS Region | `string` | n/a | yes |
 | <a name="input_send_to_firehose"></a> [send\_to\_firehose](#input\_send\_to\_firehose) | Flag indicating whether logs should be sent to firehose | `bool` | n/a | yes |
-| <a name="input_ses_domain_identity_arns"></a> [ses\_domain\_identity\_arns](#input\_ses\_domain\_identity\_arns) | SES Domain Identity ARNs | `list(string)` | n/a | yes |
 | <a name="input_use_sftp_letter_supplier_mock"></a> [use\_sftp\_letter\_supplier\_mock](#input\_use\_sftp\_letter\_supplier\_mock) | Flag indicating whether mock letter supplier is enabled | `bool` | n/a | yes |
 ## Modules
 
diff --git a/infrastructure/terraform/modules/backend-api/locals.tf b/infrastructure/terraform/modules/backend-api/locals.tf
@@ -48,7 +48,7 @@ locals {
     TEMPLATES_DOWNLOAD_BUCKET_NAME          = module.s3bucket_download.id
     TEMPLATES_TABLE_NAME                    = aws_dynamodb_table.templates.name
     ENABLE_PROOFING                         = var.enable_proofing
-    TEMPLATE_SUBMITTED_SENDER_EMAIL_ADDRESS = "template-submitted@${var.email_domain}"
+    TEMPLATE_SUBMITTED_SENDER_EMAIL_ADDRESS = local.template_submitted_sender_email_address
     SUPPLIER_RECIPIENT_EMAIL_ADDRESSES      = jsonencode({ for k, v in var.letter_suppliers : k => v.email_addresses })
   }
 
@@ -57,4 +57,5 @@ locals {
   ][0], "")
 
   sftp_environment = "${var.group}-${var.environment}-${var.component}"
+  template_submitted_sender_email_address = "template-submitted-recipient@${var.email_domain}"
 }
diff --git a/infrastructure/terraform/modules/backend-api/module_submit_template_lambda.tf b/infrastructure/terraform/modules/backend-api/module_submit_template_lambda.tf
@@ -71,6 +71,7 @@ data "aws_iam_policy_document" "submit_template_lambda_policy" {
 
     actions = ["ses:SendRawEmail"]
 
-    resources = var.ses_domain_identity_arns
+    resources = ["arn:aws:ses:${var.region}:${var.aws_account_id}:identity/${local.template_submitted_sender_email_address}",
+    "arn:aws:ses:${var.region}:${var.aws_account_id}:identity/${var.email_domain}"]
   }
 }
diff --git a/infrastructure/terraform/modules/backend-api/variables.tf b/infrastructure/terraform/modules/backend-api/variables.tf
@@ -143,8 +143,3 @@ variable "use_sftp_letter_supplier_mock" {
   type        = bool
   description = "Flag indicating whether mock letter supplier is enabled"
 }
-
-variable "ses_domain_identity_arns" {
-  type        = list(string)
-  description = "SES Domain Identity ARNs"
-}
diff --git a/infrastructure/terraform/modules/ses/README.md b/infrastructure/terraform/modules/ses/README.md
@@ -28,7 +28,7 @@ No requirements.
 
 | Name | Description |
 |------|-------------|
-| <a name="output_domain_identity_arns"></a> [domain\_identity\_arns](#output\_domain\_identity\_arns) | n/a |
+| <a name="output_domain"></a> [domain](#output\_domain) | n/a |
 <!-- vale on -->
 <!-- markdownlint-enable -->
 <!-- END_TF_DOCS -->
diff --git a/infrastructure/terraform/modules/ses/outputs.tf b/infrastructure/terraform/modules/ses/outputs.tf
@@ -1,3 +1,3 @@
-output "domain_identity_arns" {
-    value = var.external_email_domain == null ? [aws_ses_domain_identity.main.arn] : [aws_ses_domain_identity.main.arn, aws_ses_domain_identity.external.0.arn]
+output "domain" {
+    value = var.external_email_domain == null ? aws_ses_domain_identity.main.domain : aws_ses_domain_identity.external.0.domain
 }
diff --git a/infrastructure/terraform/modules/ses/route53_record_ses_mx_inbound.tf b/infrastructure/terraform/modules/ses/route53_record_ses_mx_inbound.tf
@@ -0,0 +1,9 @@
+resource "aws_route53_record" "ses_mx_inbound" {
+  count = var.use_sftp_letter_supplier_mock ? 1 : 0
+
+  zone_id = var.zone_id
+  name    = aws_ses_domain_identity.main.domain
+  type    = "MX"
+  ttl     = "600"
+  records = ["10 inbound-smtp.eu-west-2.amazonaws.com"]
+}
diff --git a/lambdas/backend-api/build.sh b/lambdas/backend-api/build.sh
@@ -0,0 +1,28 @@
+#!/bin/bash
+
+set -euo pipefail
+
+rm -rf dist
+
+npx esbuild \
+    --bundle \
+    --minify \
+    --sourcemap \
+    --target=es2020 \
+    --platform=node \
+    --loader:.node=file \
+    --entry-names=[name] \
+    --outdir=dist \
+    --external:pdfjs-dist \
+    src/templates/copy-scanned-object-to-internal.ts \
+    src/templates/create-letter.ts src/templates/create.ts \
+    src/templates/delete-failed-scanned-object.ts \
+    src/templates/delete.ts src/templates/get.ts \
+    src/templates/list.ts \
+    src/templates/proof.ts \
+    src/templates/set-letter-upload-virus-scan-status.ts \
+    src/templates/process-proof.ts src/templates/submit.ts \
+    src/templates/update.ts \
+    src/templates/validate-letter-template-files.ts
+
+cp src/templates/infra/email-template.html dist/email-template.html
diff --git a/lambdas/backend-api/package.json b/lambdas/backend-api/package.json
@@ -40,7 +40,7 @@
   "name": "nhs-notify-backend-api",
   "private": true,
   "scripts": {
-    "lambda-build": "rm -rf dist && npx esbuild --bundle --minify --sourcemap --target=es2020 --platform=node --loader:.node=file --entry-names=[name] --outdir=dist --external:pdfjs-dist src/templates/copy-scanned-object-to-internal.ts src/templates/create-letter.ts src/templates/create.ts src/templates/delete-failed-scanned-object.ts src/templates/delete.ts src/templates/get.ts src/templates/list.ts src/templates/proof.ts src/templates/set-letter-upload-virus-scan-status.ts src/templates/process-proof.ts src/templates/submit.ts src/templates/update.ts src/templates/validate-letter-template-files.ts",
+    "lambda-build": "./build.sh",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "test:unit": "NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules\" npx jest",
diff --git a/lambdas/backend-api/src/templates/infra/config.ts b/lambdas/backend-api/src/templates/infra/config.ts
@@ -18,7 +18,7 @@ export function loadConfig() {
 
   const supplierRecipientEmailAddresses = z
     .record(z.array(z.string()))
-    .parse(env.SUPPLIER_RECIPIENT_EMAIL_ADDRESSES);
+    .parse(JSON.parse(env.SUPPLIER_RECIPIENT_EMAIL_ADDRESSES));
 
   return {
     defaultLetterSupplier: env.DEFAULT_LETTER_SUPPLIER,
diff --git a/lambdas/backend-api/src/templates/infra/email-client.ts b/lambdas/backend-api/src/templates/infra/email-client.ts
@@ -19,7 +19,7 @@ export class EmailClient {
     supplier: string,
     proofFilenames: string[]
   ) {
-    const emailTemplateContent = readFileSync('./email-template.html');
+    const emailTemplateContent = readFileSync('./email-template.html').toString();
     const htmlTemplate = Handlebars.compile(emailTemplateContent);
 
     return htmlTemplate({

Original file line number	Diff line number	Diff line change
`@@ -72,7 +72,7 @@ variable "letter_suppliers" {`
`72`	`72`
`73`	`73`	`default = {`
`74`	`74`	`"WTMMOCK" = {`
`75`		`- email_addresses = ["[email protected]"]`
	`75`	`+ email_addresses = ["template-submitted-recipient@sandbox.templates.dev.nhsnotify.national.nhs.uk"]`
`76`	`76`	`enable_polling = true`
`77`	`77`	`default_supplier = true`
`78`	`78`	`}`
Original file line number	Diff line number	Diff line change
`@@ -48,7 +48,7 @@ locals {`
`48`	`48`	`TEMPLATES_DOWNLOAD_BUCKET_NAME = module.s3bucket_download.id`
`49`	`49`	`TEMPLATES_TABLE_NAME = aws_dynamodb_table.templates.name`
`50`	`50`	`ENABLE_PROOFING = var.enable_proofing`
`51`		`- TEMPLATE_SUBMITTED_SENDER_EMAIL_ADDRESS = "template-submitted@${var.email_domain}"`
	`51`	`+ TEMPLATE_SUBMITTED_SENDER_EMAIL_ADDRESS = local.template_submitted_sender_email_address`
`52`	`52`	`SUPPLIER_RECIPIENT_EMAIL_ADDRESSES = jsonencode({ for k, v in var.letter_suppliers : k => v.email_addresses })`
`53`	`53`	`}`
`54`	`54`
`@@ -57,4 +57,5 @@ locals {`
`57`	`57`	`][0], "")`
`58`	`58`
`59`	`59`	`sftp_environment = "${var.group}-${var.environment}-${var.component}"`
	`60`	`+ template_submitted_sender_email_address = "template-submitted-recipient@${var.email_domain}"`
`60`	`61`	`}`
Original file line number	Diff line number	Diff line change
`@@ -71,6 +71,7 @@ data "aws_iam_policy_document" "submit_template_lambda_policy" {`
`71`	`71`
`72`	`72`	`actions = ["ses:SendRawEmail"]`
`73`	`73`
`74`		`- resources = var.ses_domain_identity_arns`
	`74`	`+ resources = ["arn:aws:ses:${var.region}:${var.aws_account_id}:identity/${local.template_submitted_sender_email_address}",`
	`75`	`+ "arn:aws:ses:${var.region}:${var.aws_account_id}:identity/${var.email_domain}"]`
`75`	`76`	`}`
`76`	`77`	`}`
Original file line number	Diff line number	Diff line change
`@@ -143,8 +143,3 @@ variable "use_sftp_letter_supplier_mock" {`
`143`	`143`	`type = bool`
`144`	`144`	`description = "Flag indicating whether mock letter supplier is enabled"`
`145`	`145`	`}`
`146`		`-`
`147`		`-variable "ses_domain_identity_arns" {`
`148`		`- type = list(string)`
`149`		`- description = "SES Domain Identity ARNs"`
`150`		`-}`