Skip to content

Commit b1ec019

Browse files
harrim91harrim91
committed
CCM-8572: enrichment lambda
1 parent 412876e commit b1ec019

File tree

15 files changed

+4204
-4672
lines changed

15 files changed

+4204
-4672
lines changed

‎infrastructure/terraform/components/app/module_kms.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@ data "aws_iam_policy_document" "kms" {
2828
identifiers = [
2929
"logs.${var.region}.amazonaws.com",
3030
"sns.amazonaws.com",
31-
"sqs.amazonaws.com",
3231
]
3332
}
3433

‎infrastructure/terraform/modules/s3-object-tagging-enrichment/README.md‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,26 @@ No requirements.
99

1010
| Name | Description | Type | Default | Required |
1111
|------|-------------|------|---------|:--------:|
12-
| <a name="input_csi"></a> [csi](#input\_csi) | CSI from the parent component | `string` | n/a | yes |
12+
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
13+
| <a name="input_component"></a> [component](#input\_component) | The variable encapsulating the name of this component | `string` | n/a | yes |
14+
| <a name="input_environment"></a> [environment](#input\_environment) | The name of the tfscaffold environment | `string` | n/a | yes |
15+
| <a name="input_group"></a> [group](#input\_group) | The group variables are being inherited from (often synonymous with account short-name) | `string` | n/a | yes |
1316
| <a name="input_id"></a> [id](#input\_id) | ID for the module instance | `string` | n/a | yes |
1417
| <a name="input_kms_key_arn"></a> [kms\_key\_arn](#input\_kms\_key\_arn) | ARN of KMS Key used for encrypting application data | `string` | n/a | yes |
15-
| <a name="input_source_bucket"></a> [source\_bucket](#input\_source\_bucket) | Source bucket details | <pre>object({<br/> name : string<br/> })</pre> | n/a | yes |
18+
| <a name="input_log_retention_in_days"></a> [log\_retention\_in\_days](#input\_log\_retention\_in\_days) | The retention period in days for the Cloudwatch Logs events to be retained, default of 0 is indefinite | `number` | `0` | no |
19+
| <a name="input_output_event_source"></a> [output\_event\_source](#input\_output\_event\_source) | the value of the 'source' field on the emitted events | `string` | n/a | yes |
20+
| <a name="input_project"></a> [project](#input\_project) | The name of the tfscaffold project | `string` | n/a | yes |
21+
| <a name="input_region"></a> [region](#input\_region) | The AWS Region | `string` | n/a | yes |
22+
| <a name="input_source_bucket"></a> [source\_bucket](#input\_source\_bucket) | Source bucket details | <pre>object({<br/> arn : string<br/> name : string<br/> })</pre> | n/a | yes |
23+
| <a name="input_source_csi"></a> [source\_csi](#input\_source\_csi) | CSI from the parent component | `string` | n/a | yes |
24+
| <a name="input_target_event_bus_arn"></a> [target\_event\_bus\_arn](#input\_target\_event\_bus\_arn) | ARN of the event bus to send tag-enrichment events to | `string` | n/a | yes |
1625
## Modules
1726

18-
No modules.
27+
| Name | Source | Version |
28+
|------|--------|---------|
29+
| <a name="module_build_get_s3_object_tags_lambda"></a> [build\_get\_s3\_object\_tags\_lambda](#module\_build\_get\_s3\_object\_tags\_lambda) | ../typescript-build-zip | n/a |
30+
| <a name="module_lambda_get_s3_object_tags"></a> [lambda\_get\_s3\_object\_tags](#module\_lambda\_get\_s3\_object\_tags) | ../lambda-function | n/a |
31+
| <a name="module_sqs_tags_added"></a> [sqs\_tags\_added](#module\_sqs\_tags\_added) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/sqs | v1.0.8 |
1932
## Outputs
2033

2134
No outputs.

‎infrastructure/terraform/modules/s3-object-tagging-enrichment/iam_role_pipe.tf‎

Lines changed: 0 additions & 81 deletions
This file was deleted.

‎infrastructure/terraform/modules/s3-object-tagging-enrichment/module_build_get_s3_object_tags_lambda.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
module "build_get_s3_object_tags_lambda" {
2+
source = "../typescript-build-zip"
3+
4+
source_code_dir = abspath("${path.module}/../../../../lambdas/get-s3-object-tags")
5+
6+
entrypoints = [
7+
"src/get-s3-object-tags.ts"
8+
]
9+
}
10+

infrastructure/terraform/modules/s3-object-tagging-enrichment/module_lambda_get_object_tags.tf renamed to infrastructure/terraform/modules/s3-object-tagging-enrichment/module_lambda_get_s3_object_tags.tf

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,19 +1,19 @@
1-
module "lambda_get_object_tags" {
1+
module "lambda_get_s3_object_tags" {
22
source = "../lambda-function"
33
description = "Get S3 Object Tags"
44

5-
function_name = "${local.csi}-get-object-tags"
6-
filename = module.build_get_object_tags_lambda.zips["src/get-object-tag.ts"].path
7-
source_code_hash = module.build_get_object_tags_lambda.zips["src/get-object-tag.ts"].base64sha256 // todo: create this lambda
5+
function_name = "${local.csi}-get-s3-object-tags"
6+
filename = module.build_get_object_tags_lambda.zips["src/get-s3-object-tags.ts"].path
7+
source_code_hash = module.build_get_object_tags_lambda.zips["src/get-s3-object-tags.ts"].base64sha256 // todo: create this lambda
88
runtime = "nodejs20.x"
9-
handler = "get-object-tags.handler"
9+
handler = "get-s3-object-tags.handler"
1010

1111
log_retention_in_days = var.log_retention_in_days
1212

13-
execution_role_policy_document = data.aws_iam_policy_document.get_template_lambda_policy.json
13+
execution_role_policy_document = data.aws_iam_policy_document.get_s3_object_tags.json
1414
}
1515

16-
data "aws_iam_policy_document" "get_template_lambda_policy" {
16+
data "aws_iam_policy_document" "get_s3_object_tags" {
1717
statement {
1818
sid = "AllowSQS"
1919
effect = "Allow"

‎infrastructure/terraform/modules/s3-object-tagging-enrichment/pipes_pipe_tags_added.tf‎

Lines changed: 65 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ resource "aws_pipes_pipe" "tags_added" {
55

66
source = module.sqs_tags_added.sqs_queue_arn
77
target = var.target_event_bus_arn
8-
enrichment = module.lambda_get_object_tags.function_arn
8+
enrichment = module.lambda_get_s3_object_tags.function_arn
99

1010
target_parameters {
1111
eventbridge_event_bus_parameters {
@@ -14,22 +14,74 @@ resource "aws_pipes_pipe" "tags_added" {
1414
resources = [var.source_bucket.arn]
1515
}
1616
}
17+
}
18+
19+
resource "aws_iam_role" "pipe" {
20+
name = "${local.csi}-pipe"
21+
description = "Role used by Pipes enrich S3 tagging events"
22+
assume_role_policy = data.aws_iam_policy_document.pipe_trust_policy.json
23+
}
24+
25+
resource "aws_iam_role_policy" "pipe" {
26+
role = aws_iam_role.pipe.id
27+
policy = data.aws_iam_policy_document.pipe.json
28+
}
1729

18-
# unsupported apparently
19-
# kms_key_identifier = var.kms_key_arn
30+
data "aws_iam_policy_document" "pipe_trust_policy" {
31+
version = "2012-10-17"
32+
33+
statement {
34+
sid = "PipesAssumeRole"
35+
effect = "Allow"
36+
actions = ["sts:AssumeRole"]
37+
38+
principals {
39+
type = "Service"
40+
41+
identifiers = ["pipes.amazonaws.com"]
42+
}
2043

21-
# do we need this?
22-
log_configuration {
23-
include_execution_data = ["ALL"]
24-
level = "INFO"
25-
cloudwatch_logs_log_destination {
26-
log_group_arn = aws_cloudwatch_log_group.pipe.arn
44+
condition {
45+
test = "StringEquals"
46+
variable = "aws:SourceAccount"
47+
values = [var.aws_account_id]
48+
}
49+
50+
condition {
51+
test = "StringEquals"
52+
variable = "aws:SourceArn"
53+
values = [aws_pipes_pipe.tags_added.arn]
2754
}
2855
}
2956
}
3057

31-
resource "aws_cloudwatch_log_group" "pipe" {
32-
name = "/aws/pipes/${local.csi}-tags-added"
33-
retention_in_days = var.log_retention_in_days
34-
kms_key_id = var.kms_key_arn
58+
data "aws_iam_policy_document" "pipe" {
59+
version = "2012-10-17"
60+
61+
statement {
62+
sid = "AllowSqsSource"
63+
effect = "Allow"
64+
actions = [
65+
"sqs:ReceiveMessage",
66+
"sqs:DeleteMessage",
67+
"sqs:GetQueueAttributes",
68+
]
69+
resources = [aws_sqs_queue.tags_added.arn]
70+
}
71+
72+
statement {
73+
sid = "AllowLambdaEnrich"
74+
effect = "Allow"
75+
actions = ["lambda:InvokeFunction"]
76+
resources = [module.lambda_get_object_tags.function_arn]
77+
}
78+
79+
statement {
80+
sid = "AllowEventBusTarget"
81+
effect = "Allow"
82+
actions = ["events:PutEvent"]
83+
resources = [
84+
var.target_event_bus_arn
85+
]
86+
}
3587
}

‎lambdas/get-s3-object-tags/.eslintignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
dist

‎lambdas/get-s3-object-tags/.gitignore‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
.build
2+
coverage
3+
node_modules
4+
dist

‎lambdas/get-s3-object-tags/jest.config.ts‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
import type { Config } from 'jest';
2+
import { baseJestConfig } from 'nhs-notify-web-template-management-utils'; // eslint-disable-line no-restricted-exports
3+
4+
const config: Config = { ...baseJestConfig, testEnvironment: 'node' };
5+
6+
export default config;

‎lambdas/get-s3-object-tags/package.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
{
2+
"name": "nhs-notify-get-s3-object-tags",
3+
"version": "0.0.1",
4+
"private": true,
5+
"scripts": {
6+
"test:unit": "jest --config jest.config.ts",
7+
"lint": "eslint .",
8+
"lint:fix": "eslint . --fix",
9+
"typecheck": "tsc --noEmit"
10+
},
11+
"devDependencies": {
12+
"@swc/core": "^1.10.1",
13+
"@swc/jest": "^0.2.37",
14+
"@tsconfig/node20": "^20.1.4",
15+
"@types/aws-lambda": "^8.10.145",
16+
"@types/jest": "^29.5.14",
17+
"aws-sdk-client-mock": "^4.1.0",
18+
"esbuild": "^0.24.0",
19+
"jest": "^29.7.0",
20+
"ts-jest": "^29.2.5",
21+
"ts-node": "^10.9.2",
22+
"typescript": "^5.5.4"
23+
},
24+
"dependencies": {
25+
"@aws-sdk/client-s3": "3.621.0",
26+
"nhs-notify-web-template-management-utils": "*",
27+
"zod": "^3.23.8"
28+
}
29+
}

0 commit comments

Comments
 (0)