Skip to content

Commit e11fd85

Browse files
nicki-nhsnicki-nhs
authored
Merge branch 'main' into feature/CCM-8493-missing-nhs-app-markdown-guidance
2 parents 309a53f + e46db4c commit e11fd85

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+753
-740
lines changed

‎infrastructure/terraform/components/app/module_backend_api.tf‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,4 +30,5 @@ module "backend_api" {
3030

3131
email_domain = module.ses.domain
3232
template_submitted_sender_email_address = "template-submitted@${module.ses.domain}"
33+
proof_requested_sender_email_address = "proof-requested@${module.ses.domain}"
3334
}

‎infrastructure/terraform/components/sandbox/README.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,13 +41,14 @@
4141
| <a name="output_download_bucket_name"></a> [download\_bucket\_name](#output\_download\_bucket\_name) | n/a |
4242
| <a name="output_internal_bucket_name"></a> [internal\_bucket\_name](#output\_internal\_bucket\_name) | n/a |
4343
| <a name="output_quarantine_bucket_name"></a> [quarantine\_bucket\_name](#output\_quarantine\_bucket\_name) | n/a |
44-
| <a name="output_send_proof_queue_url"></a> [send\_proof\_queue\_url](#output\_send\_proof\_queue\_url) | n/a |
44+
| <a name="output_request_proof_queue_url"></a> [request\_proof\_queue\_url](#output\_request\_proof\_queue\_url) | n/a |
4545
| <a name="output_sftp_environment"></a> [sftp\_environment](#output\_sftp\_environment) | n/a |
4646
| <a name="output_sftp_mock_credential_path"></a> [sftp\_mock\_credential\_path](#output\_sftp\_mock\_credential\_path) | n/a |
4747
| <a name="output_sftp_poll_lambda_name"></a> [sftp\_poll\_lambda\_name](#output\_sftp\_poll\_lambda\_name) | n/a |
4848
| <a name="output_templates_table_name"></a> [templates\_table\_name](#output\_templates\_table\_name) | n/a |
4949
| <a name="output_test_email_bucket_name"></a> [test\_email\_bucket\_name](#output\_test\_email\_bucket\_name) | n/a |
50-
| <a name="output_test_email_prefix"></a> [test\_email\_prefix](#output\_test\_email\_prefix) | n/a |
50+
| <a name="output_test_proof_requested_email_prefix"></a> [test\_proof\_requested\_email\_prefix](#output\_test\_proof\_requested\_email\_prefix) | n/a |
51+
| <a name="output_test_template_submitted_email_prefix"></a> [test\_template\_submitted\_email\_prefix](#output\_test\_template\_submitted\_email\_prefix) | n/a |
5152
<!-- vale on -->
5253
<!-- markdownlint-enable -->
5354
<!-- END_TF_DOCS -->

‎infrastructure/terraform/components/sandbox/locals.tf‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,9 +3,10 @@ locals {
33

44
use_sftp_letter_supplier_mock = lookup(var.letter_suppliers, local.mock_letter_supplier_name, null) != null
55

6-
email_domain = "sandbox.${local.acct.dns_zone["name"]}"
7-
sandbox_letter_supplier_mock_sender = "template-submitted-sender-${var.environment}@${local.email_domain}"
8-
sandbox_letter_supplier_mock_recipient = "template-submitted-recipient-${var.environment}@${local.email_domain}"
6+
email_domain = "sandbox.${local.acct.dns_zone["name"]}"
7+
sandbox_letter_supplier_mock_proof_requested_sender = "proof-requested-sender-${var.environment}@${local.email_domain}"
8+
sandbox_letter_supplier_mock_template_submitted_sender = "template-submitted-sender-${var.environment}@${local.email_domain}"
9+
sandbox_letter_supplier_mock_recipient = "supplier-recipient-${var.environment}@${local.email_domain}"
910

1011
# var.letter_suppliers is defined at a point where we don't know what the environment is, so
1112
# we need to add the environment-dependent test recipient separately here

‎infrastructure/terraform/components/sandbox/module_backend_api.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,5 +27,6 @@ module "backend_api" {
2727
enable_event_stream = true
2828

2929
email_domain = local.email_domain
30-
template_submitted_sender_email_address = local.sandbox_letter_supplier_mock_sender
30+
template_submitted_sender_email_address = local.sandbox_letter_supplier_mock_template_submitted_sender
31+
proof_requested_sender_email_address = local.sandbox_letter_supplier_mock_proof_requested_sender
3132
}

‎infrastructure/terraform/components/sandbox/outputs.tf‎

Lines changed: 9 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -22,8 +22,8 @@ output "internal_bucket_name" {
2222
value = module.backend_api.internal_bucket_name
2323
}
2424

25-
output "send_proof_queue_url" {
26-
value = module.backend_api.send_proof_queue_url
25+
output "request_proof_queue_url" {
26+
value = module.backend_api.request_proof_queue_url
2727
}
2828

2929
output "sftp_mock_credential_path" {
@@ -62,6 +62,11 @@ output "test_email_bucket_name" {
6262
value = local.acct["ses_testing_config"].bucket_name
6363
}
6464

65-
output "test_email_prefix" {
66-
value = "emails-${var.environment}"
65+
output "test_proof_requested_email_prefix" {
66+
value = "proof-requested-emails-${var.environment}"
67+
}
68+
69+
70+
output "test_template_submitted_email_prefix" {
71+
value = "template-submitted-emails-${var.environment}"
6772
}

infrastructure/terraform/components/sandbox/ses_receipt_rule.tf renamed to infrastructure/terraform/components/sandbox/ses_receipt_rule_proof_requested.tf

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,17 @@
1-
resource "aws_ses_receipt_rule" "main" {
2-
name = "${local.csi}-store-email-sandbox"
1+
resource "aws_ses_receipt_rule" "proof_requested" {
2+
name = "${local.csi}-store-email-proof-requested"
33
rule_set_name = local.acct["ses_testing_config"].rule_set_name
44

55
# Despite being called "recipients", AWS appears to apply this check to the sender email
6-
recipients = [local.sandbox_letter_supplier_mock_sender]
6+
recipients = [local.sandbox_letter_supplier_mock_proof_requested_sender]
77
enabled = true
88
scan_enabled = true
99
tls_policy = "Optional"
1010

1111
s3_action {
1212
position = 1
1313
bucket_name = local.acct["ses_testing_config"].bucket_name
14-
object_key_prefix = "emails-${var.environment}/"
14+
object_key_prefix = "proof-requested-emails-${var.environment}/"
1515
iam_role_arn = local.acct["ses_testing_config"].iam_role_arn
1616
}
1717
}

‎infrastructure/terraform/components/sandbox/ses_receipt_rule_template_submitted.tf‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
resource "aws_ses_receipt_rule" "template_submitted" {
2+
name = "${local.csi}-store-email-template-submitted"
3+
rule_set_name = local.acct["ses_testing_config"].rule_set_name
4+
5+
# Despite being called "recipients", AWS appears to apply this check to the sender email
6+
recipients = [local.sandbox_letter_supplier_mock_template_submitted_sender]
7+
enabled = true
8+
scan_enabled = true
9+
tls_policy = "Optional"
10+
11+
s3_action {
12+
position = 1
13+
bucket_name = local.acct["ses_testing_config"].bucket_name
14+
object_key_prefix = "template-submitted-emails-${var.environment}/"
15+
iam_role_arn = local.acct["ses_testing_config"].iam_role_arn
16+
}
17+
}

‎infrastructure/terraform/modules/backend-api/README.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ No requirements.
2929
| <a name="input_module"></a> [module](#input\_module) | The variable encapsulating the name of this module | `string` | `"api"` | no |
3030
| <a name="input_parent_acct_environment"></a> [parent\_acct\_environment](#input\_parent\_acct\_environment) | Name of the environment responsible for the acct resources used | `string` | n/a | yes |
3131
| <a name="input_project"></a> [project](#input\_project) | The name of the tfscaffold project | `string` | n/a | yes |
32+
| <a name="input_proof_requested_sender_email_address"></a> [proof\_requested\_sender\_email\_address](#input\_proof\_requested\_sender\_email\_address) | Proof requested sender email address | `string` | n/a | yes |
3233
| <a name="input_region"></a> [region](#input\_region) | The AWS Region | `string` | n/a | yes |
3334
| <a name="input_send_to_firehose"></a> [send\_to\_firehose](#input\_send\_to\_firehose) | Flag indicating whether logs should be sent to firehose | `bool` | n/a | yes |
3435
| <a name="input_template_submitted_sender_email_address"></a> [template\_submitted\_sender\_email\_address](#input\_template\_submitted\_sender\_email\_address) | Template submitted sender email address | `string` | n/a | yes |
@@ -45,9 +46,9 @@ No requirements.
4546
| <a name="module_lambda_copy_scanned_object_to_internal"></a> [lambda\_copy\_scanned\_object\_to\_internal](#module\_lambda\_copy\_scanned\_object\_to\_internal) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.4 |
4647
| <a name="module_lambda_delete_failed_scanned_object"></a> [lambda\_delete\_failed\_scanned\_object](#module\_lambda\_delete\_failed\_scanned\_object) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.4 |
4748
| <a name="module_lambda_process_proof"></a> [lambda\_process\_proof](#module\_lambda\_process\_proof) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.4 |
48-
| <a name="module_lambda_send_letter_proof"></a> [lambda\_send\_letter\_proof](#module\_lambda\_send\_letter\_proof) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.4 |
4949
| <a name="module_lambda_set_file_virus_scan_status_for_upload"></a> [lambda\_set\_file\_virus\_scan\_status\_for\_upload](#module\_lambda\_set\_file\_virus\_scan\_status\_for\_upload) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.4 |
5050
| <a name="module_lambda_sftp_poll"></a> [lambda\_sftp\_poll](#module\_lambda\_sftp\_poll) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.4 |
51+
| <a name="module_lambda_sftp_request_proof"></a> [lambda\_sftp\_request\_proof](#module\_lambda\_sftp\_request\_proof) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.4 |
5152
| <a name="module_lambda_validate_letter_template_files"></a> [lambda\_validate\_letter\_template\_files](#module\_lambda\_validate\_letter\_template\_files) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.4 |
5253
| <a name="module_list_template_lambda"></a> [list\_template\_lambda](#module\_list\_template\_lambda) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.4 |
5354
| <a name="module_request_proof_lambda"></a> [request\_proof\_lambda](#module\_request\_proof\_lambda) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.4 |
@@ -70,7 +71,7 @@ No requirements.
7071
| <a name="output_download_bucket_regional_domain_name"></a> [download\_bucket\_regional\_domain\_name](#output\_download\_bucket\_regional\_domain\_name) | n/a |
7172
| <a name="output_internal_bucket_name"></a> [internal\_bucket\_name](#output\_internal\_bucket\_name) | n/a |
7273
| <a name="output_quarantine_bucket_name"></a> [quarantine\_bucket\_name](#output\_quarantine\_bucket\_name) | n/a |
73-
| <a name="output_send_proof_queue_url"></a> [send\_proof\_queue\_url](#output\_send\_proof\_queue\_url) | n/a |
74+
| <a name="output_request_proof_queue_url"></a> [request\_proof\_queue\_url](#output\_request\_proof\_queue\_url) | n/a |
7475
| <a name="output_sftp_environment"></a> [sftp\_environment](#output\_sftp\_environment) | n/a |
7576
| <a name="output_sftp_mock_credential_path"></a> [sftp\_mock\_credential\_path](#output\_sftp\_mock\_credential\_path) | n/a |
7677
| <a name="output_sftp_poll_lambda_name"></a> [sftp\_poll\_lambda\_name](#output\_sftp\_poll\_lambda\_name) | n/a |

infrastructure/terraform/modules/backend-api/module_lambda_send_letter_proof.tf renamed to infrastructure/terraform/modules/backend-api/module_lambda_sftp_request_proof.tf

Lines changed: 31 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
module "lambda_send_letter_proof" {
1+
module "lambda_sftp_request_proof" {
22
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda?ref=v2.0.4"
33

44
project = var.project
@@ -9,30 +9,32 @@ module "lambda_send_letter_proof" {
99

1010
kms_key_arn = var.kms_key_arn
1111

12-
function_name = "send-letter-proof"
12+
function_name = "sftp-request-proof"
1313

14-
function_module_name = "send-proof"
14+
function_module_name = "sftp-request-proof"
1515
handler_function_name = "handler"
16-
description = "Send proof and test data to letter supplier via SFTP"
16+
description = "Send template and test data to letter supplier via SFTP to request a proof"
1717

1818
memory = 512
1919
timeout = 20
2020
runtime = "nodejs20.x"
2121

2222
log_retention_in_days = var.log_retention_in_days
2323
iam_policy_document = {
24-
body = data.aws_iam_policy_document.send_letter_proof.json
24+
body = data.aws_iam_policy_document.sftp_request_proof.json
2525
}
2626

2727
lambda_env_vars = {
28-
CREDENTIALS_TTL_SECONDS = 900
29-
CSI = local.csi
30-
INTERNAL_BUCKET_NAME = module.s3bucket_internal.id
31-
NODE_OPTIONS = "--enable-source-maps",
32-
REGION = var.region
33-
SEND_LOCK_TTL_MS = 50 * 1000 # this must be less than the visibility timeout
34-
SFTP_ENVIRONMENT = local.sftp_environment
35-
TEMPLATES_TABLE_NAME = aws_dynamodb_table.templates.name
28+
CREDENTIALS_TTL_SECONDS = 900
29+
CSI = local.csi
30+
INTERNAL_BUCKET_NAME = module.s3bucket_internal.id
31+
NODE_OPTIONS = "--enable-source-maps",
32+
REGION = var.region
33+
SEND_LOCK_TTL_MS = 50 * 1000 # this must be less than the visibility timeout
34+
SFTP_ENVIRONMENT = local.sftp_environment
35+
TEMPLATES_TABLE_NAME = aws_dynamodb_table.templates.name
36+
PROOF_REQUESTED_SENDER_EMAIL_ADDRESS = var.proof_requested_sender_email_address
37+
SUPPLIER_RECIPIENT_EMAIL_ADDRESSES = jsonencode({ for k, v in var.letter_suppliers : k => v.email_addresses })
3638
}
3739

3840
function_s3_bucket = var.function_s3_bucket
@@ -49,9 +51,9 @@ module "lambda_send_letter_proof" {
4951
log_subscription_role_arn = var.log_subscription_role_arn
5052
}
5153

52-
resource "aws_lambda_event_source_mapping" "send_letter_proof" {
54+
resource "aws_lambda_event_source_mapping" "sftp_request_proof" {
5355
event_source_arn = module.sqs_sftp_upload.sqs_queue_arn
54-
function_name = module.lambda_send_letter_proof.function_name
56+
function_name = module.lambda_sftp_request_proof.function_name
5557
batch_size = 5
5658
maximum_batching_window_in_seconds = 0
5759
function_response_types = [
@@ -63,7 +65,7 @@ resource "aws_lambda_event_source_mapping" "send_letter_proof" {
6365
}
6466
}
6567

66-
data "aws_iam_policy_document" "send_letter_proof" {
68+
data "aws_iam_policy_document" "sftp_request_proof" {
6769
statement {
6870
sid = "AllowDynamoAccess"
6971
effect = "Allow"
@@ -187,4 +189,17 @@ data "aws_iam_policy_document" "send_letter_proof" {
187189
"*"
188190
]
189191
}
192+
193+
statement {
194+
sid = "AllowSESAccess"
195+
effect = "Allow"
196+
197+
actions = ["ses:SendRawEmail"]
198+
199+
resources = flatten([
200+
"arn:aws:ses:${var.region}:${var.aws_account_id}:identity/${var.proof_requested_sender_email_address}",
201+
"arn:aws:ses:${var.region}:${var.aws_account_id}:identity/${var.email_domain}",
202+
[for k, v in var.letter_suppliers : [for email in v.email_addresses : "arn:aws:ses:${var.region}:${var.aws_account_id}:identity/${email}"]]
203+
])
204+
}
190205
}

‎infrastructure/terraform/modules/backend-api/outputs.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ output "internal_bucket_name" {
1818
value = module.s3bucket_internal.id
1919
}
2020

21-
output "send_proof_queue_url" {
21+
output "request_proof_queue_url" {
2222
value = module.sqs_sftp_upload.sqs_queue_url
2323
}
2424

0 commit comments

Comments
 (0)