Skip to content

Commit ea00d73

Browse files
alexnuttallalexnuttall
committed
back to shared lamdba mod, again
1 parent 3ba4acc commit ea00d73

File tree

11 files changed

+316
-57
lines changed

11 files changed

+316
-57
lines changed

‎infrastructure/terraform/components/acct/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
| <a name="module_kms_sandbox"></a> [kms\_sandbox](#module\_kms\_sandbox) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/kms | v1.0.8 |
3737
| <a name="module_obs_datasource"></a> [obs\_datasource](#module\_obs\_datasource) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/obs-datasource | v2.0.3 |
3838
| <a name="module_s3bucket_access_logs"></a> [s3bucket\_access\_logs](#module\_s3bucket\_access\_logs) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.9 |
39+
| <a name="module_s3bucket_artefacts"></a> [s3bucket\_artefacts](#module\_s3bucket\_artefacts) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v2.0.2 |
3940
| <a name="module_s3bucket_backup_reports"></a> [s3bucket\_backup\_reports](#module\_s3bucket\_backup\_reports) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket | v1.0.8 |
4041
| <a name="module_vpc"></a> [vpc](#module\_vpc) | terraform-aws-modules/vpc/aws | 5.19.0 |
4142
## Outputs

‎infrastructure/terraform/components/acct/module_s3bucket_artefacts.tf‎

Lines changed: 130 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,130 @@
1+
module "s3bucket_artefacts" {
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/s3bucket?ref=v2.0.2"
3+
4+
name = "artefacts"
5+
6+
aws_account_id = var.aws_account_id
7+
region = var.region
8+
project = var.project
9+
environment = var.environment
10+
component = var.component
11+
12+
acl = "private"
13+
force_destroy = false
14+
versioning = true
15+
16+
lifecycle_rules = [
17+
{
18+
prefix = ""
19+
enabled = true
20+
21+
noncurrent_version_transition = [
22+
{
23+
noncurrent_days = "30"
24+
storage_class = "STANDARD_IA"
25+
}
26+
]
27+
28+
noncurrent_version_expiration = {
29+
noncurrent_days = "90"
30+
}
31+
32+
abort_incomplete_multipart_upload = {
33+
days = "1"
34+
}
35+
}
36+
]
37+
38+
policy_documents = [
39+
data.aws_iam_policy_document.s3bucket_artefacts.json
40+
]
41+
42+
bucket_logging_target = {
43+
bucket = module.s3bucket_access_logs.id
44+
}
45+
46+
public_access = {
47+
block_public_acls = true
48+
block_public_policy = true
49+
ignore_public_acls = true
50+
restrict_public_buckets = true
51+
}
52+
53+
54+
default_tags = {
55+
Name = "Artefact bucket"
56+
}
57+
}
58+
59+
data "aws_iam_policy_document" "s3bucket_artefacts" {
60+
statement {
61+
sid = "DontAllowNonSecureConnection"
62+
effect = "Deny"
63+
64+
actions = [
65+
"s3:*",
66+
]
67+
68+
resources = [
69+
module.s3bucket_artefacts.arn,
70+
"${module.s3bucket_artefacts.arn}/*",
71+
]
72+
73+
principals {
74+
type = "AWS"
75+
76+
identifiers = [
77+
"*",
78+
]
79+
}
80+
81+
condition {
82+
test = "Bool"
83+
variable = "aws:SecureTransport"
84+
85+
values = [
86+
"false",
87+
]
88+
}
89+
}
90+
91+
statement {
92+
sid = "AllowManagedAccountsToList"
93+
effect = "Allow"
94+
95+
actions = [
96+
"s3:ListBucket",
97+
]
98+
99+
resources = [
100+
module.s3bucket_artefacts.arn,
101+
]
102+
103+
principals {
104+
type = "AWS"
105+
identifiers = [
106+
"arn:aws:iam::${var.aws_account_id}:root"
107+
]
108+
}
109+
}
110+
111+
statement {
112+
sid = "AllowManagedAccountsToGet"
113+
effect = "Allow"
114+
115+
actions = [
116+
"s3:GetObject",
117+
]
118+
119+
resources = [
120+
"${module.s3bucket_artefacts.arn}/*",
121+
]
122+
123+
principals {
124+
type = "AWS"
125+
identifiers = [
126+
"arn:aws:iam::${var.aws_account_id}:root"
127+
]
128+
}
129+
}
130+
}

‎infrastructure/terraform/components/acct/outputs.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,11 @@ output "github_pat_ssm_param_name" {
1212

1313
output "s3_buckets" {
1414
value = {
15+
artefacts = {
16+
arn = module.s3bucket_artefacts.arn
17+
bucket = module.s3bucket_artefacts.bucket
18+
id = module.s3bucket_artefacts.id
19+
}
1520
backup_reports = {
1621
arn = module.s3bucket_backup_reports.arn
1722
bucket = module.s3bucket_backup_reports.bucket

‎infrastructure/terraform/components/app/README.md‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,7 @@
5151
|------|--------|---------|
5252
| <a name="module_amplify_branch"></a> [amplify\_branch](#module\_amplify\_branch) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/amp_branch | v1.0.0 |
5353
| <a name="module_backend_api"></a> [backend\_api](#module\_backend\_api) | ../../modules/backend-api | n/a |
54-
| <a name="module_download_authorizer_build"></a> [download\_authorizer\_build](#module\_download\_authorizer\_build) | ../../modules/typescript-build-zip | n/a |
55-
| <a name="module_download_authorizer_lambda"></a> [download\_authorizer\_lambda](#module\_download\_authorizer\_lambda) | ../../modules/lambda-function | n/a |
54+
| <a name="module_download_authorizer_lambda"></a> [download\_authorizer\_lambda](#module\_download\_authorizer\_lambda) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda | v2.0.2 |
5655
| <a name="module_eventpub"></a> [eventpub](#module\_eventpub) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/eventpub | v1.0.13 |
5756
| <a name="module_kms"></a> [kms](#module\_kms) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/kms | v1.0.8 |
5857
| <a name="module_nhse_backup_vault"></a> [nhse\_backup\_vault](#module\_nhse\_backup\_vault) | git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/aws-backup-source | v1.0.8 |

‎infrastructure/terraform/components/app/module_download_authorizer_lambda.tf‎

Lines changed: 24 additions & 47 deletions
Original file line numberDiff line numberDiff line change
@@ -1,60 +1,37 @@
11
module "download_authorizer_lambda" {
2-
source = "../../modules/lambda-function"
3-
description = "templates api download authorizer"
4-
5-
function_name = "${local.csi}-download-authorizer"
6-
filename = module.download_authorizer_build.zips[local.authorizer_entrypoint].path
7-
source_code_hash = module.download_authorizer_build.zips[local.authorizer_entrypoint].base64sha256
8-
runtime = "nodejs20.x"
9-
handler = "index.handler"
10-
publish = true
11-
12-
log_retention_in_days = var.log_retention_in_days
13-
# source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda?ref=v2.0.2"
2+
source = "git::https://github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/modules/lambda?ref=v2.0.2"
143

154
providers = {
165
aws = aws.us-east-1
176
}
187

19-
# function_name = "download-authorizer"
20-
# description = "Download authorizer for s3 download bucket"
21-
22-
# aws_account_id = var.aws_account_id
23-
# component = var.component
24-
# environment = var.environment
25-
# project = var.project
26-
# region = "us-east-1"
27-
# group = var.group
28-
29-
# log_retention_in_days = var.log_retention_in_days
30-
# kms_key_arn = module.kms.key_arn
8+
function_name = "download-authorizer"
9+
description = "Download authorizer for s3 download bucket"
3110

32-
# iam_policy_document = {
33-
# body = data.aws_iam_policy_document.authorizer.json
34-
# }
11+
aws_account_id = var.aws_account_id
12+
component = var.component
13+
environment = var.environment
14+
project = var.project
15+
region = "us-east-1"
16+
group = var.group
3517

36-
# function_s3_bucket = local.acct.s3_buckets["artefacts"]["id"]
37-
# function_code_base_path = local.lambdas_source_code_dir
38-
# function_code_dir = "download-authorizer/dist"
39-
# handler_function_name = "handler"
40-
# runtime = "nodejs20.x"
41-
# memory = 128
42-
# timeout = 3
43-
# lambda_at_edge = true
44-
# enable_lambda_insights = false
45-
# force_lambda_code_deploy = true
46-
}
47-
48-
// temp
49-
module "download_authorizer_build" {
50-
source = "../../modules/typescript-build-zip"
18+
log_retention_in_days = var.log_retention_in_days
19+
kms_key_arn = module.kms.key_arn
5120

52-
source_code_dir = "${local.lambdas_source_code_dir}/authorizer"
53-
entrypoints = [local.authorizer_entrypoint]
54-
}
21+
iam_policy_document = {
22+
body = data.aws_iam_policy_document.authorizer.json
23+
}
5524

56-
locals {
57-
authorizer_entrypoint = "src/index.ts"
25+
function_s3_bucket = local.acct.s3_buckets["artefacts"]["id"]
26+
function_code_base_path = local.lambdas_source_code_dir
27+
function_code_dir = "download-authorizer/dist"
28+
handler_function_name = "handler"
29+
runtime = "nodejs20.x"
30+
memory = 128
31+
timeout = 3
32+
lambda_at_edge = true
33+
enable_lambda_insights = false
34+
force_lambda_code_deploy = true
5835
}
5936

6037
data "aws_iam_policy_document" "authorizer" {

‎infrastructure/terraform/components/app/pre.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,6 @@ npm ci
22

33
npm run generate-dependencies --workspaces --if-present
44

5+
npm run lambda-build --workspaces --if-present
6+
57
$(git rev-parse --show-toplevel)/lambdas/layers/pdfjs/build.sh

‎infrastructure/terraform/modules/lambda-function/README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ No requirements.
1919
| <a name="input_layer_arns"></a> [layer\_arns](#input\_layer\_arns) | List of Lambda Layer Version ARNs (maximum of 5) to attach to your Lambda Function. | `list(string)` | `null` | no |
2020
| <a name="input_log_retention_in_days"></a> [log\_retention\_in\_days](#input\_log\_retention\_in\_days) | Specifies the number of days you want to retain log events in the log group for this Lambda | `number` | `0` | no |
2121
| <a name="input_memory_size"></a> [memory\_size](#input\_memory\_size) | Lambda memory size | `number` | `128` | no |
22-
| <a name="input_publish"></a> [publish](#input\_publish) | Whether to publish creation/change as new Lambda Function Version | `bool` | `false` | no |
2322
| <a name="input_runtime"></a> [runtime](#input\_runtime) | Identifier of the function's runtime | `string` | `"nodejs20.x"` | no |
2423
| <a name="input_source_code_hash"></a> [source\_code\_hash](#input\_source\_code\_hash) | Base64-encoded SHA256 hash of the package file specified by `filename` | `string` | n/a | yes |
2524
| <a name="input_sqs_event_source_mapping"></a> [sqs\_event\_source\_mapping](#input\_sqs\_event\_source\_mapping) | Configuration for SQS event source mapping | <pre>object({<br/> sqs_queue_arn = string<br/> batch_size = optional(number, 10)<br/> maximum_batching_window_in_seconds = optional(number, 0)<br/> scaling_config = optional(object({<br/> maximum_concurrency = number<br/> }), null)<br/> })</pre> | `null` | no |

‎infrastructure/terraform/modules/lambda-function/lambda_function_main.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,6 @@ resource "aws_lambda_function" "main" {
99
memory_size = var.memory_size
1010
layers = var.layer_arns
1111
timeout = var.timeout
12-
publish = var.publish
1312

1413
environment {
1514
variables = var.environment_variables

‎infrastructure/terraform/modules/lambda-function/variables.tf‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -94,9 +94,3 @@ variable "sqs_event_source_mapping" {
9494
})
9595
default = null
9696
}
97-
98-
variable "publish" {
99-
type = bool
100-
description = "Whether to publish creation/change as new Lambda Function Version"
101-
default = false
102-
}

0 commit comments

Comments
 (0)