Skip to content

Commit faaafe7

Browse files
harrim91harrim91
committed
Merge branch 'main' into feature/CCM-11965_letter-template-preview-content-changes
2 parents 3c18a56 + 0db3cda commit faaafe7

File tree

14 files changed

+382
-138
lines changed

14 files changed

+382
-138
lines changed

‎infrastructure/terraform/components/sandbox/module_backend_api.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ module "backend_api" {
3131

3232
send_to_firehose = false
3333

34-
enable_event_stream = true
34+
enable_routing_config_event_stream = true
3535

3636
email_domain = local.email_domain
3737
template_submitted_sender_email_address = local.sandbox_letter_supplier_mock_template_submitted_sender

‎infrastructure/terraform/modules/backend-api/README.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@ No requirements.
1616
| <a name="input_csi"></a> [csi](#input\_csi) | CSI from the parent component | `string` | n/a | yes |
1717
| <a name="input_email_domain"></a> [email\_domain](#input\_email\_domain) | Email domain | `string` | n/a | yes |
1818
| <a name="input_enable_backup"></a> [enable\_backup](#input\_enable\_backup) | Enable Backups for the DynamoDB table? | `bool` | `true` | no |
19-
| <a name="input_enable_event_stream"></a> [enable\_event\_stream](#input\_enable\_event\_stream) | Enable DynamoDB streaming to EventBridge | `bool` | `true` | no |
19+
| <a name="input_enable_routing_config_event_stream"></a> [enable\_routing\_config\_event\_stream](#input\_enable\_routing\_config\_event\_stream) | Enable DynamoDB streaming from routing config table to EventBridge | `bool` | `false` | no |
2020
| <a name="input_environment"></a> [environment](#input\_environment) | The name of the tfscaffold environment | `string` | n/a | yes |
2121
| <a name="input_function_s3_bucket"></a> [function\_s3\_bucket](#input\_function\_s3\_bucket) | Name of S3 bucket to upload lambda artefacts to | `string` | n/a | yes |
2222
| <a name="input_group"></a> [group](#input\_group) | The group variables are being inherited from (often synonmous with account short-name) | `string` | n/a | yes |
@@ -60,6 +60,7 @@ No requirements.
6060
| <a name="module_s3bucket_download"></a> [s3bucket\_download](#module\_s3bucket\_download) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-s3bucket.zip | n/a |
6161
| <a name="module_s3bucket_internal"></a> [s3bucket\_internal](#module\_s3bucket\_internal) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-s3bucket.zip | n/a |
6262
| <a name="module_s3bucket_quarantine"></a> [s3bucket\_quarantine](#module\_s3bucket\_quarantine) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-s3bucket.zip | n/a |
63+
| <a name="module_sqs_routing_config_table_events_pipe_dlq"></a> [sqs\_routing\_config\_table\_events\_pipe\_dlq](#module\_sqs\_routing\_config\_table\_events\_pipe\_dlq) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-sqs.zip | n/a |
6364
| <a name="module_sqs_sftp_upload"></a> [sqs\_sftp\_upload](#module\_sqs\_sftp\_upload) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-sqs.zip | n/a |
6465
| <a name="module_sqs_template_mgmt_events"></a> [sqs\_template\_mgmt\_events](#module\_sqs\_template\_mgmt\_events) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-sqs.zip | n/a |
6566
| <a name="module_sqs_template_table_events_pipe_dlq"></a> [sqs\_template\_table\_events\_pipe\_dlq](#module\_sqs\_template\_table\_events\_pipe\_dlq) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-sqs.zip | n/a |

‎infrastructure/terraform/modules/backend-api/cloudwatch_log_group_pipe_routing_config_table_events.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
resource "aws_cloudwatch_log_group" "pipe_routing_config_table_events" {
2+
name = "/aws/vendedlogs/pipes/${local.csi}-routing-config-table-events"
3+
kms_key_id = var.kms_key_arn
4+
retention_in_days = var.log_retention_in_days
5+
}

‎infrastructure/terraform/modules/backend-api/module_lambda_event_publisher.tf‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,10 @@ module "lambda_event_publisher" {
2525
}
2626

2727
lambda_env_vars = {
28-
SNS_TOPIC_ARN = coalesce(var.sns_topic_arn, aws_sns_topic.main.arn)
29-
TEMPLATES_TABLE_NAME = aws_dynamodb_table.templates.name
30-
EVENT_SOURCE = "//notify.nhs.uk/${var.component}/${var.group}/${var.environment}"
28+
EVENT_SOURCE = "//notify.nhs.uk/${var.component}/${var.group}/${var.environment}"
29+
ROUTING_CONFIG_TABLE_NAME = aws_dynamodb_table.routing_configuration.name
30+
SNS_TOPIC_ARN = coalesce(var.sns_topic_arn, aws_sns_topic.main.arn)
31+
TEMPLATES_TABLE_NAME = aws_dynamodb_table.templates.name
3132
}
3233

3334
function_s3_bucket = var.function_s3_bucket

‎infrastructure/terraform/modules/backend-api/module_sqs_routing_config_table_events_pipe_dlq.tf‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
module "sqs_routing_config_table_events_pipe_dlq" {
2+
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-sqs.zip"
3+
4+
aws_account_id = var.aws_account_id
5+
component = var.component
6+
environment = var.environment
7+
project = var.project
8+
region = var.region
9+
name = "routing-config-table-events-pipe-dead-letter"
10+
sqs_kms_key_arn = var.kms_key_arn
11+
}

‎infrastructure/terraform/modules/backend-api/pipes_pipe_routing_config_table_events.tf‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
resource "aws_pipes_pipe" "routing_config_table_events" {
2+
depends_on = [module.sqs_routing_config_table_events_pipe_dlq]
3+
4+
name = "${local.csi}-routing-config-table-events"
5+
role_arn = aws_iam_role.pipe_routing_config_table_events.arn
6+
source = aws_dynamodb_table.routing_configuration.stream_arn
7+
target = module.sqs_template_mgmt_events.sqs_queue_arn
8+
desired_state = var.enable_routing_config_event_stream ? "RUNNING" : "STOPPED"
9+
kms_key_identifier = var.kms_key_arn
10+
11+
source_parameters {
12+
dynamodb_stream_parameters {
13+
starting_position = "TRIM_HORIZON"
14+
on_partial_batch_item_failure = "AUTOMATIC_BISECT"
15+
batch_size = 10
16+
maximum_batching_window_in_seconds = 5
17+
maximum_retry_attempts = 5
18+
maximum_record_age_in_seconds = -1
19+
20+
dead_letter_config {
21+
arn = module.sqs_routing_config_table_events_pipe_dlq.sqs_queue_arn
22+
}
23+
}
24+
}
25+
26+
target_parameters {
27+
input_template = <<-EOF
28+
{
29+
"dynamodb": <$.dynamodb>,
30+
"eventID": <$.eventID>,
31+
"eventName": <$.eventName>,
32+
"eventSource": <$.eventSource>,
33+
"tableName": "${aws_dynamodb_table.routing_configuration.name}"
34+
}
35+
EOF
36+
37+
sqs_queue_parameters {
38+
message_group_id = "$.dynamodb.Keys.id.S"
39+
message_deduplication_id = "$.eventID"
40+
}
41+
}
42+
43+
log_configuration {
44+
level = "ERROR"
45+
include_execution_data = ["ALL"]
46+
47+
cloudwatch_logs_log_destination {
48+
log_group_arn = aws_cloudwatch_log_group.pipe_routing_config_table_events.arn
49+
}
50+
}
51+
}
52+
53+
resource "aws_iam_role" "pipe_routing_config_table_events" {
54+
name = "${local.csi}-pipe-routing-config-table-events"
55+
description = "IAM Role for Pipe to forward routing config table stream events to SQS"
56+
assume_role_policy = data.aws_iam_policy_document.pipes_routing_config_trust_policy.json
57+
}
58+
59+
data "aws_iam_policy_document" "pipes_routing_config_trust_policy" {
60+
statement {
61+
sid = "PipesAssumeRole"
62+
effect = "Allow"
63+
actions = ["sts:AssumeRole"]
64+
65+
principals {
66+
type = "Service"
67+
identifiers = ["pipes.amazonaws.com"]
68+
}
69+
}
70+
}
71+
72+
resource "aws_iam_role_policy" "pipe_routing_config_table_events" {
73+
name = "${local.csi}-pipe-routing-config-table-events"
74+
role = aws_iam_role.pipe_routing_config_table_events.id
75+
policy = data.aws_iam_policy_document.pipe_routing_config_table_events.json
76+
}
77+
78+
data "aws_iam_policy_document" "pipe_routing_config_table_events" {
79+
version = "2012-10-17"
80+
81+
statement {
82+
sid = "AllowDynamoStreamRead"
83+
effect = "Allow"
84+
actions = [
85+
"dynamodb:DescribeStream",
86+
"dynamodb:GetRecords",
87+
"dynamodb:GetShardIterator",
88+
"dynamodb:ListStreams",
89+
]
90+
resources = [aws_dynamodb_table.routing_configuration.stream_arn]
91+
}
92+
93+
statement {
94+
sid = "AllowSqsSendMessage"
95+
effect = "Allow"
96+
actions = ["sqs:SendMessage"]
97+
resources = [
98+
module.sqs_template_mgmt_events.sqs_queue_arn,
99+
module.sqs_routing_config_table_events_pipe_dlq.sqs_queue_arn,
100+
]
101+
}
102+
103+
statement {
104+
sid = "AllowKmsUsage"
105+
effect = "Allow"
106+
actions = [
107+
"kms:Decrypt",
108+
"kms:Encrypt",
109+
"kms:GenerateDataKey*"
110+
]
111+
resources = [var.kms_key_arn]
112+
}
113+
}

‎infrastructure/terraform/modules/backend-api/pipes_pipe_template_table_events.tf‎

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ resource "aws_pipes_pipe" "template_table_events" {
55
role_arn = aws_iam_role.pipe_template_table_events.arn
66
source = aws_dynamodb_table.templates.stream_arn
77
target = module.sqs_template_mgmt_events.sqs_queue_arn
8-
desired_state = var.enable_event_stream ? "RUNNING" : "STOPPED"
8+
desired_state = "RUNNING"
99
kms_key_identifier = var.kms_key_arn
1010

1111
source_parameters {
@@ -24,7 +24,15 @@ resource "aws_pipes_pipe" "template_table_events" {
2424
}
2525

2626
target_parameters {
27-
input_template = "{\"dynamodb\": <$.dynamodb>,\"eventID\": <$.eventID>,\"eventName\": <$.eventName>,\"eventSource\": <$.eventSource>,\"tableName\": \"${aws_dynamodb_table.templates.name}\"}"
27+
input_template = <<-EOF
28+
{
29+
"dynamodb": <$.dynamodb>,
30+
"eventID": <$.eventID>,
31+
"eventName": <$.eventName>,
32+
"eventSource": <$.eventSource>,
33+
"tableName": "${aws_dynamodb_table.templates.name}"
34+
}
35+
EOF
2836

2937
sqs_queue_parameters {
3038
message_group_id = "$.dynamodb.Keys.id.S"
@@ -44,11 +52,11 @@ resource "aws_pipes_pipe" "template_table_events" {
4452

4553
resource "aws_iam_role" "pipe_template_table_events" {
4654
name = "${local.csi}-pipe-template-table-events"
47-
description = "IAM Role for Pipe forward template table stream events to SQS"
48-
assume_role_policy = data.aws_iam_policy_document.pipes_trust_policy.json
55+
description = "IAM Role for Pipe to forward template table stream events to SQS"
56+
assume_role_policy = data.aws_iam_policy_document.pipes_templates_trust_policy.json
4957
}
5058

51-
data "aws_iam_policy_document" "pipes_trust_policy" {
59+
data "aws_iam_policy_document" "pipes_templates_trust_policy" {
5260
statement {
5361
sid = "PipesAssumeRole"
5462
effect = "Allow"

‎infrastructure/terraform/modules/backend-api/variables.tf‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -71,10 +71,10 @@ variable "enable_backup" {
7171
default = true
7272
}
7373

74-
variable "enable_event_stream" {
74+
variable "enable_routing_config_event_stream" {
7575
type = bool
76-
description = "Enable DynamoDB streaming to EventBridge"
77-
default = true
76+
description = "Enable DynamoDB streaming from routing config table to EventBridge"
77+
default = false
7878
}
7979

8080
variable "kms_key_arn" {

0 commit comments

Comments
 (0)