Skip to content

Commit 58305e5

Browse files
masl2masl2
committed
Merge branch 'main' into fix/CCM-14508-metricsNotTracked 
2 parents 29295a2 + bbfa920 commit 58305e5

52 files changed

Lines changed: 798 additions & 340 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/workflows/manual-proxy-environment-deploy.yaml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,11 +36,10 @@ jobs:
3636
node-version: 22
3737

3838
- name: Npm install
39-
working-directory: .
40-
env:
41-
NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
42-
run: npm ci
43-
shell: bash
39+
uses: ./.github/actions/node-install
40+
with:
41+
node-version: 22
42+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
4443

4544
- name: "Check if pull request exists for this branch and set ENVIRONMENT/APIM_ENV"
4645
id: pr_exists

‎infrastructure/terraform/components/api/README.md‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,9 @@ No requirements.
1818
| <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
1919
| <a name="input_disable_gateway_execute_endpoint"></a> [disable\_gateway\_execute\_endpoint](#input\_disable\_gateway\_execute\_endpoint) | Disable the execution endpoint for the API Gateway | `bool` | `true` | no |
2020
| <a name="input_enable_api_data_trace"></a> [enable\_api\_data\_trace](#input\_enable\_api\_data\_trace) | Enable API Gateway data trace logging | `bool` | `false` | no |
21-
| <a name="input_enable_event_cache"></a> [enable\_event\_cache](#input\_enable\_event\_cache) | Enable caching of events to an S3 bucket | `bool` | `false` | no |
22-
| <a name="input_enable_sns_delivery_logging"></a> [enable\_sns\_delivery\_logging](#input\_enable\_sns\_delivery\_logging) | Enable SNS Delivery Failure Notifications | `bool` | `false` | no |
21+
| <a name="input_enable_backups"></a> [enable\_backups](#input\_enable\_backups) | Enable backups | `bool` | `false` | no |
22+
| <a name="input_enable_event_cache"></a> [enable\_event\_cache](#input\_enable\_event\_cache) | Enable caching of events to an S3 bucket | `bool` | `true` | no |
23+
| <a name="input_enable_sns_delivery_logging"></a> [enable\_sns\_delivery\_logging](#input\_enable\_sns\_delivery\_logging) | Enable SNS Delivery Failure Notifications | `bool` | `true` | no |
2324
| <a name="input_environment"></a> [environment](#input\_environment) | The name of the tfscaffold environment | `string` | n/a | yes |
2425
| <a name="input_eventpub_control_plane_bus_arn"></a> [eventpub\_control\_plane\_bus\_arn](#input\_eventpub\_control\_plane\_bus\_arn) | ARN of the EventBridge control plane bus for eventpub | `string` | `""` | no |
2526
| <a name="input_eventpub_data_plane_bus_arn"></a> [eventpub\_data\_plane\_bus\_arn](#input\_eventpub\_data\_plane\_bus\_arn) | ARN of the EventBridge data plane bus for eventpub | `string` | `""` | no |
@@ -42,16 +43,17 @@ No requirements.
4243

4344
| Name | Source | Version |
4445
|------|--------|---------|
46+
| <a name="module_amendment_event_transformer"></a> [amendment\_event\_transformer](#module\_amendment\_event\_transformer) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
47+
| <a name="module_amendments_queue"></a> [amendments\_queue](#module\_amendments\_queue) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
4548
| <a name="module_authorizer_lambda"></a> [authorizer\_lambda](#module\_authorizer\_lambda) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
4649
| <a name="module_domain_truststore"></a> [domain\_truststore](#module\_domain\_truststore) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip | n/a |
47-
| <a name="module_eventpub"></a> [eventpub](#module\_eventpub) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-eventpub.zip | n/a |
50+
| <a name="module_eventpub"></a> [eventpub](#module\_eventpub) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.31/terraform-eventpub.zip | n/a |
4851
| <a name="module_eventsub"></a> [eventsub](#module\_eventsub) | ../../modules/eventsub | n/a |
4952
| <a name="module_get_letter"></a> [get\_letter](#module\_get\_letter) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5053
| <a name="module_get_letter_data"></a> [get\_letter\_data](#module\_get\_letter\_data) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5154
| <a name="module_get_letters"></a> [get\_letters](#module\_get\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5255
| <a name="module_get_status"></a> [get\_status](#module\_get\_status) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5356
| <a name="module_kms"></a> [kms](#module\_kms) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-kms.zip | n/a |
54-
| <a name="module_letter_status_update"></a> [letter\_status\_update](#module\_letter\_status\_update) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5557
| <a name="module_letter_status_updates_queue"></a> [letter\_status\_updates\_queue](#module\_letter\_status\_updates\_queue) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
5658
| <a name="module_letter_updates_transformer"></a> [letter\_updates\_transformer](#module\_letter\_updates\_transformer) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5759
| <a name="module_logging_bucket"></a> [logging\_bucket](#module\_logging\_bucket) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip | n/a |

‎infrastructure/terraform/components/api/event_source_mapping_status_updates_to_handler.tf‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
resource "aws_lambda_event_source_mapping" "status_updates_sqs_to_status_update_handler" {
2-
event_source_arn = module.letter_status_updates_queue.sqs_queue_arn
3-
function_name = module.letter_status_update.function_arn
2+
event_source_arn = module.amendments_queue.sqs_queue_arn
3+
function_name = module.amendment_event_transformer.function_arn
44
batch_size = 10
55
maximum_batching_window_in_seconds = 1
66
scaling_config { maximum_concurrency = 10 }
77

88
depends_on = [
9-
module.letter_status_updates_queue, # ensures queue exists
10-
module.letter_status_update # ensures update handler exists
9+
module.amendments_queue, # ensures queue exists
10+
module.amendment_event_transformer # ensures update handler exists
1111
]
1212
}

‎infrastructure/terraform/components/api/glue_catalog_database_supplier.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
resource "aws_glue_catalog_database" "supplier" {
2+
name = "${local.csi}-supplier"
3+
description = "Glue catalog database for Suppliers API"
4+
}

‎infrastructure/terraform/components/api/glue_crawler_event_crawler.tf‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
resource "aws_glue_crawler" "event_crawler" {
2+
count = local.event_cache_bucket_name != null ? 1 : 0
3+
name = "${local.csi}-audit-event-crawler"
4+
database_name = aws_glue_catalog_database.supplier.name
5+
role = aws_iam_role.glue_role.arn
6+
7+
table_prefix = ""
8+
s3_target {
9+
path = "s3://${local.event_cache_bucket_name}/"
10+
}
11+
12+
s3_target {
13+
path = "s3://${local.eventsub_event_cache_bucket_name}/"
14+
}
15+
16+
schedule = "cron(0 * * * ? *)"
17+
recrawl_policy {
18+
recrawl_behavior = "CRAWL_NEW_FOLDERS_ONLY"
19+
}
20+
21+
schema_change_policy {
22+
delete_behavior = "LOG"
23+
update_behavior = "LOG"
24+
}
25+
26+
}

‎infrastructure/terraform/components/api/iam_role_glue.tf‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
resource "aws_iam_role" "glue_role" {
2+
name = "${local.csi}-glue-role"
3+
assume_role_policy = data.aws_iam_policy_document.glue_assume_role.json
4+
}
5+
6+
data "aws_iam_policy_document" "glue_assume_role" {
7+
statement {
8+
sid = "AllowGlueServiceAssumeRole"
9+
effect = "Allow"
10+
11+
principals {
12+
type = "Service"
13+
identifiers = ["glue.amazonaws.com"]
14+
}
15+
16+
actions = [
17+
"sts:AssumeRole",
18+
]
19+
}
20+
}
21+
22+
resource "aws_iam_policy" "glue_service_policy" {
23+
name = "${local.csi}-glue-service-policy"
24+
description = "Policy for ${local.csi} Glue Service Role"
25+
policy = data.aws_iam_policy_document.glue_service_policy.json
26+
}
27+
28+
data "aws_iam_policy_document" "glue_service_policy" {
29+
statement {
30+
sid = "AllowGlueLogging"
31+
effect = "Allow"
32+
33+
actions = [
34+
"logs:CreateLogGroup",
35+
"logs:CreateLogStream",
36+
"logs:PutLogEvents"
37+
]
38+
resources = ["arn:aws:logs:*:*:*"]
39+
}
40+
41+
statement {
42+
sid = "AllowListBucketAndGetLocation"
43+
effect = "Allow"
44+
45+
actions = [
46+
"s3:ListBucket",
47+
"s3:GetBucketLocation"
48+
]
49+
50+
resources = [
51+
"arn:aws:s3:::${local.event_cache_bucket_name}",
52+
"arn:aws:s3:::${local.eventsub_event_cache_bucket_name}"
53+
]
54+
}
55+
statement {
56+
sid = "AllowS3Access"
57+
effect = "Allow"
58+
59+
actions = [
60+
"s3:GetObject",
61+
"s3:GetObjectVersion",
62+
"s3:PutObject",
63+
"s3:DeleteObject"
64+
]
65+
resources = [
66+
"arn:aws:s3:::${local.event_cache_bucket_name}/*",
67+
"arn:aws:s3:::${local.eventsub_event_cache_bucket_name}/*"
68+
]
69+
}
70+
statement {
71+
sid = "GlueCatalogAccess"
72+
effect = "Allow"
73+
actions = [
74+
"glue:GetDatabase",
75+
"glue:GetDatabases",
76+
"glue:GetTable",
77+
"glue:GetTables",
78+
"glue:CreateTable",
79+
"glue:UpdateTable",
80+
"glue:CreatePartition",
81+
"glue:BatchCreatePartition",
82+
"glue:GetPartition",
83+
"glue:BatchGetPartition",
84+
"glue:UpdatePartition"
85+
]
86+
resources = ["*"]
87+
}
88+
statement {
89+
sid = "S3TempAndGlueETL"
90+
effect = "Allow"
91+
actions = [
92+
"s3:PutObject",
93+
"s3:GetObject"
94+
]
95+
resources = [
96+
"arn:aws:s3:::aws-glue-*",
97+
"arn:aws:s3:::aws-glue-*/*"
98+
]
99+
}
100+
}
101+
102+
resource "aws_iam_role_policy_attachment" "gllue_attach_policy" {
103+
role = aws_iam_role.glue_role.name
104+
policy_arn = aws_iam_policy.glue_service_policy.arn
105+
}

‎infrastructure/terraform/components/api/lambda_event_source_mapping_amendments.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "aws_lambda_event_source_mapping" "amendment_event_transformer" {
2+
event_source_arn = module.amendments_queue.sqs_queue_arn
3+
function_name = module.amendment_event_transformer.function_name
4+
batch_size = 10
5+
maximum_batching_window_in_seconds = 5
6+
function_response_types = [
7+
"ReportBatchItemFailures"
8+
]
9+
}

‎infrastructure/terraform/components/api/lambda_event_source_mapping_letter_status_update.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "aws_lambda_event_source_mapping" "letter_status_update" {
2+
event_source_arn = module.letter_status_updates_queue.sqs_queue_arn
3+
function_name = module.amendment_event_transformer.function_name
4+
batch_size = 10
5+
maximum_batching_window_in_seconds = 5
6+
function_response_types = [
7+
"ReportBatchItemFailures"
8+
]
9+
}

‎infrastructure/terraform/components/api/locals.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,8 +27,13 @@ locals {
2727
SUPPLIER_ID_HEADER = "nhsd-supplier-id",
2828
APIM_CORRELATION_HEADER = "nhsd-correlation-id",
2929
DOWNLOAD_URL_TTL_SECONDS = 60
30+
SNS_TOPIC_ARN = "${module.eventsub.sns_topic.arn}",
31+
EVENT_SOURCE = "/data-plane/supplier-api/${var.group}/${var.environment}/letters"
3032
}
3133

3234
core_pdf_bucket_arn = "arn:aws:s3:::comms-${var.core_account_id}-eu-west-2-${var.core_environment}-api-stg-pdf-pipeline"
3335
core_s3_kms_key_alias_name = "alias/comms-${var.core_environment}-api-s3"
36+
37+
event_cache_bucket_name = lookup(module.eventpub.s3_bucket_event_cache, "bucket", null)
38+
eventsub_event_cache_bucket_name = lookup(module.eventsub.s3_bucket_event_cache, "bucket", null)
3439
}

infrastructure/terraform/components/api/module_lambda_letter_status_update.tf renamed to infrastructure/terraform/components/api/module_lambda_amendment_event_transformer.tf

Lines changed: 20 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
1-
module "letter_status_update" {
1+
module "amendment_event_transformer" {
22
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip"
33

4-
function_name = "letter_status_update"
4+
function_name = "amendment_event_transformer"
55
description = "Processes letter status updates"
66

77
aws_account_id = var.aws_account_id
@@ -15,14 +15,14 @@ module "letter_status_update" {
1515
kms_key_arn = module.kms.key_arn
1616

1717
iam_policy_document = {
18-
body = data.aws_iam_policy_document.letter_status_update.json
18+
body = data.aws_iam_policy_document.amendment_event_transformer.json
1919
}
2020

2121
function_s3_bucket = local.acct.s3_buckets["lambda_function_artefacts"]["id"]
2222
function_code_base_path = local.aws_lambda_functions_dir_path
2323
function_code_dir = "api-handler/dist"
2424
function_include_common = true
25-
handler_function_name = "letterStatusUpdate"
25+
handler_function_name = "transformAmendmentEvent"
2626
runtime = "nodejs22.x"
2727
memory = 512
2828
timeout = 29
@@ -37,7 +37,7 @@ module "letter_status_update" {
3737
lambda_env_vars = merge(local.common_lambda_env_vars, {})
3838
}
3939

40-
data "aws_iam_policy_document" "letter_status_update" {
40+
data "aws_iam_policy_document" "amendment_event_transformer" {
4141
statement {
4242
sid = "KMSPermissions"
4343
effect = "Allow"
@@ -59,7 +59,6 @@ data "aws_iam_policy_document" "letter_status_update" {
5959
actions = [
6060
"dynamodb:GetItem",
6161
"dynamodb:Query",
62-
"dynamodb:UpdateItem",
6362
]
6463

6564
resources = [
@@ -79,7 +78,21 @@ data "aws_iam_policy_document" "letter_status_update" {
7978
]
8079

8180
resources = [
82-
module.letter_status_updates_queue.sqs_queue_arn
81+
module.letter_status_updates_queue.sqs_queue_arn,
82+
module.amendments_queue.sqs_queue_arn,
83+
]
84+
}
85+
86+
statement {
87+
sid = "AllowSNSPublish"
88+
effect = "Allow"
89+
90+
actions = [
91+
"sns:Publish"
92+
]
93+
94+
resources = [
95+
module.eventsub.sns_topic.arn
8396
]
8497
}
8598
}

0 commit comments

Comments
 (0)