Skip to content

Commit 93c640e

Browse files
nhsd-david-wassnhsd-david-wass
committed
Status updates for sub
1 parent bd295ce commit 93c640e

17 files changed

Lines changed: 304 additions & 10 deletions

‎infrastructure/terraform/components/api/README.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,9 @@ No requirements.
1818
| <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
1919
| <a name="input_disable_gateway_execute_endpoint"></a> [disable\_gateway\_execute\_endpoint](#input\_disable\_gateway\_execute\_endpoint) | Disable the execution endpoint for the API Gateway | `bool` | `true` | no |
2020
| <a name="input_enable_api_data_trace"></a> [enable\_api\_data\_trace](#input\_enable\_api\_data\_trace) | Enable API Gateway data trace logging | `bool` | `false` | no |
21-
| <a name="input_enable_event_cache"></a> [enable\_event\_cache](#input\_enable\_event\_cache) | Enable caching of events to an S3 bucket | `bool` | `false` | no |
22-
| <a name="input_enable_sns_delivery_logging"></a> [enable\_sns\_delivery\_logging](#input\_enable\_sns\_delivery\_logging) | Enable SNS Delivery Failure Notifications | `bool` | `false` | no |
21+
| <a name="input_enable_backups"></a> [enable\_backups](#input\_enable\_backups) | Enable backups | `bool` | `false` | no |
22+
| <a name="input_enable_event_cache"></a> [enable\_event\_cache](#input\_enable\_event\_cache) | Enable caching of events to an S3 bucket | `bool` | `true` | no |
23+
| <a name="input_enable_sns_delivery_logging"></a> [enable\_sns\_delivery\_logging](#input\_enable\_sns\_delivery\_logging) | Enable SNS Delivery Failure Notifications | `bool` | `true` | no |
2324
| <a name="input_environment"></a> [environment](#input\_environment) | The name of the tfscaffold environment | `string` | n/a | yes |
2425
| <a name="input_eventpub_control_plane_bus_arn"></a> [eventpub\_control\_plane\_bus\_arn](#input\_eventpub\_control\_plane\_bus\_arn) | ARN of the EventBridge control plane bus for eventpub | `string` | `""` | no |
2526
| <a name="input_eventpub_data_plane_bus_arn"></a> [eventpub\_data\_plane\_bus\_arn](#input\_eventpub\_data\_plane\_bus\_arn) | ARN of the EventBridge data plane bus for eventpub | `string` | `""` | no |

‎infrastructure/terraform/components/api/glue_catalog_database_supplier.tf‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
resource "aws_glue_catalog_database" "supplier" {
2+
name = "${local.csi}-supplier"
3+
description = "Glue catalog database for Suppliers API"
4+
}

‎infrastructure/terraform/components/api/glue_crawler_event_crawler.tf‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
resource "aws_glue_crawler" "event_crawler" {
2+
count = local.event_cache_bucket_name != null ? 1 : 0
3+
name = "event-crawler-${aws_glue_catalog_table.events.name}"
4+
database_name = aws_glue_catalog_database.supplier.name
5+
role = aws_iam_role.glue_role.arn
6+
7+
table_prefix = ""
8+
s3_target {
9+
path = "s3://${local.event_cache_bucket_name}/"
10+
}
11+
12+
s3_target {
13+
path = "s3://${local.eventsub_event_cache_bucket_name}/"
14+
}
15+
recrawl_policy {
16+
recrawl_behavior = "CRAWL_EVERYTHING"
17+
}
18+
19+
schema_change_policy {
20+
delete_behavior = "LOG"
21+
update_behavior = "UPDATE_IN_DATABASE"
22+
}
23+
24+
}

‎infrastructure/terraform/components/api/iam_role_glue.tf‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
resource "aws_iam_role" "glue_role" {
2+
name = "${local.csi}-glue-role"
3+
assume_role_policy = data.aws_iam_policy_document.glue_assume_role.json
4+
}
5+
6+
data "aws_iam_policy_document" "glue_assume_role" {
7+
statement {
8+
sid = "AllowGlueServiceAssumeRole"
9+
effect = "Allow"
10+
11+
principals {
12+
type = "Service"
13+
identifiers = ["glue.amazonaws.com"]
14+
}
15+
16+
actions = [
17+
"sts:AssumeRole",
18+
]
19+
}
20+
}
21+
22+
resource "aws_iam_policy" "glue_service_policy" {
23+
name = "${local.csi}-glue-service-policy"
24+
description = "Policy for ${local.csi} Glue Service Role"
25+
policy = data.aws_iam_policy_document.glue_service_policy.json
26+
}
27+
28+
data "aws_iam_policy_document" "glue_service_policy" {
29+
statement {
30+
sid = "AllowGlueLogging"
31+
effect = "Allow"
32+
33+
actions = [
34+
"logs:CreateLogGroup",
35+
"logs:CreateLogStream",
36+
"logs:PutLogEvents"
37+
]
38+
resources = ["arn:aws:logs:*:*:*"]
39+
}
40+
41+
statement {
42+
sid = "AllowListBucketAndGetLocation"
43+
effect = "Allow"
44+
45+
actions = [
46+
"s3:ListBucket",
47+
"s3:GetBucketLocation"
48+
]
49+
50+
resources = [
51+
"arn:aws:s3:::${local.event_cache_bucket_name}",
52+
"arn:aws:s3:::${local.eventsub_event_cache_bucket_name}"
53+
]
54+
}
55+
statement {
56+
sid = "AllowS3Access"
57+
effect = "Allow"
58+
59+
actions = [
60+
"s3:GetObject",
61+
"s3:GetObjectVersion",
62+
"s3:PutObject",
63+
"s3:DeleteObject"
64+
]
65+
resources = [
66+
"arn:aws:s3:::${local.event_cache_bucket_name}/*",
67+
"arn:aws:s3:::${local.eventsub_event_cache_bucket_name}/*"
68+
]
69+
}
70+
statement {
71+
sid = "GlueCatalogAccess"
72+
effect = "Allow"
73+
actions = [
74+
"glue:GetDatabase",
75+
"glue:GetDatabases",
76+
"glue:GetTable",
77+
"glue:GetTables",
78+
"glue:CreateTable",
79+
"glue:UpdateTable",
80+
"glue:CreatePartition",
81+
"glue:BatchCreatePartition",
82+
"glue:GetPartition",
83+
"glue:BatchGetPartition",
84+
"glue:UpdatePartition"
85+
]
86+
resources = ["*"]
87+
}
88+
statement {
89+
sid = "S3TempAndGlueETL"
90+
effect = "Allow"
91+
actions = [
92+
"s3:PutObject",
93+
"s3:GetObject"
94+
]
95+
resources = [
96+
"arn:aws:s3:::aws-glue-*",
97+
"arn:aws:s3:::aws-glue-*/*"
98+
]
99+
}
100+
}
101+
102+
resource "aws_iam_role_policy_attachment" "gllue_attach_policy" {
103+
role = aws_iam_role.glue_role.name
104+
policy_arn = aws_iam_policy.glue_service_policy.arn
105+
}

‎infrastructure/terraform/components/api/locals.tf‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,4 +31,7 @@ locals {
3131

3232
core_pdf_bucket_arn = "arn:aws:s3:::comms-${var.core_account_id}-eu-west-2-${var.core_environment}-api-stg-pdf-pipeline"
3333
core_s3_kms_key_alias_name = "alias/comms-${var.core_environment}-api-s3"
34+
35+
event_cache_bucket_name = lookup(module.eventpub.s3_bucket_event_cache, "bucket", null)
36+
eventsub_event_cache_bucket_name = lookup(module.eventsub.s3bucket_event_cache, "bucket", null)
3437
}

‎infrastructure/terraform/components/api/module_lambda_letter_status_update.tf‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,4 +82,17 @@ data "aws_iam_policy_document" "letter_status_update" {
8282
module.letter_status_updates_queue.sqs_queue_arn
8383
]
8484
}
85+
86+
statement {
87+
sid = "AllowSNSPublish"
88+
effect = "Allow"
89+
90+
actions = [
91+
"sns:Publish"
92+
]
93+
94+
resources = [
95+
module.eventsub.sns_topic.arn
96+
]
97+
}
8598
}

‎infrastructure/terraform/components/api/modules_eventsub.tf‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@ module "eventsub" {
1212

1313
default_tags = local.default_tags
1414

15+
glue_role_arn = aws_iam_role.glue_role.arn
16+
1517
kms_key_arn = module.kms.key_arn
1618
log_retention_in_days = var.log_retention_in_days
1719
log_level = "INFO"
@@ -22,7 +24,7 @@ module "eventsub" {
2224
sns_success_logging_sample_percent = var.sns_success_logging_sample_percent
2325

2426
event_cache_expiry_days = 30
25-
enable_event_cache = var.enable_event_cache
27+
enable_event_cache = var.enable_event_cache
2628

2729
shared_infra_account_id = var.shared_infra_account_id
2830
}

‎infrastructure/terraform/components/api/s3_bucket_policy_eventcache.tf‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
resource "aws_s3_bucket_policy" "eventcache" {
2+
count = local.event_cache_bucket_name != null ? 1 : 0
3+
bucket = local.event_cache_bucket_name
4+
policy = data.aws_iam_policy_document.eventcache[0].json
5+
6+
depends_on = [module.eventpub]
7+
}
8+
9+
data "aws_iam_policy_document" "eventcache" {
10+
count = local.event_cache_bucket_name != null ? 1 : 0
11+
statement {
12+
sid = "AllowGlueListBucketAndGetLocation"
13+
effect = "Allow"
14+
15+
principals {
16+
type = "AWS"
17+
identifiers = [aws_iam_role.glue_role.arn]
18+
}
19+
20+
actions = [
21+
"s3:ListBucket",
22+
"s3:GetBucketLocation"
23+
]
24+
25+
resources = [
26+
"arn:aws:s3:::${local.csi_global}-eventcache"
27+
]
28+
}
29+
30+
# Object-level permissions: Get/Put/Delete objects
31+
statement {
32+
sid = "AllowGlueObjectAccess"
33+
effect = "Allow"
34+
35+
principals {
36+
type = "AWS"
37+
identifiers = [aws_iam_role.glue_role.arn]
38+
}
39+
40+
actions = [
41+
"s3:GetObject",
42+
"s3:GetObjectVersion",
43+
"s3:PutObject",
44+
"s3:DeleteObject"
45+
]
46+
47+
resources = [
48+
"arn:aws:s3:::${local.csi_global}-eventcache/*"
49+
]
50+
}
51+
}

‎infrastructure/terraform/components/api/s3_event_reporting.tf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
resource "aws_s3_bucket" "event_reporting" {
2+
bucket = "${local.csi_global}-event-reporting"
3+
4+
tags = merge(local.default_tags, { "Enable-Backup" = var.enable_backups }, { "Enable-S3-Continuous-Backup" = var.enable_backups })
5+
}
6+
resource "aws_s3_bucket_ownership_controls" "event_reporting" {
7+
bucket = aws_s3_bucket.event_reporting.id
8+
9+
rule {
10+
object_ownership = "BucketOwnerPreferred"
11+
}
12+
}
13+
resource "aws_s3_bucket_versioning" "event_reporting" {
14+
bucket = aws_s3_bucket.event_reporting.id
15+
16+
versioning_configuration {
17+
status = "Enabled"
18+
}
19+
}

‎infrastructure/terraform/components/api/variables.tf‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -163,17 +163,23 @@ variable "core_environment" {
163163

164164
}
165165

166+
variable "enable_backups" {
167+
type = bool
168+
description = "Enable backups"
169+
default = false
170+
}
171+
166172
# Event Pub/Sub cache settings
167173
variable "enable_event_cache" {
168174
type = bool
169175
description = "Enable caching of events to an S3 bucket"
170-
default = false
176+
default = true
171177
}
172178

173179
variable "enable_sns_delivery_logging" {
174180
type = bool
175181
description = "Enable SNS Delivery Failure Notifications"
176-
default = false
182+
default = true
177183
}
178184

179185
variable "sns_success_logging_sample_percent" {

0 commit comments

Comments
 (0)