main.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: |
  PSU lambda functions and related resources

Globals:
  Function:
    Timeout: 50
    MemorySize: 256
    Architectures:
      - x86_64
    Runtime: nodejs20.x
    Environment:
      Variables:
        NODE_OPTIONS: "--enable-source-maps"
    Layers:
      - !Sub arn:aws:lambda:${AWS::Region}:580247275435:layer:LambdaInsightsExtension:49

Parameters:
  StackName:
    Type: String
    Default: none

  PrescriptionStatusUpdatesTableName:
    Type: String
    Default: none

  PrescriptionNotificationStateTableName:
    Type: String
    Default: none

  NHSNotifyPrescriptionsSQSQueueUrl:
    Type: String
    Default: none

  LogLevel:
    Type: String

  LogRetentionInDays:
    Type: Number

  EnableSplunk:
    Type: String

  VersionNumber:
    Type: String

  CommitId:
    Type: String

  DeployCheckPrescriptionStatusUpdate:
    Type: String

  Environment:
    Type: String

Conditions:
  ShouldDeployCheckPrescriptionStatusUpdate: !Equals
    - true
    - !Ref DeployCheckPrescriptionStatusUpdate

Resources:
  SQSSaltSecret:
    Type: AWS::SecretsManager::Secret
    Properties:
      Name: !Sub ${StackName}-SqsSalt
      Description: Auto-generated salt for SQS_SALT
      GenerateSecretString:
        SecretStringTemplate: "{}"
        GenerateStringKey: salt
        PasswordLength: 32
        ExcludePunctuation: true

  UpdatePrescriptionStatus:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-UpdatePrescriptionStatus
      CodeUri: ../../packages
      Handler: updatePrescriptionStatus.handler
      Role: !GetAtt UpdatePrescriptionStatusResources.Outputs.LambdaRoleArn
      Environment:
        Variables:
          TABLE_NAME: !Ref PrescriptionStatusUpdatesTableName
          NHS_NOTIFY_PRESCRIPTIONS_SQS_QUEUE_URL: !Ref NHSNotifyPrescriptionsSQSQueueUrl
          SQS_SALT: !Sub "{{resolve:secretsmanager:${SQSSaltSecret}:SecretString:salt}}"
          LOG_LEVEL: !Ref LogLevel
          ENVIRONMENT: !Ref Environment
          TEST_PRESCRIPTIONS_1: "None"
          TEST_PRESCRIPTIONS_2: "None"
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: updatePrescriptionStatus/tsconfig.json
        packages: bundle
        EntryPoints:
          - updatePrescriptionStatus/src/updatePrescriptionStatus.ts

  UpdatePrescriptionStatusResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-UpdatePrescriptionStatus
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-UpdatePrescriptionStatus
        IncludeAdditionalPolicies: true
        AdditionalPolicies: !Join
          - ","
          - - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionStatusUpdatesTableName}:TableWritePolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionStatusUpdatesTableName}:TableReadPolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:UsePrescriptionStatusUpdatesKMSKeyPolicyArn
            - Fn::ImportValue: !Sub ${StackName}-UseNotificationSQSQueueKMSKeyPolicyArn
            - Fn::ImportValue: !Sub ${StackName}-WriteNHSNotifyPrescriptionsSQSQueuePolicyArn
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream

  ConvertRequestToFhirFormat:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-ConvertRequestToFhirFormat
      CodeUri: ../../packages
      Handler: cpsu.format_1_handler
      Role: !GetAtt ConvertRequestToFhirFormatResources.Outputs.LambdaRoleArn
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: cpsuLambda/tsconfig.json
        packages: bundle
        EntryPoints:
          - cpsuLambda/src/cpsu.ts

  ConvertRequestToFhirFormatResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-ConvertRequestToFhirFormat
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-ConvertRequestToFhirFormat
        IncludeAdditionalPolicies: false
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream

  GetStatusUpdates:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-GetStatusUpdates
      CodeUri: ../../packages
      Handler: getStatusUpdates.handler
      Role: !GetAtt GetStatusUpdatesResources.Outputs.LambdaRoleArn
      Environment:
        Variables:
          TABLE_NAME: !Ref PrescriptionStatusUpdatesTableName
          LOG_LEVEL: !Ref LogLevel
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: gsul/tsconfig.json
        packages: bundle
        EntryPoints:
          - gsul/src/getStatusUpdates.ts

  GetStatusUpdatesResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-GetStatusUpdates
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-GetStatusUpdates
        IncludeAdditionalPolicies: true
        AdditionalPolicies: !Join
          - ","
          - - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionStatusUpdatesTableName}:TableReadPolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:UsePrescriptionStatusUpdatesKMSKeyPolicyArn
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream

  Status:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-status
      CodeUri: ../../packages
      Handler: statusLambda.handler
      Role: !GetAtt StatusResources.Outputs.LambdaRoleArn
      Environment:
        Variables:
          VERSION_NUMBER: !Ref VersionNumber
          COMMIT_ID: !Ref CommitId
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: statusLambda/tsconfig.json
        packages: bundle
        EntryPoints:
          - statusLambda/src/statusLambda.ts

  StatusResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-status
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-status
        IncludeAdditionalPolicies: true
        AdditionalPolicies: !Join
          - ","
          - - !ImportValue account-resources:LambdaAccessSecretsPolicy
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream

  CapabilityStatement:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-CapabilityStatement
      CodeUri: ../../packages
      Handler: capabilityStatement.handler
      Role: !GetAtt CapabilityStatementResources.Outputs.LambdaRoleArn
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: capabilityStatement/tsconfig.json
        packages: bundle
        EntryPoints:
          - capabilityStatement/src/capabilityStatement.ts

  CapabilityStatementResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-CapabilityStatement
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-CapabilityStatement
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream

  CheckPrescriptionStatusUpdates:
    Condition: ShouldDeployCheckPrescriptionStatusUpdate
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-CheckPrescriptionStatusUpdates
      CodeUri: ../../packages
      Handler: checkPrescriptionStatusUpdates.handler
      Role: !GetAtt CheckPrescriptionStatusUpdatesResources.Outputs.LambdaRoleArn
      Environment:
        Variables:
          TABLE_NAME: !Ref PrescriptionStatusUpdatesTableName
          LOG_LEVEL: !Ref LogLevel
          MIN_RESULTS_RETURNED: 5
          MAX_RESULTS_RETURNED: 15
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
          - LAMBDA_DLQ_CHECK
          - LAMBDA_INSIDE_VPC
          - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: checkPrescriptionStatusUpdates/tsconfig.json
        EntryPoints:
          - checkPrescriptionStatusUpdates/src/checkPrescriptionStatusUpdates.ts

  CheckPrescriptionStatusUpdatesResources:
    Condition: ShouldDeployCheckPrescriptionStatusUpdate
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-CheckPrescriptionStatusUpdates
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-CheckPrescriptionStatusUpdates
        IncludeAdditionalPolicies: true
        AdditionalPolicies: !Join
          - ","
          - - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionStatusUpdatesTableName}:TableReadPolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:UsePrescriptionStatusUpdatesKMSKeyPolicyArn
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream

  NotifyProcessorScheduleEventRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service:
                - scheduler.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - !Ref NotifyProcessorScheduleEventRolePolicy

  NotifyProcessorScheduleEventRolePolicy:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - lambda:InvokeFunction
            Resource:
              - !GetAtt NotifyProcessor.Arn

  NotifyProcessor:
    Type: AWS::Serverless::Function
    Properties:
      FunctionName: !Sub ${StackName}-NotifyProcessor
      CodeUri: ../../packages/
      Handler: nhsNotifyLambda.handler
      Role: !GetAtt NotifyProcessorResources.Outputs.LambdaRoleArn
      Environment:
        Variables:
          LOG_LEVEL: !Ref LogLevel
          NHS_NOTIFY_PRESCRIPTIONS_SQS_QUEUE_URL: !Ref NHSNotifyPrescriptionsSQSQueueUrl
          TABLE_NAME: !Ref PrescriptionNotificationStateTableName
      Events:
        ScheduleEvent:
          Type: ScheduleV2
          Properties:
            Name: !Sub ${StackName}-NotifySchedule
            ScheduleExpression: "rate(1 minute)"
            RoleArn: !GetAtt NotifyProcessorScheduleEventRole.Arn
    Metadata:
      BuildMethod: esbuild
      guard:
        SuppressedRules:
        - LAMBDA_DLQ_CHECK
        - LAMBDA_INSIDE_VPC
        - LAMBDA_CONCURRENCY_CHECK
      BuildProperties:
        Minify: true
        Target: es2020
        Sourcemap: true
        tsconfig: nhsNotifyLambda/tsconfig.json
        packages: bundle
        EntryPoints:
          - nhsNotifyLambda/src/nhsNotifyLambda.ts

  NotifyProcessorResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: lambda_resources.yaml
      Parameters:
        StackName: !Ref StackName
        LambdaName: !Sub ${StackName}-NotifyProcessor
        LambdaArn: !Sub arn:aws:lambda:${AWS::Region}:${AWS::AccountId}:function:${StackName}-NotifyProcessor
        LogRetentionInDays: !Ref LogRetentionInDays
        CloudWatchKMSKeyId: !ImportValue account-resources:CloudwatchLogsKmsKeyArn
        EnableSplunk: !Ref EnableSplunk
        SplunkSubscriptionFilterRole: !ImportValue lambda-resources:SplunkSubscriptionFilterRole
        SplunkDeliveryStreamArn: !ImportValue lambda-resources:SplunkDeliveryStream
        IncludeAdditionalPolicies: true
        AdditionalPolicies: !Join
          - ","
          - - Fn::ImportValue: !Sub ${StackName}-WriteNHSNotifyPrescriptionsSQSQueuePolicyArn
            - Fn::ImportValue: !Sub ${StackName}-ReadNHSNotifyPrescriptionsSQSQueuePolicyArn
            - Fn::ImportValue: !Sub ${StackName}-UseNotificationSQSQueueKMSKeyPolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionNotificationStateTableName}:TableReadPolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:${PrescriptionNotificationStateTableName}:TableWritePolicyArn
            - Fn::ImportValue: !Sub ${StackName}:tables:UsePrescriptionNotificationStateKMSKeyPolicyArn

Outputs:
  UpdatePrescriptionStatusFunctionName:
    Description: The function name of the UpdatePrescriptionStatus lambda
    Value: !Ref UpdatePrescriptionStatus

  UpdatePrescriptionStatusFunctionArn:
    Description: The function ARN of the UpdatePrescriptionStatus lambda
    Value: !GetAtt UpdatePrescriptionStatus.Arn

  GetStatusUpdatesFunctionName:
    Description: The function name of the GetStatusUpdates lambda
    Value: !Ref GetStatusUpdates

  GetStatusUpdatesFunctionArn:
    Description: The function ARN of the GetStatusUpdates lambda
    Value: !GetAtt GetStatusUpdates.Arn
    Export:
      Name: !Sub ${StackName}:functions:GetStatusUpdates:FunctionArn

  ConvertRequestToFhirFormatFunctionName:
    Description: The function name of the Convert Request to Fhir Format lambda
    Value: !Ref ConvertRequestToFhirFormat

  ConvertRequestToFhirFormatFunctionArn:
    Description: The function ARN of the ConvertRequestToFhirFormat lambda
    Value: !GetAtt ConvertRequestToFhirFormat.Arn
    Export:
      Name: !Sub ${StackName}:functions:ConvertRequestToFhirFormat:FunctionArn

  StatusFunctionName:
    Description: The function name of the Status lambda
    Value: !Ref Status

  StatusFunctionArn:
    Description: The function ARN of the Status lambda
    Value: !GetAtt Status.Arn

  CapabilityStatementFunctionName:
    Description: The function name of the CapabilityStatement lambda
    Value: !Ref CapabilityStatement

  CapabilityStatementFunctionArn:
    Description: The function ARN of the CapabilityStatement lambda
    Value: !GetAtt CapabilityStatement.Arn

  CheckPrescriptionStatusUpdatesFunctionName:
    Description: The function name of the CheckPrescriptionStatusUpdates lambda
    Value: !If
      - ShouldDeployCheckPrescriptionStatusUpdate
      - !Ref CheckPrescriptionStatusUpdates
      - ""

  CheckPrescriptionStatusUpdatesFunctionArn:
    Description: The function ARN of the CheckPrescriptionStatusUpdates lambda
    Value: !If
      - ShouldDeployCheckPrescriptionStatusUpdate
      - !GetAtt CheckPrescriptionStatusUpdates.Arn
      - ""

  NotifyProcessorFunctionName:
    Description: The function name of the NHS Notify lambda
    Value: !Ref NotifyProcessor

  NotifyProcessorFunctionArn:
    Description: The function ARN of the NHS Notify lambda
    Value: !GetAtt NotifyProcessor.Arn