main.yaml

AWSTemplateFormatVersion: "2010-09-09"
Transform: AWS::Serverless-2016-10-31
Description: |
  PSU API's and related resources

Parameters:
  StackName:
    Type: String
    Default: none

  EnableMutualTLS:
    Type: String

  TruststoreVersion:
    Type: String

  UpdatePrescriptionStatusStateMachineName:
    Type: String
    Default: none

  UpdatePrescriptionStatusStateMachineArn:
    Type: String
    Default: none

  Format1UpdatePrescriptionsStatusStateMachineName:
    Type: String
    Default: none

  Format1UpdatePrescriptionsStatusStateMachineArn:
    Type: String
    Default: none

  StatusFunctionName:
    Type: String
    Default: none

  StatusFunctionArn:
    Type: String
    Default: none

  CapabilityStatementFunctionName:
    Type: String
    Default: none

  CapabilityStatementFunctionArn:
    Type: String
    Default: none

  CheckPrescriptionStatusUpdatesFunctionName:
    Type: String
    Default: none

  CheckPrescriptionStatusUpdatesFunctionArn:
    Type: String
    Default: none

  GetStatusUpdatesFunctionName:
    Type: String
    Default: none

  GetStatusUpdatesFunctionArn:
    Type: String
    Default: none

  NHSNotifyUpdateCallbackFunctionName:
    Type: String
    Default: none

  NHSNotifyUpdateCallbackFunctionArn:
    Type: String
    Default: none

  LogRetentionInDays:
    Type: Number

  EnableSplunk:
    Type: String

  DeployCheckPrescriptionStatusUpdate:
    Type: String

  ExposeGetStatusUpdates:
    Type: String
    Default: false

  ForwardCsocLogs:
    Type: String
    Default: false
Conditions:
  ShouldUseMutualTLS: !Equals
    - true
    - !Ref EnableMutualTLS
  ShouldDeployCheckPrescriptionStatusUpdate: !Equals
    - true
    - !Ref DeployCheckPrescriptionStatusUpdate
  ShouldExposeGetStatusUpdates: !Equals
    - true
    - !Ref ExposeGetStatusUpdates

Resources:
  GenerateCertificate:
    Type: AWS::CertificateManager::Certificate
    Properties:
      ValidationMethod: DNS
      DomainName: !Join
        - .
        - - !Ref StackName
          - !ImportValue eps-route53-resources:EPS-domain
      DomainValidationOptions:
        - DomainName: !Join
            - .
            - - !Ref StackName
              - !ImportValue eps-route53-resources:EPS-domain
          HostedZoneId: !ImportValue eps-route53-resources:EPS-ZoneID

  RestApiGateway:
    Type: AWS::ApiGateway::RestApi
    Properties:
      Name: !Sub ${StackName}-apigw
      DisableExecuteApiEndpoint: !If
        - ShouldUseMutualTLS
        - true
        - !Ref AWS::NoValue
      EndpointConfiguration:
        Types:
          - REGIONAL

  RestApiDomain:
    Type: AWS::ApiGateway::DomainName
    Properties:
      DomainName: !Join
        - .
        - - !Ref StackName
          - !ImportValue eps-route53-resources:EPS-domain
      RegionalCertificateArn: !Ref GenerateCertificate
      EndpointConfiguration:
        Types:
          - REGIONAL
      SecurityPolicy: TLS_1_2
      MutualTlsAuthentication:
        TruststoreUri: !If
          - ShouldUseMutualTLS
          - !Join
            - /
            - - s3:/
              - !Select
                - 5
                - !Split
                  - ":"
                  - !ImportValue account-resources-cdk-uk:Bucket:TrustStoreBucket:Arn
              - psu-truststore.pem
          - !Ref AWS::NoValue
        TruststoreVersion: !If
          - ShouldUseMutualTLS
          - !Ref TruststoreVersion
          - !Ref AWS::NoValue

  RestApiRecordSet:
    Type: AWS::Route53::RecordSet
    Properties:
      Name: !Join
        - .
        - - !Ref StackName
          - !ImportValue eps-route53-resources:EPS-domain
      Type: A
      HostedZoneId: !ImportValue eps-route53-resources:EPS-ZoneID
      AliasTarget:
        DNSName: !GetAtt RestApiDomain.RegionalDomainName
        HostedZoneId: !GetAtt RestApiDomain.RegionalHostedZoneId

  UpdatePrescriptionStatusMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: !Ref RestApiGateway
      ResourceId: !GetAtt RestApiGateway.RootResourceId
      HttpMethod: POST
      AuthorizationType: NONE
      Integration:
        Type: AWS
        Credentials: !GetAtt RestApiGatewayResources.Outputs.ApiGwRoleArn
        IntegrationHttpMethod: POST
        Uri: !Sub arn:aws:apigateway:${AWS::Region}:states:action/StartSyncExecution
        PassthroughBehavior: WHEN_NO_MATCH
        RequestTemplates:
          application/json: !Sub
            - |-
              ## Velocity Template used for API Gateway request mapping template
              ## "@@" is used here as a placeholder for '"' to avoid using escape characters.

              #set($includeHeaders = true)
              #set($includeQueryString = true)
              #set($includePath = true)
              #set($requestContext = '')

              #set($inputString = '')
              #set($allParams = $input.params())
              #set($allParams.header.apigw-request-id = $context.requestId)
              {
                  "stateMachineArn": "${stateMachineArn}",

                  #set($inputString = "$inputString,@@body@@: $input.body")

                  #if ($includeHeaders)
                      #set($inputString = "$inputString, @@headers@@:{")
                      #foreach($paramName in $allParams.header.keySet())
                          #set($inputString = "$inputString @@$paramName@@: @@$util.escapeJavaScript($allParams.header.get($paramName))@@")
                          #if($foreach.hasNext)
                              #set($inputString = "$inputString,")
                          #end
                      #end
                      #set($inputString = "$inputString }")

                  #end

                  #if ($includeQueryString)
                      #set($inputString = "$inputString, @@querystring@@:{")
                      #foreach($paramName in $allParams.querystring.keySet())
                          #set($inputString = "$inputString @@$paramName@@: @@$util.escapeJavaScript($allParams.querystring.get($paramName))@@")
                          #if($foreach.hasNext)
                              #set($inputString = "$inputString,")
                          #end
                      #end
                      #set($inputString = "$inputString }")
                  #end

                  #if ($includePath)
                      #set($inputString = "$inputString, @@path@@:{")
                      #foreach($paramName in $allParams.path.keySet())
                          #set($inputString = "$inputString @@$paramName@@: @@$util.escapeJavaScript($allParams.path.get($paramName))@@")
                          #if($foreach.hasNext)
                              #set($inputString = "$inputString,")
                          #end
                      #end
                      #set($inputString = "$inputString }")
                  #end

                  ## Check if the request context should be included as part of the execution input
                  #if($requestContext && !$requestContext.empty)
                      #set($inputString = "$inputString,")
                      #set($inputString = "$inputString @@requestContext@@: $requestContext")
                  #end

                  #set($inputString = "$inputString}")
                  #set($inputString = $inputString.replaceAll("@@",'"'))
                  #set($len = $inputString.length() - 1)
                  "input": "{$util.escapeJavaScript($inputString.substring(1,$len))}"
              }
            - stateMachineArn: !Ref UpdatePrescriptionStatusStateMachineArn
          application/fhir+json: !Sub
            - |-
              ## Velocity Template used for API Gateway request mapping template
              ## "@@" is used here as a placeholder for '"' to avoid using escape characters.

              #set($includeHeaders = true)
              #set($includeQueryString = true)
              #set($includePath = true)
              #set($requestContext = '')

              #set($inputString = '')
              #set($allParams = $input.params())
              #set($allParams.header.apigw-request-id = $context.requestId)
              {
                  "stateMachineArn": "${stateMachineArn}",

                  #set($inputString = "$inputString,@@body@@: $input.body")

                  #if ($includeHeaders)
                      #set($inputString = "$inputString, @@headers@@:{")
                      #foreach($paramName in $allParams.header.keySet())
                          #set($inputString = "$inputString @@$paramName@@: @@$util.escapeJavaScript($allParams.header.get($paramName))@@")
                          #if($foreach.hasNext)
                              #set($inputString = "$inputString,")
                          #end
                      #end
                      #set($inputString = "$inputString }")

                  #end

                  #if ($includeQueryString)
                      #set($inputString = "$inputString, @@querystring@@:{")
                      #foreach($paramName in $allParams.querystring.keySet())
                          #set($inputString = "$inputString @@$paramName@@: @@$util.escapeJavaScript($allParams.querystring.get($paramName))@@")
                          #if($foreach.hasNext)
                              #set($inputString = "$inputString,")
                          #end
                      #end
                      #set($inputString = "$inputString }")
                  #end

                  #if ($includePath)
                      #set($inputString = "$inputString, @@path@@:{")
                      #foreach($paramName in $allParams.path.keySet())
                          #set($inputString = "$inputString @@$paramName@@: @@$util.escapeJavaScript($allParams.path.get($paramName))@@")
                          #if($foreach.hasNext)
                              #set($inputString = "$inputString,")
                          #end
                      #end
                      #set($inputString = "$inputString }")
                  #end

                  ## Check if the request context should be included as part of the execution input
                  #if($requestContext && !$requestContext.empty)
                      #set($inputString = "$inputString,")
                      #set($inputString = "$inputString @@requestContext@@: $requestContext")
                  #end

                  #set($inputString = "$inputString}")
                  #set($inputString = $inputString.replaceAll("@@",'"'))
                  #set($len = $inputString.length() - 1)
                  "input": "{$util.escapeJavaScript($inputString.substring(1,$len))}"
              }
            - stateMachineArn: !Ref UpdatePrescriptionStatusStateMachineArn
        IntegrationResponses:
          - StatusCode: 200
            ResponseTemplates:
              application/json: |-
                #set($payload = $util.parseJson($input.path('$.output')))
                #set($context.responseOverride.status = $payload.Payload.statusCode)
                #set($allHeaders = $payload.Payload.headers)
                #foreach($headerName in $allHeaders.keySet())
                    #set($context.responseOverride.header[$headerName] = $allHeaders.get($headerName))
                #end
                $payload.Payload.body
          - StatusCode: 400
            SelectionPattern: ^4\d{2}.*
            ResponseTemplates:
              application/json: |-
                #set($context.responseOverride.header["Content-Type"] ="application/fhir+json")
                {"resourceType":"OperationOutcome","issue": [{"severity":"error","code":"value","diagnostics":"Badly formatted request body."}]}
          - StatusCode: 500
            SelectionPattern: ^5\d{2}.*
            ResponseTemplates:
              application/json: |-
                #set($context.responseOverride.header["Content-Type"] ="application/fhir+json")
                {"resourceType":"OperationOutcome","issue": [{"severity":"error","code":"processing","diagnostics":"System error"}]}

      MethodResponses:
        - StatusCode: "200"
        - StatusCode: "400"
        - StatusCode: "500"

  Format1UpdatePrescriptionStatusMethodResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref RestApiGateway
      ParentId: !GetAtt RestApiGateway.RootResourceId
      PathPart: format-1

  Format1UpdatePrescriptionStatusMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: !Ref RestApiGateway
      ResourceId: !Ref Format1UpdatePrescriptionStatusMethodResource
      HttpMethod: POST
      AuthorizationType: NONE
      Integration:
        Type: AWS
        Credentials: !GetAtt RestApiGatewayResources.Outputs.ApiGwRoleArn
        IntegrationHttpMethod: POST
        Uri: !Sub arn:aws:apigateway:${AWS::Region}:states:action/StartSyncExecution
        PassthroughBehavior: WHEN_NO_MATCH
        RequestTemplates:
          application/json: !Sub
            - |-
              ## Velocity Template used for API Gateway request mapping template
              ## "@@" is used here as a placeholder for '"' to avoid using escape characters.

              #set($includeHeaders = true)
              #set($includeQueryString = true)
              #set($includePath = true)
              #set($requestContext = '')

              #set($inputString = '')
              #set($allParams = $input.params())
              #set($allParams.header.apigw-request-id = $context.requestId)
              {
                  "stateMachineArn": "${stateMachineArn}",
                  #set($cleanBody = $input.json('$').replace("'",""))
                  #set($inputString = "$inputString,@@body@@: $cleanBody")

                  #if ($includeHeaders)
                      #set($inputString = "$inputString, @@headers@@:{")
                      #foreach($paramName in $allParams.header.keySet())
                          #set($inputString = "$inputString @@$paramName@@: @@$util.escapeJavaScript($allParams.header.get($paramName))@@")
                          #if($foreach.hasNext)
                              #set($inputString = "$inputString,")
                          #end
                      #end
                      #set($inputString = "$inputString }")

                  #end

                  #if ($includeQueryString)
                      #set($inputString = "$inputString, @@querystring@@:{")
                      #foreach($paramName in $allParams.querystring.keySet())
                          #set($inputString = "$inputString @@$paramName@@: @@$util.escapeJavaScript($allParams.querystring.get($paramName))@@")
                          #if($foreach.hasNext)
                              #set($inputString = "$inputString,")
                          #end
                      #end
                      #set($inputString = "$inputString }")
                  #end

                  #if ($includePath)
                      #set($inputString = "$inputString, @@path@@:{")
                      #foreach($paramName in $allParams.path.keySet())
                          #set($inputString = "$inputString @@$paramName@@: @@$util.escapeJavaScript($allParams.path.get($paramName))@@")
                          #if($foreach.hasNext)
                              #set($inputString = "$inputString,")
                          #end
                      #end
                      #set($inputString = "$inputString }")
                  #end

                  ## Check if the request context should be included as part of the execution input
                  #if($requestContext && !$requestContext.empty)
                      #set($inputString = "$inputString,")
                      #set($inputString = "$inputString @@requestContext@@: $requestContext")
                  #end

                  #set($inputString = "$inputString}")
                  #set($inputString = $inputString.replaceAll("@@",'"'))
                  #set($len = $inputString.length() - 1)
                  "input": "{$util.escapeJavaScript($inputString.substring(1,$len))}"
              }
            - stateMachineArn: !Ref Format1UpdatePrescriptionsStatusStateMachineArn
        IntegrationResponses:
          - StatusCode: 200
            ResponseTemplates:
              application/json: |-
                #set($payload = $util.parseJson($input.path('$.output')))
                #set($context.responseOverride.status = $payload.Payload.statusCode)
                #set($allHeaders = $payload.Payload.headers)
                #foreach($headerName in $allHeaders.keySet())
                    #set($context.responseOverride.header[$headerName] = $allHeaders.get($headerName))
                #end
                $payload.Payload.body
          - StatusCode: 400
            SelectionPattern: ^4\d{2}.*
            ResponseTemplates:
              application/json: |-
                #set($context.responseOverride.header["Content-Type"] ="application/fhir+json")
                {"resourceType":"OperationOutcome","issue": [{"severity":"error","code":"value","diagnostics":"Badly formatted request body."}]}
          - StatusCode: 500
            SelectionPattern: ^5\d{2}.*
            ResponseTemplates:
              application/json: |-
                #set($context.responseOverride.header["Content-Type"] ="application/fhir+json")
                {"resourceType":"OperationOutcome","issue": [{"severity":"error","code":"processing","diagnostics":"System error"}]}

      MethodResponses:
        - StatusCode: "200"
        - StatusCode: "400"
        - StatusCode: "500"

  NotificationDeliveryStatusCallbackMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: !Ref RestApiGateway
      ResourceId: !Ref NotificationDeliveryStatusCallbackResource
      HttpMethod: POST
      AuthorizationType: NONE # They authenticate with a signature header
      Integration:
        Type: AWS_PROXY
        Credentials: !GetAtt RestApiGatewayResources.Outputs.ApiGwRoleArn
        IntegrationHttpMethod: POST
        Uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${NHSNotifyUpdateCallbackFunctionArn}/invocations
      MethodResponses:
        - StatusCode: "202"
        - StatusCode: "401"
        - StatusCode: "403"
        - StatusCode: "429"
        - StatusCode: "500"

  NotificationDeliveryStatusCallbackResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref RestApiGateway
      ParentId: !GetAtt RestApiGateway.RootResourceId
      PathPart: notification-delivery-status-callback

  StatusLambdaMethodResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref RestApiGateway
      ParentId: !GetAtt RestApiGateway.RootResourceId
      PathPart: _status

  StatusLambdaMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: !Ref RestApiGateway
      ResourceId: !Ref StatusLambdaMethodResource
      HttpMethod: GET
      AuthorizationType: NONE
      Integration:
        Type: AWS_PROXY
        Credentials: !GetAtt RestApiGatewayResources.Outputs.ApiGwRoleArn
        IntegrationHttpMethod: POST
        Uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${StatusFunctionArn}/invocations

  CapabilityStatementResource:
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref RestApiGateway
      ParentId: !GetAtt RestApiGateway.RootResourceId
      PathPart: metadata

  CapabilityStatementMethod:
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: !Ref RestApiGateway
      ResourceId: !Ref CapabilityStatementResource
      HttpMethod: GET
      AuthorizationType: NONE
      Integration:
        Type: AWS_PROXY
        Credentials: !GetAtt RestApiGatewayResources.Outputs.ApiGwRoleArn
        IntegrationHttpMethod: POST
        Uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${CapabilityStatementFunctionArn}/invocations

  CheckPrescriptionStatusUpdatesResource:
    Condition: ShouldDeployCheckPrescriptionStatusUpdate
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref RestApiGateway
      ParentId: !GetAtt RestApiGateway.RootResourceId
      PathPart: checkprescriptionstatusupdates

  CheckPrescriptionStatusUpdatesMethod:
    Condition: ShouldDeployCheckPrescriptionStatusUpdate
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: !Ref RestApiGateway
      ResourceId: !Ref CheckPrescriptionStatusUpdatesResource
      HttpMethod: GET
      AuthorizationType: NONE
      Integration:
        Type: AWS_PROXY
        Credentials: !GetAtt RestApiGatewayResources.Outputs.ApiGwRoleArn
        IntegrationHttpMethod: POST
        Uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${CheckPrescriptionStatusUpdatesFunctionArn}/invocations

  GetStatusUpdatesResource:
    Condition: ShouldExposeGetStatusUpdates
    Type: AWS::ApiGateway::Resource
    Properties:
      RestApiId: !Ref RestApiGateway
      ParentId: !GetAtt RestApiGateway.RootResourceId
      PathPart: get-status-updates

  GetStatusUpdatesMethod:
    Condition: ShouldExposeGetStatusUpdates
    Type: AWS::ApiGateway::Method
    Properties:
      RestApiId: !Ref RestApiGateway
      ResourceId: !Ref GetStatusUpdatesResource
      HttpMethod: POST
      AuthorizationType: NONE
      Integration:
        Type: AWS
        Credentials: !GetAtt RestApiGatewayResources.Outputs.ApiGwRoleArn
        IntegrationHttpMethod: POST
        Uri: !Sub arn:aws:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${GetStatusUpdatesFunctionArn}/invocations
        RequestTemplates:
          application/json: |-
            $input.json('$')
        IntegrationResponses:
          - StatusCode: 200
            ResponseTemplates:
              application/json: |-
                $input.body
      MethodResponses:
        - StatusCode: "200"

  GetStatusUpdatesHandle:
    Condition: ShouldExposeGetStatusUpdates
    DependsOn: GetStatusUpdatesMethod
    Type: "AWS::CloudFormation::WaitConditionHandle"

  GetStatusUpdatesWaitHandle:
    Type: "AWS::CloudFormation::WaitConditionHandle"

  GetStatusUpdatesWaitCondition:
    Type: "AWS::CloudFormation::WaitCondition"
    Properties:
      Handle:
        !If [
          ShouldExposeGetStatusUpdates,
          !Ref GetStatusUpdatesHandle,
          !Ref GetStatusUpdatesWaitHandle,
        ]
      Timeout: "1"
      Count: 0

  # we can not use a conditional in depends on in ApiGateway::Deployment
  # so instead we use a wait condition that has the conditional in it and use that as a dependency
  # taken from https://garbe.io/blog/2017/07/17/cloudformation-hacks/
  CheckPrescriptionStatusUpdatesHandle:
    Condition: ShouldDeployCheckPrescriptionStatusUpdate
    DependsOn: CheckPrescriptionStatusUpdatesMethod
    Type: "AWS::CloudFormation::WaitConditionHandle"

  CheckPrescriptionStatusUpdatesWaitHandle:
    Type: "AWS::CloudFormation::WaitConditionHandle"

  CheckPrescriptionStatusUpdatesWaitCondition:
    Type: "AWS::CloudFormation::WaitCondition"
    Properties:
      Handle:
        !If [
          ShouldDeployCheckPrescriptionStatusUpdate,
          !Ref CheckPrescriptionStatusUpdatesHandle,
          !Ref CheckPrescriptionStatusUpdatesWaitHandle,
        ]
      Timeout: "1"
      Count: 0

  # *********************************************************************
  # if you add a new endpoint, then change the name of this resource
  # also need to change it in RestApiGatewayStage.Properties.DeploymentId
  # *********************************************************************
  RestApiGatewayDeploymentV2h:
    Type: AWS::ApiGateway::Deployment
    DependsOn:
      # see note above if you add something in here when you add a new endpoint
      - UpdatePrescriptionStatusMethod
      - StatusLambdaMethod
      - CapabilityStatementMethod
      - Format1UpdatePrescriptionStatusMethod
      - CheckPrescriptionStatusUpdatesWaitCondition
      - NotificationDeliveryStatusCallbackMethod
      - GetStatusUpdatesWaitCondition
      # see note above if you add something in here when you add a new endpoint
    Properties:
      RestApiId: !Ref RestApiGateway

  RestApiGatewayStage:
    Type: AWS::ApiGateway::Stage
    Properties:
      RestApiId: !Ref RestApiGateway
      DeploymentId: !Ref RestApiGatewayDeploymentV2h
      StageName: prod
      TracingEnabled: true
      AccessLogSetting:
        DestinationArn: !GetAtt RestApiGatewayResources.Outputs.ApiGwAccessLogsArn
        Format: '{ "requestId": "$context.requestId", "ip": "$context.identity.sourceIp", "caller":"$context.identity.caller", "user":"$context.identity.user","requestTime":"$context.requestTime", "httpMethod":"$context.httpMethod","resourcePath":"$context.resourcePath", "status":"$context.status","protocol":"$context.protocol", "responseLength":"$context.responseLength", "accountId":"$context.accountId", "apiId":"$context.apiId", "stage" : "$context.stage", "api_key" : "$context.identity.apiKey", "identity": { "sourceIp": "$context.identity.sourceIp", "userAgent": "$context.identity.userAgent", "clientCert":{ "subjectDN": "$context.identity.clientCert.subjectDN", "issuerDN": "$context.identity.clientCert.issuerDN", "serialNumber": "$context.identity.clientCert.serialNumber", "validityNotBefore": "$context.identity.clientCert.validity.notBefore", "validityNotAfter": "$context.identity.clientCert.validity.notAfter" }}, "integration":{ "error": "$context.integration.error", "integrationStatus": "$context.integration.integrationStatus", "latency": "$context.integration.latency", "requestId": "$context.integration.requestId", "status": "$context.integration.status" } }'
  RestApiDomainMapping:
    Type: AWS::ApiGateway::BasePathMapping
    Properties:
      DomainName: !Ref RestApiDomain
      RestApiId: !Ref RestApiGateway
      Stage: !Ref RestApiGatewayStage

  RestApiGatewayResources:
    Type: AWS::Serverless::Application
    Properties:
      Location: api_resources.yaml
      Parameters:
        AdditionalPolicies: !Join
          - ","
          - - Fn::ImportValue: !Sub ${StackName}:state-machines:${UpdatePrescriptionStatusStateMachineName}:ExecuteStateMachinePolicy
            - Fn::ImportValue: !Sub ${StackName}:functions:${StatusFunctionName}:ExecuteLambdaPolicyArn
            - Fn::ImportValue: !Sub ${StackName}:functions:${CapabilityStatementFunctionName}:ExecuteLambdaPolicyArn
            - Fn::ImportValue: !Sub ${StackName}:functions:${NHSNotifyUpdateCallbackFunctionName}:ExecuteLambdaPolicyArn
            - !If
              - ShouldExposeGetStatusUpdates
              - Fn::ImportValue: !Sub ${StackName}:functions:${GetStatusUpdatesFunctionName}:ExecuteLambdaPolicyArn
              - !Ref AWS::NoValue
            - Fn::ImportValue: !Sub ${StackName}:state-machines:${Format1UpdatePrescriptionsStatusStateMachineName}:ExecuteStateMachinePolicy
            - !If
              - ShouldDeployCheckPrescriptionStatusUpdate
              - Fn::ImportValue: !Sub ${StackName}:functions:${CheckPrescriptionStatusUpdatesFunctionName}:ExecuteLambdaPolicyArn
              - !Ref AWS::NoValue

        ApiName: !Sub ${StackName}-apigw
        LogRetentionInDays: !Ref LogRetentionInDays
        EnableSplunk: !Ref EnableSplunk
        ForwardCsocLogs: !Ref ForwardCsocLogs