Skip to content

Commit f897562

Browse files
aidenvaines-cgiaidenvaines-cgi
authored
Merge pull request #46 from NHSDigital/feat/CCM-7938_MessagingInfra
Feat/CCM-7938 messaging infra
2 parents c22b48e + 9405752 commit f897562

29 files changed

Lines changed: 4189 additions & 5 deletions

‎.github/actions/create-lines-of-code-report/action.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ runs:
3232
run: zip lines-of-code-report.json.zip lines-of-code-report.json
3333
- name: "Upload CLOC report as an artefact"
3434
if: ${{ !env.ACT }}
35-
uses: actions/upload-artifact@v3
35+
uses: actions/upload-artifact@v4
3636
with:
3737
name: lines-of-code-report.json.zip
3838
path: ./lines-of-code-report.json.zip

‎.github/actions/scan-dependencies/action.yaml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ runs:
3232
run: zip sbom-repository-report.json.zip sbom-repository-report.json
3333
- name: "Upload SBOM report as an artefact"
3434
if: ${{ !env.ACT }}
35-
uses: actions/upload-artifact@v3
35+
uses: actions/upload-artifact@v4
3636
with:
3737
name: sbom-repository-report.json.zip
3838
path: ./sbom-repository-report.json.zip
@@ -47,7 +47,7 @@ runs:
4747
run: zip vulnerabilities-repository-report.json.zip vulnerabilities-repository-report.json
4848
- name: "Upload vulnerabilities report as an artefact"
4949
if: ${{ !env.ACT }}
50-
uses: actions/upload-artifact@v3
50+
uses: actions/upload-artifact@v4
5151
with:
5252
name: vulnerabilities-repository-report.json.zip
5353
path: ./vulnerabilities-repository-report.json.zip

‎.gitignore‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,4 +10,4 @@ version.json
1010
*.code-workspace
1111
!project.code-workspace
1212

13-
# Please, add your custom content below!
13+
infrastructure/modules/eventpub/lambda/*.zip

‎infrastructure/modules/eventpub/cloudwatch_log_group_kinesis_data_firehose.tf‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
resource "aws_cloudwatch_log_group" "kinesis_data_firehose" {
2+
count = var.enable_event_cache ? 1 : 0
3+
4+
name = "/aws/firehose/${local.csi}"
5+
kms_key_id = var.kms_key_arn
6+
retention_in_days = var.log_retention_in_days
7+
}
8+
9+
resource "aws_cloudwatch_log_stream" "kinesis_data_firehose_extended_s3" {
10+
count = var.enable_event_cache ? 1 : 0
11+
12+
name = "extended_s3"
13+
log_group_name = aws_cloudwatch_log_group.kinesis_data_firehose[0].name
14+
}

‎infrastructure/modules/eventpub/cloudwatch_log_group_lambda.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
resource "aws_cloudwatch_log_group" "lambda" {
2+
name = "/aws/lambda/${local.csi}"
3+
retention_in_days = var.log_retention_in_days
4+
kms_key_id = var.kms_key_arn
5+
}

‎infrastructure/modules/eventpub/cloudwatch_log_group_sns_delivery_logging_failure.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "aws_cloudwatch_log_group" "sns_delivery_logging_failure" {
2+
count = var.enable_sns_delivery_logging ? 1 : 0
3+
4+
# SNS doesn't allow specifying a log group and is derived as: sns/${region}/${account_id}/${name_of_sns_topic}/Failure
5+
# (for failure logs)
6+
name = "sns/${var.region}/${var.aws_account_id}/${local.csi}/Failure"
7+
kms_key_id = var.kms_key_arn
8+
retention_in_days = var.log_retention_in_days
9+
}

‎infrastructure/modules/eventpub/cloudwatch_log_group_sns_delivery_logging_success.tf‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
resource "aws_cloudwatch_log_group" "sns_delivery_logging_success" {
2+
count = var.enable_sns_delivery_logging ? 1 : 0
3+
4+
# SNS doesn't allow specifying a log group and is derived as: sns/${region}/${account_id}/${name_of_sns_topic}/Failure
5+
# (for failure logs)
6+
name = "sns/${var.region}/${var.aws_account_id}/${local.csi}"
7+
kms_key_id = var.kms_key_arn
8+
retention_in_days = var.log_retention_in_days
9+
}

‎infrastructure/modules/eventpub/data_archive_file_lambda.tf‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
data "archive_file" "lambda" {
2+
type = "zip"
3+
source_dir = "${path.module}/lambda/eventpub/src"
4+
output_path = "${path.module}/lambda/eventpub.zip"
5+
excludes = [
6+
# NodeJS Exclusions
7+
"**/__tests__",
8+
"**/node_modules",
9+
"**/package.json",
10+
"**/package-lock.json",
11+
]
12+
}

‎infrastructure/modules/eventpub/iam_policy_sns_delivery_logging_cloudwatch.tf‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
resource "aws_iam_policy" "sns_delivery_logging_cloudwatch" {
2+
count = var.enable_sns_delivery_logging ? 1 : 0
3+
4+
name = "${local.csi}-${var.name}-sns-delivery"
5+
description = "Policy for ${local.csi}-${var.name} SNS Delivery Logging"
6+
policy = data.aws_iam_policy_document.sns_delivery_logging_cloudwatch[0].json
7+
}
8+
9+
data "aws_iam_policy_document" "sns_delivery_logging_cloudwatch" {
10+
count = var.enable_sns_delivery_logging ? 1 : 0
11+
12+
statement {
13+
sid = "KMSCloudwatchKeyAccess"
14+
effect = "Allow"
15+
16+
actions = [
17+
"kms:GenerateDataKey",
18+
"kms:Decrypt",
19+
]
20+
21+
resources = [
22+
var.kms_key_arn
23+
]
24+
}
25+
26+
statement {
27+
sid = "AllowSNSDeliveryNotifications"
28+
effect = "Allow"
29+
30+
actions = [
31+
"logs:CreateLogStream",
32+
"logs:PutLogEvents",
33+
"logs:PutMetricFilter",
34+
"logs:PutRetentionPolicy",
35+
]
36+
37+
resources = [
38+
aws_cloudwatch_log_group.sns_delivery_logging_success[0].arn,
39+
"${aws_cloudwatch_log_group.sns_delivery_logging_success[0].arn}:log-stream:*",
40+
aws_cloudwatch_log_group.sns_delivery_logging_failure[0].arn,
41+
"${aws_cloudwatch_log_group.sns_delivery_logging_failure[0].arn}:log-stream:*",
42+
]
43+
}
44+
}

‎infrastructure/modules/eventpub/iam_role_firehose_role.tf‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
resource "aws_iam_role" "firehose_role" {
2+
count = var.enable_event_cache ? 1 : 0
3+
4+
name = "${local.csi}-firehose-role"
5+
assume_role_policy = data.aws_iam_policy_document.firehose_assume_role[0].json
6+
}
7+
8+
data "aws_iam_policy_document" "firehose_assume_role" {
9+
count = var.enable_event_cache ? 1 : 0
10+
11+
statement {
12+
effect = "Allow"
13+
14+
principals {
15+
type = "Service"
16+
identifiers = ["firehose.amazonaws.com"]
17+
}
18+
19+
actions = ["sts:AssumeRole"]
20+
}
21+
}
22+
23+
resource "aws_iam_role_policy_attachment" "s3_write_object" {
24+
count = var.enable_event_cache ? 1 : 0
25+
26+
role = aws_iam_role.firehose_role[0].name
27+
policy_arn = aws_iam_policy.s3_write_object[0].arn
28+
}
29+
30+
resource "aws_iam_policy" "s3_write_object" {
31+
count = var.enable_event_cache ? 1 : 0
32+
33+
name = "${local.csi}-${var.name}-s3-write-object"
34+
description = "S3 Put Object policy for ${local.csi}-${var.name} Firehose"
35+
policy = data.aws_iam_policy_document.s3_write_object[0].json
36+
}
37+
38+
data "aws_iam_policy_document" "s3_write_object" {
39+
count = var.enable_event_cache ? 1 : 0
40+
41+
statement {
42+
sid = "AllowWriteObject"
43+
effect = "Allow"
44+
45+
actions = [
46+
"s3:AbortMultipartUpload",
47+
"s3:GetBucketLocation",
48+
"s3:GetObject",
49+
"s3:ListBucket",
50+
"s3:ListBucketMultipartUploads",
51+
"s3:PutObject",
52+
"s3:PutObject",
53+
]
54+
55+
resources = [
56+
"${module.s3bucket_event_cache[0].arn}/*",
57+
]
58+
}
59+
}

0 commit comments

Comments
 (0)