Skip to content

Commit 674fc77

Browse files
eddalmond1eddalmond1
committed
Merge branch 'main' into feature/cicd-4-test.yaml
2 parents b990918 + f502b9b commit 674fc77

16 files changed

Lines changed: 296 additions & 122 deletions

‎infrastructure/Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ terraform-workspace-delete: guard-env guard-stack
3535

3636
# Runs a specified Terraform command (e.g., plan, apply) for the stack and environment.
3737
terraform: guard-env guard-stack guard-tf-command terraform-init terraform-workspace
38-
terraform -chdir=./stacks/$(stack) $(tf-command) $(args) \
38+
terraform -chdir=./stacks/$(stack) $(tf-command) $(args) -var="environment=$(env)" \
3939
$(if $(filter init,$(tf-command)),,--parallelism=30) \
4040
$(if $(filter apply,$(tf-command)),-auto-approve)
4141
rm -f ./terraform_outputs_$(stack).json || true
@@ -53,4 +53,4 @@ bootstrap-terraform-init: guard-env
5353

5454
# Runs a specified Terraform command (e.g., plan, apply) for the bootstrap stack.
5555
bootstrap-terraform: guard-env guard-tf-command bootstrap-terraform-init
56-
terraform -chdir=./stacks/bootstrap $(tf-command) $(args)
56+
terraform -chdir=./stacks/bootstrap $(tf-command) $(args) -var="environment=$(env)"

‎infrastructure/stacks/_shared/default_variables.tf‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,6 @@ variable "project_name" {
55
}
66

77
variable "environment" {
8-
default = "dev"
98
description = "Environment"
109
type = string
1110
}

‎infrastructure/stacks/api-layer/backends/preprod.api-layer.tfbackend‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
bucket = "eligibility-signposting-api-preprod-tfstate"
2+
key = "tfstate/api-layer.tfstate"
3+
region = "eu-west-2"
4+
encrypt = true
5+
use_lockfile = true

‎infrastructure/stacks/api-layer/backends/prod.api-layer.tfbackend‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
bucket = "eligibility-signposting-api-prod-tfstate"
2+
key = "tfstate/api-layer.tfstate"
3+
region = "eu-west-2"
4+
encrypt = true
5+
use_lockfile = true

‎infrastructure/stacks/api-layer/backends/test.api-layer.tfbackend‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
bucket = "eligibility-signposting-api-test-tfstate"
2+
key = "tfstate/api-layer.tfstate"
3+
region = "eu-west-2"
4+
encrypt = true
5+
use_lockfile = true

‎infrastructure/stacks/api-layer/cloudwatch_metrics.tf‎

Lines changed: 132 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,132 @@
1+
locals {
2+
cloudtrail_custom_metrics = [
3+
{
4+
name = "UnauthorizedApiCalls"
5+
namespace = "security"
6+
filter = "{($.errorCode=\"*UnauthorizedOperation\") || ($.errorCode=\"AccessDenied*\")}"
7+
log_group_name = "NHSDAudit_trail_log_group"
8+
},
9+
{
10+
name = "ConsoleAuthenticationFailures"
11+
namespace = "security"
12+
filter = "{($.eventName=ConsoleLogin) && ($.errorMessage=\"Failed authentication\")}"
13+
log_group_name = "NHSDAudit_trail_log_group"
14+
},
15+
{
16+
name = "CloudTrailConfigChanges"
17+
namespace = "security"
18+
filter = "{($.eventName=CreateTrail) || ($.eventName=UpdateTrail) || ($.eventName=DeleteTrail) || ($.eventName=StartLogging) || ($.eventName=StopLogging)}"
19+
log_group_name = "NHSDAudit_trail_log_group"
20+
},
21+
{
22+
name = "VPCChanges"
23+
namespace = "security"
24+
filter = "{($.eventName=CreateVpc) || ($.eventName=DeleteVpc) || ($.eventName=ModifyVpcAttribute) || ($.eventName=AcceptVpcPeeringConnection) || ($.eventName=CreateVpcPeeringConnection) || ($.eventName=DeleteVpcPeeringConnection) || ($.eventName=RejectVpcPeeringConnection) || ($.eventName=AttachClassicLinkVpc) || ($.eventName=DetachClassicLinkVpc) || ($.eventName=DisableVpcClassicLink) || ($.eventName=EnableVpcClassicLink)}"
25+
log_group_name = "NHSDAudit_trail_log_group"
26+
},
27+
{
28+
name = "AWSConfigChanges"
29+
namespace = "security"
30+
filter = "{($.eventSource=config.amazonaws.com) && (($.eventName=StopConfigurationRecorder) || ($.eventName=DeleteDeliveryChannel) || ($.eventName=PutDeliveryChannel) || ($.eventName=PutConfigurationRecorder))}"
31+
log_group_name = "NHSDAudit_trail_log_group"
32+
},
33+
{
34+
name = "ModificationOfCMKs"
35+
namespace = "security"
36+
filter = "{($.eventSource=kms.amazonaws.com) && (($.eventName=DisableKey) || ($.eventName=ScheduleKeyDeletion))}"
37+
log_group_name = "NHSDAudit_trail_log_group"
38+
},
39+
{
40+
name = "UnsuccessfulSwitchRole"
41+
namespace = "security"
42+
filter = "{ ( $.eventName = SwitchRole && $.responseElements.SwitchRole = Failure ) }"
43+
log_group_name = "NHSDAudit_trail_log_group"
44+
},
45+
{
46+
name = "ConsoleLoginNoMFA"
47+
namespace = "security"
48+
filter = "{ ($.eventName = \"ConsoleLogin\") && ($.additionalEventData.MFAUsed != \"Yes\") && ($.userIdentity.type = \"IAMUser\") && ($.responseElements.ConsoleLogin = \"Success\") }"
49+
log_group_name = "NHSDAudit_trail_log_group"
50+
},
51+
{
52+
name = "RootAccountUsage"
53+
namespace = "security"
54+
filter = "{$.userIdentity.type=\"Root\" && $.userIdentity.invokedBy NOT EXISTS && $.eventType !=\"AwsServiceEvent\"}"
55+
log_group_name = "NHSDAudit_trail_log_group"
56+
},
57+
{
58+
name = "SecurityGroupChange"
59+
namespace = "security"
60+
filter = "{($.eventName=AuthorizeSecurityGroupIngress) || ($.eventName=AuthorizeSecurityGroupEgress) || ($.eventName=RevokeSecurityGroupIngress) || ($.eventName=RevokeSecurityGroupEgress) || ($.eventName=CreateSecurityGroup) || ($.eventName=DeleteSecurityGroup)}"
61+
log_group_name = "NHSDAudit_trail_log_group"
62+
},
63+
{
64+
name = "RouteTableChanges"
65+
namespace = "security"
66+
filter = "{($.eventSource=ec2.amazonaws.com) && (($.eventName=CreateRoute) || ($.eventName=CreateRouteTable) || ($.eventName=ReplaceRoute) || ($.eventName=ReplaceRouteTableAssociation) || ($.eventName=DeleteRouteTable) || ($.eventName=DeleteRoute) || ($.eventName=DisassociateRouteTable))}"
67+
log_group_name = "NHSDAudit_trail_log_group"
68+
},
69+
{
70+
name = "IAMPolicyChanges"
71+
namespace = "security"
72+
filter = "{($.eventSource=iam.amazonaws.com) && (($.eventName=DeleteGroupPolicy) || ($.eventName=DeleteRolePolicy) || ($.eventName=DeleteUserPolicy) || ($.eventName=PutGroupPolicy) || ($.eventName=PutRolePolicy) || ($.eventName=PutUserPolicy) || ($.eventName=CreatePolicy) || ($.eventName=DeletePolicy) || ($.eventName=CreatePolicyVersion) || ($.eventName=DeletePolicyVersion) || ($.eventName=AttachRolePolicy) || ($.eventName=DetachRolePolicy) || ($.eventName=AttachUserPolicy) || ($.eventName=DetachUserPolicy) || ($.eventName=AttachGroupPolicy) || ($.eventName=DetachGroupPolicy))}"
73+
log_group_name = "NHSDAudit_trail_log_group"
74+
},
75+
{
76+
name = "s3BucketPolicyChanges"
77+
namespace = "security"
78+
filter = "{($.eventSource=s3.amazonaws.com) && (($.eventName=PutBucketAcl) || ($.eventName=PutBucketPolicy) || ($.eventName=PutBucketCors) || ($.eventName=PutBucketLifecycle) || ($.eventName=PutBucketReplication) || ($.eventName=DeleteBucketPolicy) || ($.eventName=DeleteBucketCors) || ($.eventName=DeleteBucketLifecycle) || ($.eventName=DeleteBucketReplication))}"
79+
log_group_name = "NHSDAudit_trail_log_group"
80+
},
81+
{
82+
name = "ChangesToNetworkGateways"
83+
namespace = "security"
84+
filter = "{($.eventName=CreateCustomerGateway) || ($.eventName=DeleteCustomerGateway) || ($.eventName=AttachInternetGateway) || ($.eventName=CreateInternetGateway) || ($.eventName=DeleteInternetGateway) || ($.eventName=DetachInternetGateway)}"
85+
log_group_name = "NHSDAudit_trail_log_group"
86+
},
87+
{
88+
name = "ChangesToNACLs"
89+
namespace = "security"
90+
filter = "{($.eventName=CreateNetworkAcl) || ($.eventName=CreateNetworkAclEntry) || ($.eventName=DeleteNetworkAcl) || ($.eventName=DeleteNetworkAclEntry) || ($.eventName=ReplaceNetworkAclEntry) || ($.eventName=ReplaceNetworkAclAssociation)}"
91+
log_group_name = "NHSDAudit_trail_log_group"
92+
},
93+
{
94+
name = "KMSKeyPolicyChanges"
95+
namespace = "security"
96+
filter = "{($.eventSource=kms.amazonaws.com) && (($.eventName=PutKeyPolicy) || ($.eventName=DeleteKeyPolicy))}"
97+
log_group_name = "NHSDAudit_trail_log_group"
98+
},
99+
{
100+
name = "s3PublicAccessChanges"
101+
namespace = "security"
102+
filter = "{($.eventSource=s3.amazonaws.com) && (($.eventName=PutBucketAcl) || ($.eventName=PutObjectAcl))}"
103+
log_group_name = "NHSDAudit_trail_log_group"
104+
},
105+
{
106+
name = "CloudWatchAlarmChanges"
107+
namespace = "security"
108+
filter = "{($.eventSource=cloudwatch.amazonaws.com) && (($.eventName=PutMetricAlarm) || ($.eventName=DeleteAlarms) || ($.eventName=SetAlarmState))}"
109+
log_group_name = "NHSDAudit_trail_log_group"
110+
},
111+
{
112+
name = "LambdaFunctionChanges"
113+
namespace = "security"
114+
filter = "{($.eventSource=lambda.amazonaws.com) && (($.eventName=CreateFunction20150331) || ($.eventName=DeleteFunction20150331) || ($.eventName=UpdateFunctionCode20150331) || ($.eventName=UpdateFunctionConfiguration20150331))}"
115+
log_group_name = "NHSDAudit_trail_log_group"
116+
},
117+
]
118+
}
119+
120+
resource "aws_cloudwatch_log_metric_filter" "cloudtrail_custom_metrics" {
121+
for_each = { for metric in local.cloudtrail_custom_metrics : metric.name => metric }
122+
123+
name = each.value.name
124+
log_group_name = each.value.log_group_name
125+
pattern = each.value.filter
126+
127+
metric_transformation {
128+
name = each.value.name
129+
namespace = each.value.namespace
130+
value = "1"
131+
}
132+
}

‎infrastructure/stacks/bootstrap/backends/preprod.bootstrap.tfbackend‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
bucket = "eligibility-signposting-api-preprod-tfstate"
2+
key = "terraform.tfstate"
3+
region = "eu-west-2"
4+
encrypt = true

‎infrastructure/stacks/bootstrap/backends/prod.bootstrap.tfbackend‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
bucket = "eligibility-signposting-api-prod-tfstate"
2+
key = "terraform.tfstate"
3+
region = "eu-west-2"
4+
encrypt = true

‎infrastructure/stacks/bootstrap/backends/test.bootstrap.tfbackend‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
bucket = "eligibility-signposting-api-test-tfstate"
2+
key = "terraform.tfstate"
3+
region = "eu-west-2"
4+
encrypt = true

‎infrastructure/stacks/iams-developer-roles/backends/prod.iams-developer-roles.tfbackend‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
bucket = "eligibility-signposting-api-prod-tfstate"
2+
key = "iams-roles.tfstate"
3+
region = "eu-west-2"
4+
encrypt = true

0 commit comments

Comments
 (0)