Skip to content

Commit 32855d4

Browse files
Thomas-BoyleThomas-Boyle
committed
Refactor Lambda infrastructure by removing ECR repository and lifecycle policy configurations
- Deleted ECR repository configurations for record processor, batch processor filter, delta, filename processor, id sync, forwarder, redis sync, and mesh processor Lambdas. - Removed associated ECR lifecycle policies for the above Lambdas. - Updated Lambda functions to use image URIs directly from variables instead of modules. - Added new variables for backend, batch processor filter, delta, filename processor, id sync, mesh processor, MNS publisher, record forwarder, and redis sync Lambda image URIs to ensure CI/CD integration. - Cleaned up shared Lambda configurations and removed unused local variables.
1 parent f8a0f1f commit 32855d4

21 files changed

Lines changed: 482 additions & 807 deletions

‎.github/workflows/deploy-backend.yml‎

Lines changed: 51 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ on:
99
lambda_build_flags:
1010
description: >
1111
JSON map of lambda_name -> force-build flag.
12-
e.g. {"recordprocessor":true,"ack-backend":false}
12+
e.g. {"backend":true,"recordprocessor":true,"ack-backend":false}
1313
required: false
1414
type: string
1515
default: "{}"
@@ -73,14 +73,14 @@ on:
7373
lambda_build_flags:
7474
description: >
7575
JSON map of lambda_name -> force-build flag.
76-
e.g. {"recordprocessor":true,"ack-backend":false}
76+
e.g. {"backend":true,"recordprocessor":true,"ack-backend":false}
7777
required: false
7878
type: string
7979
default: "{}"
8080
lambda_image_overrides:
8181
description: >
8282
JSON map of lambda_name -> immutable image selector for reuse mode.
83-
e.g. {"recordprocessor":"internal-dev-git-abc123","ack-backend":"123456789012.dkr.ecr.eu-west-2.amazonaws.com/imms-ackbackend-repo@sha256:..."}
83+
e.g. {"backend":"internal-dev-git-abc123","ack-backend":"123456789012.dkr.ecr.eu-west-2.amazonaws.com/imms-ackbackend-repo@sha256:..."}
8484
required: false
8585
type: string
8686
default: "{}"
@@ -118,18 +118,61 @@ jobs:
118118
fail-fast: false
119119
matrix:
120120
include:
121+
- lambda_name: backend
122+
tf_var_suffix: backend
123+
ecr_repository: imms-fhir-api-operation-lambda-repo
124+
dockerfile_path: lambdas/backend/Dockerfile
125+
lambda_paths: lambdas/backend/
126+
- lambda_name: batch_processor_filter
127+
tf_var_suffix: batch_processor_filter
128+
ecr_repository: imms-batch-processor-filter-repo
129+
dockerfile_path: lambdas/batch_processor_filter/Dockerfile
130+
lambda_paths: lambdas/batch_processor_filter/
131+
- lambda_name: delta_backend
132+
tf_var_suffix: delta_backend
133+
ecr_repository: imms-fhir-api-delta-lambda-repo
134+
dockerfile_path: lambdas/delta_backend/Dockerfile
135+
lambda_paths: lambdas/delta_backend/
136+
- lambda_name: filenameprocessor
137+
tf_var_suffix: filenameprocessor
138+
ecr_repository: imms-filenameproc-repo
139+
dockerfile_path: lambdas/filenameprocessor/Dockerfile
140+
lambda_paths: lambdas/filenameprocessor/
141+
- lambda_name: id_sync
142+
tf_var_suffix: id_sync
143+
ecr_repository: imms-id-sync-repo
144+
dockerfile_path: lambdas/id_sync/Dockerfile
145+
lambda_paths: lambdas/id_sync/
146+
- lambda_name: mesh_processor
147+
tf_var_suffix: mesh_processor
148+
ecr_repository: imms-mesh-processor-repo
149+
dockerfile_path: lambdas/mesh_processor/Dockerfile
150+
lambda_paths: lambdas/mesh_processor/
151+
- lambda_name: mns_publisher
152+
tf_var_suffix: mns_publisher
153+
ecr_repository: imms-mns-publisher-repo
154+
dockerfile_path: lambdas/mns_publisher/Dockerfile
155+
lambda_paths: lambdas/mns_publisher/
156+
- lambda_name: recordforwarder
157+
tf_var_suffix: recordforwarder
158+
ecr_repository: imms-forwarding-repo
159+
dockerfile_path: lambdas/recordforwarder/Dockerfile
160+
lambda_paths: lambdas/recordforwarder/
161+
- lambda_name: redis_sync
162+
tf_var_suffix: redis_sync
163+
ecr_repository: imms-redis-sync-repo
164+
dockerfile_path: lambdas/redis_sync/Dockerfile
165+
lambda_paths: lambdas/redis_sync/
121166
- lambda_name: recordprocessor
122167
tf_var_suffix: recordprocessor
123168
ecr_repository: imms-recordprocessor-repo
124169
dockerfile_path: lambdas/recordprocessor/Dockerfile
125-
lambda_paths: |
126-
lambdas/recordprocessor/
170+
lambda_paths: lambdas/recordprocessor/
127171
- lambda_name: ack-backend
128172
tf_var_suffix: ack_backend
129173
ecr_repository: imms-ackbackend-repo
130174
dockerfile_path: lambdas/ack_backend/Dockerfile
131-
lambda_paths: |
132-
lambdas/ack_backend/
175+
lambda_paths: lambdas/ack_backend/
133176
uses: ./.github/workflows/deploy-lambda-artifact.yml
134177
with:
135178
lambda_name: ${{ matrix.lambda_name }}
@@ -142,8 +185,7 @@ jobs:
142185
diff_base_sha: ${{ inputs.diff_base_sha }}
143186
diff_head_sha: ${{ inputs.diff_head_sha }}
144187
lambda_paths: ${{ matrix.lambda_paths }}
145-
shared_paths: |
146-
lambdas/shared/src/common/
188+
shared_paths: lambdas/shared/src/common/
147189
docker_context_path: lambdas
148190
dockerfile_path: ${{ matrix.dockerfile_path }}
149191
ecr_repository: ${{ matrix.ecr_repository }}

‎.github/workflows/pr-deploy-and-test.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,6 @@ jobs:
2020
uses: ./.github/workflows/deploy-backend.yml
2121
with:
2222
apigee_environment: internal-dev
23-
lambda_build_flags: >-
24-
${{ (github.event.action == 'opened' || github.event.action == 'reopened')
25-
&& '{"recordprocessor":true,"ack-backend":true}'
26-
|| '{}' }}
2723
diff_base_sha: ${{ github.event.action == 'synchronize' && github.event.before || github.event.pull_request.base.sha }}
2824
diff_head_sha: ${{ github.event.pull_request.head.sha }}
2925
run_diff_check: ${{ github.event.action == 'synchronize' }}

‎.github/workflows/pr-teardown.yml‎

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,18 @@ jobs:
2020
APIGEE_ENVIRONMENT: internal-dev
2121
BACKEND_ENVIRONMENT: dev
2222
BACKEND_SUB_ENVIRONMENT: pr-${{ github.event_name == 'pull_request' && github.event.pull_request.number || inputs.pr_number }}
23+
LAMBDA_IMAGE_BINDINGS: |
24+
backend_image_uri:imms-fhir-api-operation-lambda-repo
25+
batch_processor_filter_image_uri:imms-batch-processor-filter-repo
26+
delta_backend_image_uri:imms-fhir-api-delta-lambda-repo
27+
filenameprocessor_image_uri:imms-filenameproc-repo
28+
id_sync_image_uri:imms-id-sync-repo
29+
mesh_processor_image_uri:imms-mesh-processor-repo
30+
mns_publisher_image_uri:imms-mns-publisher-repo
31+
recordprocessor_image_uri:imms-recordprocessor-repo
32+
recordforwarder_image_uri:imms-forwarding-repo
33+
ack_backend_image_uri:imms-ackbackend-repo
34+
redis_sync_image_uri:imms-redis-sync-repo
2335
permissions:
2436
id-token: write
2537
contents: read
@@ -53,8 +65,10 @@ jobs:
5365
local uri="$(make -s output "name=$1" 2>/dev/null || true)"
5466
echo "${uri:-placeholder.dkr.ecr.eu-west-2.amazonaws.com/$2@sha256:0000000000000000000000000000000000000000000000000000000000000000}"
5567
}
56-
echo "TF_VAR_recordprocessor_image_uri=$(resolve_or_placeholder recordprocessor_image_uri imms-recordprocessor-repo)" >> $GITHUB_ENV
57-
echo "TF_VAR_ack_backend_image_uri=$(resolve_or_placeholder ack_backend_image_uri imms-ackbackend-repo)" >> $GITHUB_ENV
68+
while IFS=: read -r output_name repository_name; do
69+
[ -n "${output_name}" ] || continue
70+
echo "TF_VAR_${output_name}=$(resolve_or_placeholder "${output_name}" "${repository_name}")" >> $GITHUB_ENV
71+
done <<< "${LAMBDA_IMAGE_BINDINGS}"
5872
5973
- name: Install poetry
6074
run: pip install poetry==2.1.4
@@ -129,6 +143,7 @@ jobs:
129143
--output json
130144
}
131145
132-
for repository_name in imms-recordprocessor-repo imms-ackbackend-repo; do
146+
while IFS=: read -r _ repository_name; do
147+
[ -n "${repository_name}" ] || continue
133148
cleanup_repo_by_prefix "${repository_name}"
134-
done
149+
done <<< "${LAMBDA_IMAGE_BINDINGS}"

‎infrastructure/account/ackbackend_ecr_repo.tf‎

Lines changed: 0 additions & 33 deletions
This file was deleted.

‎infrastructure/account/lambda_ecr_repos.tf‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
locals {
2+
lambda_source_arn_prefix = "arn:aws:lambda:${var.aws_region}:${var.imms_account_id}:function:imms-"
3+
lambda_image_retrieval_actions = [
4+
"ecr:BatchGetImage",
5+
"ecr:GetDownloadUrlForLayer"
6+
]
7+
recordprocessor_lifecycle_policy = jsonencode({
8+
rules = [
9+
{
10+
rulePriority = 1
11+
description = "Keep last 10 images."
12+
selection = {
13+
tagStatus = "any"
14+
countType = "imageCountMoreThan"
15+
countNumber = 10
16+
}
17+
action = {
18+
type = "expire"
19+
}
20+
}
21+
]
22+
})
23+
}
24+
25+
locals {
26+
lambda_ecr_repositories = {
27+
operation = {
28+
name = "imms-fhir-api-operation-lambda-repo"
29+
lambda_source_names = [
30+
"*_get_status",
31+
"*_not_found",
32+
"*_search_imms",
33+
"*_get_imms",
34+
"*_delete_imms",
35+
"*_create_imms",
36+
"*_update_imms"
37+
]
38+
}
39+
batch_processor_filter = {
40+
name = "imms-batch-processor-filter-repo"
41+
lambda_source_names = ["*-batch-processor-filter-lambda"]
42+
}
43+
delta = {
44+
name = "imms-fhir-api-delta-lambda-repo"
45+
lambda_source_names = ["*-delta-lambda"]
46+
}
47+
filenameprocessor = {
48+
name = "imms-filenameproc-repo"
49+
lambda_source_names = ["*-filenameproc-lambda"]
50+
}
51+
id_sync = {
52+
name = "imms-id-sync-repo"
53+
lambda_source_names = ["*-id-sync-lambda"]
54+
}
55+
mesh_processor = {
56+
name = "imms-mesh-processor-repo"
57+
lambda_source_names = ["*-mesh-processor-lambda"]
58+
}
59+
mns_publisher = {
60+
name = "imms-mns-publisher-repo"
61+
lambda_source_names = ["*-mns-publisher-lambda"]
62+
}
63+
ack_backend = {
64+
name = "imms-ackbackend-repo"
65+
lambda_source_names = ["*-ack-lambda"]
66+
}
67+
recordforwarder = {
68+
name = "imms-forwarding-repo"
69+
lambda_source_names = ["*-forwarding-lambda"]
70+
}
71+
recordprocessor = {
72+
name = "imms-recordprocessor-repo"
73+
lifecycle_policy = local.recordprocessor_lifecycle_policy
74+
}
75+
redis_sync = {
76+
name = "imms-redis-sync-repo"
77+
lambda_source_names = ["*-redis-sync-lambda"]
78+
}
79+
}
80+
}
81+
82+
resource "aws_ecr_repository" "lambda_repository" {
83+
for_each = local.lambda_ecr_repositories
84+
85+
image_scanning_configuration {
86+
scan_on_push = true
87+
}
88+
89+
image_tag_mutability = "IMMUTABLE"
90+
name = each.value.name
91+
}
92+
93+
resource "aws_ecr_repository_policy" "lambda_repository_image_retrieval_policy" {
94+
for_each = {
95+
for key, repo in local.lambda_ecr_repositories : key => repo if try(repo.lambda_source_names, null) != null
96+
}
97+
98+
repository = aws_ecr_repository.lambda_repository[each.key].name
99+
100+
policy = jsonencode({
101+
Version = "2012-10-17"
102+
Statement = [
103+
{
104+
Sid = "LambdaECRImageRetrievalPolicy"
105+
Effect = "Allow"
106+
Principal = {
107+
Service = "lambda.amazonaws.com"
108+
}
109+
Action = local.lambda_image_retrieval_actions
110+
Condition = {
111+
StringLike = {
112+
"aws:sourceArn" = formatlist("${local.lambda_source_arn_prefix}%s", each.value.lambda_source_names)
113+
}
114+
}
115+
}
116+
]
117+
})
118+
}
119+
120+
resource "aws_ecr_lifecycle_policy" "lambda_repository_lifecycle_policy" {
121+
for_each = {
122+
for key, repo in local.lambda_ecr_repositories : key => repo if try(repo.lifecycle_policy, null) != null
123+
}
124+
125+
repository = aws_ecr_repository.lambda_repository[each.key].name
126+
policy = each.value.lifecycle_policy
127+
}
128+
129+
moved {
130+
from = aws_ecr_repository.ackbackend_repository
131+
to = aws_ecr_repository.lambda_repository["ack_backend"]
132+
}
133+
134+
moved {
135+
from = aws_ecr_repository_policy.ackbackend_repository_lambda_image_retrieval_policy
136+
to = aws_ecr_repository_policy.lambda_repository_image_retrieval_policy["ack_backend"]
137+
}
138+
139+
moved {
140+
from = aws_ecr_repository.recordprocessor_repository
141+
to = aws_ecr_repository.lambda_repository["recordprocessor"]
142+
}
143+
144+
moved {
145+
from = aws_ecr_lifecycle_policy.recordprocessor_repository_lifecycle_policy
146+
to = aws_ecr_lifecycle_policy.lambda_repository_lifecycle_policy["recordprocessor"]
147+
}

‎infrastructure/account/recordprocessor_ecr_repo.tf‎

Lines changed: 0 additions & 30 deletions
This file was deleted.

0 commit comments

Comments
 (0)