Skip to content

Commit ac5f495

Browse files
edhall-nhsedhall-nhs
authored
VED-1040: Terraform tidy (#1172)
* Consolidate lambda names to use hyphens Also tidy us hard coded aws regions and use vars instead * Revert to hard coded region in main.tf * Review comment * Review comment - add tf validation to aws region * Tidy up generic validator code from redis_sync lambda
1 parent 0f37f45 commit ac5f495

23 files changed

Lines changed: 128 additions & 150 deletions

‎infrastructure/account/csoc_eventforwarder_role.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ resource "aws_iam_role_policy" "eventbridge_forwarder_policy" {
2727
Effect = "Allow",
2828
Action = ["events:PutEvents"],
2929
Resource = [
30-
"arn:aws:events:eu-west-2:${var.csoc_account_id}:event-bus/shield-eventbus"
30+
"arn:aws:events:${var.aws_region}:${var.csoc_account_id}:event-bus/shield-eventbus"
3131
]
3232
}]
3333
})

‎infrastructure/account/endpoints.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
data "aws_ec2_managed_prefix_list" "egress" {
22
for_each = toset([
33
"com.amazonaws.global.cloudfront.origin-facing",
4-
"com.amazonaws.eu-west-2.dynamodb",
5-
"com.amazonaws.eu-west-2.s3"
4+
"com.amazonaws.${var.aws_region}.dynamodb",
5+
"com.amazonaws.${var.aws_region}.s3"
66
])
77

88
name = each.value

‎infrastructure/account/shield_protection.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ resource "aws_cloudwatch_event_rule" "shield_ddos_rule_regional" {
101101
resource "aws_cloudwatch_event_target" "shield_ddos_target_regional" {
102102
rule = aws_cloudwatch_event_rule.shield_ddos_rule_regional.name
103103
target_id = "csoc-eventbus"
104-
arn = "arn:aws:events:eu-west-2:${var.csoc_account_id}:event-bus/shield-eventbus"
104+
arn = "arn:aws:events:${var.aws_region}:${var.csoc_account_id}:event-bus/shield-eventbus"
105105
role_arn = aws_iam_role.eventbridge_forwarder_role.arn
106106
}
107107

‎infrastructure/instance/ack_lambda.tf‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,9 @@
11
# Define the directory containing the Docker image and calculate its SHA-256 hash for triggering redeployments
22
locals {
3-
ack_lambda_dir = abspath("${path.root}/../../lambdas/ack_backend")
4-
5-
ack_lambda_files = fileset(local.ack_lambda_dir, "**")
6-
3+
ack_lambda_dir = abspath("${path.root}/../../lambdas/ack_backend")
4+
ack_lambda_files = fileset(local.ack_lambda_dir, "**")
75
ack_lambda_dir_sha = sha1(join("", [for f in local.ack_lambda_files : filesha1("${local.ack_lambda_dir}/${f}")]))
8-
ack_lambda_name = "${local.short_prefix}-ack_lambda"
6+
ack_lambda_name = "${local.short_prefix}-ack-lambda"
97
}
108

119

@@ -72,7 +70,7 @@ resource "aws_ecr_repository_policy" "ack_lambda_ECRImageRetreival_policy" {
7270
],
7371
"Condition" : {
7472
"StringLike" : {
75-
"aws:sourceArn" : "arn:aws:lambda:eu-west-2:${var.immunisation_account_id}:function:${local.short_prefix}-ack-lambda"
73+
"aws:sourceArn" : "arn:aws:lambda:${var.aws_region}:${var.immunisation_account_id}:function:${local.ack_lambda_name}"
7674
}
7775
}
7876
}
@@ -82,7 +80,7 @@ resource "aws_ecr_repository_policy" "ack_lambda_ECRImageRetreival_policy" {
8280

8381
# IAM Role for Lambda
8482
resource "aws_iam_role" "ack_lambda_exec_role" {
85-
name = "${local.short_prefix}-ack-lambda-exec-role"
83+
name = "${local.ack_lambda_name}-exec-role"
8684
assume_role_policy = jsonencode({
8785
Version = "2012-10-17",
8886
Statement = [{
@@ -98,7 +96,7 @@ resource "aws_iam_role" "ack_lambda_exec_role" {
9896

9997
# Policy for Lambda execution role
10098
resource "aws_iam_policy" "ack_lambda_exec_policy" {
101-
name = "${local.short_prefix}-ack-lambda-exec-policy"
99+
name = "${local.ack_lambda_name}-exec-policy"
102100
policy = jsonencode({
103101
Version = "2012-10-17",
104102
Statement = [
@@ -109,7 +107,7 @@ resource "aws_iam_policy" "ack_lambda_exec_policy" {
109107
"logs:CreateLogStream",
110108
"logs:PutLogEvents"
111109
]
112-
Resource = "arn:aws:logs:eu-west-2:${var.immunisation_account_id}:log-group:/aws/lambda/${local.short_prefix}-ack-lambda:*"
110+
Resource = "arn:aws:logs:${var.aws_region}:${var.immunisation_account_id}:log-group:/aws/lambda/${local.ack_lambda_name}:*"
113111
},
114112
{
115113
Effect = "Allow"
@@ -145,7 +143,7 @@ resource "aws_iam_policy" "ack_lambda_exec_policy" {
145143
"sqs:DeleteMessage",
146144
"sqs:GetQueueAttributes"
147145
],
148-
Resource = "arn:aws:sqs:eu-west-2:${var.immunisation_account_id}:${local.short_prefix}-ack-metadata-queue.fifo" },
146+
Resource = "arn:aws:sqs:${var.aws_region}:${var.immunisation_account_id}:${local.short_prefix}-ack-metadata-queue.fifo" },
149147
{
150148
"Effect" : "Allow",
151149
"Action" : [
@@ -159,7 +157,7 @@ resource "aws_iam_policy" "ack_lambda_exec_policy" {
159157
}
160158

161159
resource "aws_cloudwatch_log_group" "ack_lambda_log_group" {
162-
name = "/aws/lambda/${local.short_prefix}-ack-lambda"
160+
name = "/aws/lambda/${local.ack_lambda_name}"
163161
retention_in_days = 30
164162
}
165163

@@ -200,7 +198,7 @@ resource "aws_iam_role_policy_attachment" "lambda_kms_policy_attachment" {
200198

201199
# Lambda Function with Security Group and VPC.
202200
resource "aws_lambda_function" "ack_processor_lambda" {
203-
function_name = "${local.short_prefix}-ack-lambda"
201+
function_name = local.ack_lambda_name
204202
role = aws_iam_role.ack_lambda_exec_role.arn
205203
package_type = "Image"
206204
image_uri = module.ack_processor_docker_image.image_uri

‎infrastructure/instance/batch_processor_filter_lambda.tf‎

Lines changed: 10 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ locals {
33
batch_processor_filter_lambda_dir = abspath("${path.root}/../../lambdas/batch_processor_filter")
44
batch_processor_filter_lambda_files = fileset(local.batch_processor_filter_lambda_dir, "**")
55
batch_processor_filter_lambda_dir_sha = sha1(join("", [for f in local.batch_processor_filter_lambda_files : filesha1("${local.batch_processor_filter_lambda_dir}/${f}")]))
6+
batch_processor_filter_lambda_name = "${local.short_prefix}-batch-processor-filter-lambda"
67
}
78

89
resource "aws_ecr_repository" "batch_processor_filter_lambda_repository" {
@@ -69,7 +70,7 @@ resource "aws_ecr_repository_policy" "batch_processor_filter_lambda_ECRImageRetr
6970
],
7071
"Condition" : {
7172
"StringLike" : {
72-
"aws:sourceArn" : "arn:aws:lambda:${var.aws_region}:${var.immunisation_account_id}:function:${local.short_prefix}-batch-processor-filter-lambda"
73+
"aws:sourceArn" : "arn:aws:lambda:${var.aws_region}:${var.immunisation_account_id}:function:${local.batch_processor_filter_lambda_name}"
7374
}
7475
}
7576
}
@@ -79,7 +80,7 @@ resource "aws_ecr_repository_policy" "batch_processor_filter_lambda_ECRImageRetr
7980

8081
# IAM Role for Lambda
8182
resource "aws_iam_role" "batch_processor_filter_lambda_exec_role" {
82-
name = "${local.short_prefix}-batch-processor-filter-lambda-exec-role"
83+
name = "${local.batch_processor_filter_lambda_name}-exec-role"
8384
assume_role_policy = jsonencode({
8485
Version = "2012-10-17",
8586
Statement = [{
@@ -95,7 +96,7 @@ resource "aws_iam_role" "batch_processor_filter_lambda_exec_role" {
9596

9697
# Policy for Lambda execution role
9798
resource "aws_iam_policy" "batch_processor_filter_lambda_exec_policy" {
98-
name = "${local.short_prefix}-batch-processor-filter-lambda-exec-policy"
99+
name = "${local.batch_processor_filter_lambda_name}-exec-policy"
99100
policy = jsonencode({
100101
Version = "2012-10-17",
101102
Statement = [
@@ -106,7 +107,7 @@ resource "aws_iam_policy" "batch_processor_filter_lambda_exec_policy" {
106107
"logs:CreateLogStream",
107108
"logs:PutLogEvents"
108109
]
109-
Resource = "arn:aws:logs:${var.aws_region}:${var.immunisation_account_id}:log-group:/aws/lambda/${local.short_prefix}-batch-processor-filter-lambda:*"
110+
Resource = "arn:aws:logs:${var.aws_region}:${var.immunisation_account_id}:log-group:/aws/lambda/${local.batch_processor_filter_lambda_name}:*"
110111
},
111112
{
112113
Effect = "Allow",
@@ -157,7 +158,7 @@ resource "aws_iam_policy" "batch_processor_filter_lambda_exec_policy" {
157158

158159
# Policy for Lambda to interact with SQS
159160
resource "aws_iam_policy" "batch_processor_filter_lambda_sqs_policy" {
160-
name = "${local.short_prefix}-batch-processor-filter-lambda-sqs-policy"
161+
name = "${local.batch_processor_filter_lambda_name}-sqs-policy"
161162

162163
policy = jsonencode({
163164
Version = "2012-10-17",
@@ -183,7 +184,7 @@ resource "aws_iam_policy" "batch_processor_filter_lambda_sqs_policy" {
183184
}
184185

185186
resource "aws_iam_policy" "batch_processor_filter_lambda_kms_access_policy" {
186-
name = "${local.short_prefix}-batch-processor-filter-lambda-kms-policy"
187+
name = "${local.batch_processor_filter_lambda_name}-kms-policy"
187188
description = "Allow Lambda to decrypt environment variables"
188189

189190
policy = jsonencode({
@@ -261,7 +262,7 @@ resource "aws_iam_role_policy_attachment" "batch_processor_filter_lambda_dynamo_
261262

262263
# Lambda Function with Security Group and VPC.
263264
resource "aws_lambda_function" "batch_processor_filter_lambda" {
264-
function_name = "${local.short_prefix}-batch-processor-filter-lambda"
265+
function_name = local.batch_processor_filter_lambda_name
265266
role = aws_iam_role.batch_processor_filter_lambda_exec_role.arn
266267
package_type = "Image"
267268
image_uri = module.batch_processor_filter_docker_image.image_uri
@@ -293,7 +294,7 @@ resource "aws_lambda_function" "batch_processor_filter_lambda" {
293294
}
294295

295296
resource "aws_cloudwatch_log_group" "batch_processor_filter_lambda_log_group" {
296-
name = "/aws/lambda/${local.short_prefix}-batch-processor-filter-lambda"
297+
name = "/aws/lambda/${local.batch_processor_filter_lambda_name}"
297298
retention_in_days = 30
298299
}
299300

@@ -322,7 +323,7 @@ resource "aws_cloudwatch_log_metric_filter" "batch_processor_filter_error_logs"
322323
resource "aws_cloudwatch_metric_alarm" "batch_processor_filter_error_alarm" {
323324
count = var.error_alarm_notifications_enabled ? 1 : 0
324325

325-
alarm_name = "${local.short_prefix}-batch-processor-filter-lambda-error"
326+
alarm_name = "${local.batch_processor_filter_lambda_name}-error"
326327
comparison_operator = "GreaterThanOrEqualToThreshold"
327328
evaluation_periods = 1
328329
metric_name = "${local.short_prefix}-BatchProcessorFilterErrorLogs"

‎infrastructure/instance/delta.tf‎

Lines changed: 22 additions & 27 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,9 @@
11
locals {
2-
delta_lambda_dir = abspath("${path.root}/../../lambdas/delta_backend")
3-
delta_files = fileset(local.delta_lambda_dir, "**")
4-
delta_dir_sha = sha1(join("", [for f in local.delta_files : filesha1("${local.delta_lambda_dir}/${f}")]))
5-
function_name = "delta"
6-
dlq_name = "delta-dlq"
7-
sns_name = "delta-sns"
2+
delta_lambda_dir = abspath("${path.root}/../../lambdas/delta_backend")
3+
delta_files = fileset(local.delta_lambda_dir, "**")
4+
delta_dir_sha = sha1(join("", [for f in local.delta_files : filesha1("${local.delta_lambda_dir}/${f}")]))
5+
delta_lambda_name = "${local.short_prefix}-delta-lambda"
6+
dlq_name = "delta-dlq"
87
}
98

109
resource "aws_ecr_repository" "delta_lambda_repository" {
@@ -71,7 +70,7 @@ resource "aws_ecr_repository_policy" "delta_lambda_ECRImageRetreival_policy" {
7170
],
7271
"Condition" : {
7372
"StringLike" : {
74-
"aws:sourceArn" : "arn:aws:lambda:eu-west-2:${var.immunisation_account_id}:function:${local.short_prefix}-${local.function_name}"
73+
"aws:sourceArn" : "arn:aws:lambda:${var.aws_region}:${var.immunisation_account_id}:function:${local.delta_lambda_name}"
7574
}
7675
}
7776
}
@@ -101,33 +100,29 @@ data "aws_iam_policy_document" "delta_policy_document" {
101100
}
102101

103102
resource "aws_iam_role" "delta_lambda_role" {
104-
name = "${local.short_prefix}-${local.function_name}-role"
105-
assume_role_policy = <<EOF
106-
{
107-
"Version": "2012-10-17",
108-
"Statement": [
109-
{
110-
"Action": "sts:AssumeRole",
111-
"Principal": {
112-
"Service": "lambda.amazonaws.com"
103+
name = "${local.delta_lambda_name}-role"
104+
assume_role_policy = jsonencode({
105+
Version = "2012-10-17",
106+
Statement = [{
107+
Effect = "Allow",
108+
Sid = "",
109+
Principal = {
110+
Service = "lambda.amazonaws.com"
113111
},
114-
"Effect": "Allow",
115-
"Sid": ""
116-
}
117-
]
118-
}
119-
EOF
112+
Action = "sts:AssumeRole"
113+
}]
114+
})
120115
}
121116

122117
resource "aws_iam_role_policy" "lambda_role_policy" {
123-
name = "${local.prefix}-${local.function_name}-policy"
118+
name = "${local.prefix}-delta-policy"
124119
role = aws_iam_role.delta_lambda_role.id
125120
policy = data.aws_iam_policy_document.delta_policy_document.json
126121
}
127122

128123

129124
resource "aws_lambda_function" "delta_sync_lambda" {
130-
function_name = "${local.short_prefix}-${local.function_name}"
125+
function_name = local.delta_lambda_name
131126
role = aws_iam_role.delta_lambda_role.arn
132127
package_type = "Image"
133128
architectures = ["x86_64"]
@@ -168,7 +163,7 @@ resource "aws_sqs_queue" "dlq" {
168163
}
169164

170165
resource "aws_cloudwatch_log_group" "delta_lambda" {
171-
name = "/aws/lambda/${local.short_prefix}-${local.function_name}"
166+
name = "/aws/lambda/${local.delta_lambda_name}"
172167
retention_in_days = 30
173168
}
174169

@@ -190,7 +185,7 @@ resource "aws_cloudwatch_log_metric_filter" "delta_error_logs" {
190185
resource "aws_cloudwatch_metric_alarm" "delta_error_alarm" {
191186
count = var.error_alarm_notifications_enabled ? 1 : 0
192187

193-
alarm_name = "${local.short_prefix}-delta-lambda-error"
188+
alarm_name = "${local.delta_lambda_name}-error"
194189
comparison_operator = "GreaterThanOrEqualToThreshold"
195190
evaluation_periods = 1
196191
metric_name = "${local.short_prefix}-DeltaErrorLogs"
@@ -201,4 +196,4 @@ resource "aws_cloudwatch_metric_alarm" "delta_error_alarm" {
201196
alarm_description = "This sets off an alarm for any error logs found in the delta Lambda function"
202197
alarm_actions = [data.aws_sns_topic.imms_system_alert_errors.arn]
203198
treat_missing_data = "notBreaching"
204-
}
199+
}

‎infrastructure/instance/endpoints.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ locals {
3030
# except for prod and ref, any other env uses PDS int environment
3131
"PDS_ENV" = var.pds_environment
3232
"SPLUNK_FIREHOSE_NAME" = module.splunk.firehose_stream_name
33-
"SQS_QUEUE_URL" = "https://sqs.eu-west-2.amazonaws.com/${var.immunisation_account_id}/${local.short_prefix}-ack-metadata-queue.fifo"
33+
"SQS_QUEUE_URL" = "https://sqs.${var.aws_region}.amazonaws.com/${var.immunisation_account_id}/${local.short_prefix}-ack-metadata-queue.fifo"
3434
"REDIS_HOST" = data.aws_elasticache_cluster.existing_redis.cache_nodes[0].address
3535
"REDIS_PORT" = data.aws_elasticache_cluster.existing_redis.cache_nodes[0].port
3636
}

‎infrastructure/instance/file_name_processor.tf‎

Lines changed: 11 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@ locals {
33
filename_lambda_dir = abspath("${path.root}/../../lambdas/filenameprocessor")
44
filename_lambda_files = fileset(local.filename_lambda_dir, "**")
55
filename_lambda_dir_sha = sha1(join("", [for f in local.filename_lambda_files : filesha1("${local.filename_lambda_dir}/${f}")]))
6+
filename_lambda_name = "${local.short_prefix}-filenameproc-lambda"
7+
68
dps_bucket_name_for_extended_attribute = (
79
var.environment == "prod"
810
? "nhsd-dspp-core-prod-extended-attributes-gdp"
@@ -79,7 +81,7 @@ resource "aws_ecr_repository_policy" "filenameprocessor_lambda_ECRImageRetreival
7981
],
8082
"Condition" : {
8183
"StringLike" : {
82-
"aws:sourceArn" : "arn:aws:lambda:eu-west-2:${var.immunisation_account_id}:function:${local.short_prefix}-filenameproc_lambda"
84+
"aws:sourceArn" : "arn:aws:lambda:${var.aws_region}:${var.immunisation_account_id}:function:${local.filename_lambda_name}"
8385
}
8486
}
8587
}
@@ -89,7 +91,7 @@ resource "aws_ecr_repository_policy" "filenameprocessor_lambda_ECRImageRetreival
8991

9092
# IAM Role for Lambda
9193
resource "aws_iam_role" "filenameprocessor_lambda_exec_role" {
92-
name = "${local.short_prefix}-filenameproc-lambda-exec-role"
94+
name = "${local.filename_lambda_name}-exec-role"
9395
assume_role_policy = jsonencode({
9496
Version = "2012-10-17",
9597
Statement = [{
@@ -105,7 +107,7 @@ resource "aws_iam_role" "filenameprocessor_lambda_exec_role" {
105107

106108
# Policy for Lambda execution role
107109
resource "aws_iam_policy" "filenameprocessor_lambda_exec_policy" {
108-
name = "${local.short_prefix}-filenameproc-lambda-exec-policy"
110+
name = "${local.filename_lambda_name}-exec-policy"
109111
policy = jsonencode({
110112
Version = "2012-10-17",
111113
Statement = [
@@ -116,7 +118,7 @@ resource "aws_iam_policy" "filenameprocessor_lambda_exec_policy" {
116118
"logs:CreateLogStream",
117119
"logs:PutLogEvents"
118120
]
119-
Resource = "arn:aws:logs:${var.aws_region}:${var.immunisation_account_id}:log-group:/aws/lambda/${local.short_prefix}-filenameproc_lambda:*"
121+
Resource = "arn:aws:logs:${var.aws_region}:${var.immunisation_account_id}:log-group:/aws/lambda/${local.filename_lambda_name}:*"
120122
},
121123
{
122124
Effect = "Allow"
@@ -186,7 +188,7 @@ resource "aws_iam_policy" "filenameprocessor_lambda_exec_policy" {
186188

187189
# Policy for Lambda to interact with SQS
188190
resource "aws_iam_policy" "filenameprocessor_lambda_sqs_policy" {
189-
name = "${local.short_prefix}-filenameproc-lambda-sqs-policy"
191+
name = "${local.filename_lambda_name}-sqs-policy"
190192

191193
policy = jsonencode({
192194
Version = "2012-10-17",
@@ -201,7 +203,7 @@ resource "aws_iam_policy" "filenameprocessor_lambda_sqs_policy" {
201203
}
202204

203205
resource "aws_iam_policy" "filenameprocessor_lambda_kms_access_policy" {
204-
name = "${local.short_prefix}-filenameproc-lambda-kms-policy"
206+
name = "${local.filename_lambda_name}-kms-policy"
205207
description = "Allow Lambda to decrypt environment variables"
206208

207209
policy = jsonencode({
@@ -268,7 +270,7 @@ resource "aws_iam_policy" "filenameprocessor_dps_extended_attribute_kms_policy"
268270
"kms:GenerateDataKey",
269271
"kms:DescribeKey"
270272
],
271-
Resource = "arn:aws:kms:eu-west-2:${var.dspp_core_account_id}:key/*",
273+
Resource = "arn:aws:kms:${var.aws_region}:${var.dspp_core_account_id}:key/*",
272274
"Condition" = {
273275
"ForAnyValue:StringEquals" = {
274276
"kms:ResourceAliases" = "alias/${var.dspp_kms_key_alias}"
@@ -311,7 +313,7 @@ resource "aws_iam_role_policy_attachment" "filenameprocessor_lambda_dynamo_acces
311313

312314
# Lambda Function with Security Group and VPC.
313315
resource "aws_lambda_function" "file_processor_lambda" {
314-
function_name = "${local.short_prefix}-filenameproc_lambda"
316+
function_name = local.filename_lambda_name
315317
role = aws_iam_role.filenameprocessor_lambda_exec_role.arn
316318
package_type = "Image"
317319
image_uri = module.file_processor_docker_image.image_uri
@@ -371,7 +373,7 @@ resource "aws_s3_bucket_notification" "datasources_lambda_notification" {
371373
}
372374

373375
resource "aws_cloudwatch_log_group" "file_name_processor_log_group" {
374-
name = "/aws/lambda/${local.short_prefix}-filenameproc_lambda"
376+
name = "/aws/lambda/${local.filename_lambda_name}"
375377
retention_in_days = 30
376378
}
377379

0 commit comments

Comments
 (0)