national-document-repository-infrastructure/infrastructure/api_mtls.tf at 908dad4d6c556b0e71729aa5d2b05e5e1b7ee54c · NHSDigital/national-document-repository-infrastructure · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
# New API Gateway for mTLS
resource "aws_api_gateway_rest_api" "ndr_doc_store_api_mtls" {
  name                         = "${terraform.workspace}_DocStoreApiMtls"
  description                  = "Document store API with mTLS enabled"
  disable_execute_api_endpoint = true

  endpoint_configuration {
    types = ["REGIONAL"]
  }

  tags = {
    Name = "${terraform.workspace}_DocStoreApiMtls"
  }
}

resource "aws_api_gateway_domain_name" "custom_api_domain_mtls" {
  domain_name              = local.mtls_api_gateway_full_domain_name
  regional_certificate_arn = aws_acm_certificate_validation.mtls_api_gateway_cert.certificate_arn
  security_policy          = "TLS_1_2"

  endpoint_configuration {
    types = ["REGIONAL"]
  }

  mutual_tls_authentication {
    truststore_uri     = local.truststore_uri
    truststore_version = data.aws_s3_object.truststore_ext_cert.version_id
  }
}

resource "aws_api_gateway_base_path_mapping" "api_mapping_mtls" {
  api_id      = aws_api_gateway_rest_api.ndr_doc_store_api_mtls.id
  stage_name  = var.environment
  domain_name = aws_api_gateway_domain_name.custom_api_domain_mtls.domain_name

  depends_on = [aws_api_gateway_deployment.ndr_api_deploy_mtls]
}

resource "aws_api_gateway_deployment" "ndr_api_deploy_mtls" {
  rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api_mtls.id

  depends_on = [
    aws_api_gateway_rest_api.ndr_doc_store_api_mtls,
    aws_api_gateway_resource.get_document_reference_mtls,
    module.get-doc-fhir-lambda,
    aws_api_gateway_integration.get_doc_fhir_lambda_integration,
    aws_lambda_permission.lambda_permission_get_mtls_api,
    module.post-document-references-fhir-lambda,
    aws_api_gateway_integration.post_doc_fhir_lambda_integration,
    aws_lambda_permission.lambda_permission_post_mtls_api,
    module.search-document-references-fhir-lambda,
    aws_api_gateway_integration.search_doc_fhir_lambda_integration,
    aws_lambda_permission.lambda_permission_search_mtls_api,
  ]

  lifecycle {
    create_before_destroy = true
  }

  variables = {
    deployed_at = timestamp()
  }
}

resource "aws_api_gateway_stage" "ndr_api_mtls" {
  deployment_id        = aws_api_gateway_deployment.ndr_api_deploy_mtls.id
  rest_api_id          = aws_api_gateway_rest_api.ndr_doc_store_api_mtls.id
  stage_name           = var.environment
  xray_tracing_enabled = var.enable_xray_tracing
}

resource "aws_cloudwatch_log_group" "mtls_api_gateway_stage" {
  name              = "API-Gateway-Execution-Logs_${aws_api_gateway_rest_api.ndr_doc_store_api_mtls.id}/${var.environment}"
  retention_in_days = 0
  depends_on = [
    aws_api_gateway_account.logging
  ]
}

resource "aws_api_gateway_method_settings" "mtls_api_gateway_stage" {
  rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api_mtls.id
  stage_name  = aws_api_gateway_stage.ndr_api_mtls.stage_name
  method_path = "*/*"

  settings {
    logging_level      = "INFO"
    metrics_enabled    = true
    data_trace_enabled = true
  }
}

resource "aws_api_gateway_gateway_response" "unauthorised_response_mtls" {
  rest_api_id   = aws_api_gateway_rest_api.ndr_doc_store_api_mtls.id
  response_type = "DEFAULT_4XX"

  response_templates = {
    "application/json" = "{\"message\":$context.error.messageString}"
  }

  response_parameters = {
    "gatewayresponse.header.Access-Control-Allow-Origin"      = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
    "gatewayresponse.header.Access-Control-Allow-Methods"     = "'*'"
    "gatewayresponse.header.Access-Control-Allow-Headers"     = "'Content-Type,X-Amz-Date,Authorization,X-Auth,X-Api-Key,X-Amz-Security-Token,X-Auth-Cookie,Accept'"
    "gatewayresponse.header.Access-Control-Allow-Credentials" = "'true'"
  }
}

resource "aws_api_gateway_gateway_response" "bad_gateway_response_mtls" {
  rest_api_id   = aws_api_gateway_rest_api.ndr_doc_store_api_mtls.id
  response_type = "DEFAULT_5XX"

  response_templates = {
    "application/json" = "{\"message\":$context.error.messageString}"
  }

  response_parameters = {
    "gatewayresponse.header.Access-Control-Allow-Origin"      = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
    "gatewayresponse.header.Access-Control-Allow-Methods"     = "'*'"
    "gatewayresponse.header.Access-Control-Allow-Headers"     = "'Content-Type,X-Amz-Date,Authorization,X-Auth,X-Api-Key,X-Amz-Security-Token,X-Auth-Cookie,Accept'"
    "gatewayresponse.header.Access-Control-Allow-Credentials" = "'true'"
  }
}

module "mtls_api_endpoint_url_ssm_parameter" {
  source              = "./modules/ssm_parameter"
  name                = "${terraform.workspace}_ApiEndpointMtls"
  description         = "mTLS api endpoint URL for ${var.environment}"
  resource_depends_on = aws_api_gateway_deployment.ndr_api_deploy_mtls
  value               = "https://${aws_api_gateway_base_path_mapping.api_mapping_mtls.domain_name}"
  type                = "SecureString"
  owner               = var.owner
  environment         = var.environment
}