More tweaks

Author: chrisbloe

infrastructure/api.tf

@@ -1,7 +1,8 @@
 # Create Document Store API
 resource "aws_api_gateway_rest_api" "ndr_doc_store_api" {
-  name        = "${terraform.workspace}-DocStoreAPI"
-  description = "Document store API for Repo"
+  name                         = "${terraform.workspace}-DocStoreAPI"
+  description                  = "Document store API for Repo"
+  disable_execute_api_endpoint = true
 
   tags = {
     Name = "${terraform.workspace}-docstore-api"
@@ -11,10 +12,11 @@ resource "aws_api_gateway_rest_api" "ndr_doc_store_api" {
 resource "aws_api_gateway_domain_name" "custom_api_domain" {
   domain_name              = local.api_gateway_full_domain_name
   regional_certificate_arn = module.ndr-ecs-fargate-app.certificate_arn
-  security_policy          = "SecurityPolicy_TLS13_1_3_2025_09"
+  security_policy          = "SecurityPolicy_TLS13_2025_EDGE"
+  endpoint_access_mode     = "BASIC"
 
   endpoint_configuration {
-    types = ["REGIONAL"]
+    types = ["EDGE"]
   }
 }
 

infrastructure/api_mtls.tf

@@ -16,7 +16,8 @@ resource "aws_api_gateway_rest_api" "ndr_doc_store_api_mtls" {
 resource "aws_api_gateway_domain_name" "custom_api_domain_mtls" {
   domain_name              = local.mtls_api_gateway_full_domain_name
   regional_certificate_arn = aws_acm_certificate_validation.mtls_api_gateway_cert.certificate_arn
-  security_policy          = "SecurityPolicy_TLS13_1_3_2025_09"
+  security_policy          = "SecurityPolicy_TLS13_1_3_FIPS_2025_09"
+  endpoint_access_mode     = "BASIC"
 
   endpoint_configuration {
     types = ["REGIONAL"]

scripts/cleanup_sandboxes.py

@@ -7,13 +7,13 @@
 def trigger_delete_workflow(token: str, sandbox: str):
     owner = "NHSDigital"
     repo = "national-document-repository-infrastructure"
-    workflow = "tear-down-sandbox.yml"
+    workflow_id = "tear-down-sandbox.yml"
 
-    url = f"https://api.github.com/repos/{owner}/{repo}/actions/workflows/{workflow}/dispatches"
+    url = f"https://api.github.com/repos/{owner}/{repo}/actions/workflows/{workflow_id}/dispatches"
     headers = {
         "Accept": "application/vnd.github+json",
         "Authorization": f"Bearer {token}",
-        "X-GitHub-Api-Version": "2022-11-28",
+        "X-GitHub-Api-Version": "2026-03-10",
     }
 
     inputs = {