Merge branch 'main' into PRMP-1476

Author: NogaNHS

base_iam/iam_github_pre-prod.tf

@@ -166,6 +166,7 @@ resource "aws_iam_role_policy" "github_extended_policy_virus_scanner_pre_prod" {
             "ssm:CreateDocument",
             "iam:TagRole",
             "SNS:TagResource",
+            "SNS:SetSubscriptionAttributes",
             "cognito-idp:CreateUserPool",
             "cognito-idp:TagResource",
             "cognito-idp:SetUserPoolMfaConfig",

base_iam/iam_github_prod.tf

@@ -270,6 +270,7 @@ resource "aws_iam_role_policy" "github_extended_policy_virus_scanner_prod" {
             "ssm:CreateDocument",
             "iam:TagRole",
             "SNS:TagResource",
+            "SNS:SetSubscriptionAttributes",
             "cognito-idp:CreateUserPool",
             "cognito-idp:TagResource",
             "cognito-idp:SetUserPoolMfaConfig",

infrastructure/gateway-user-restrictions.tf

@@ -7,7 +7,7 @@ module "user_restrictions_gateway" {
   gateway_path        = "UserRestriction"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
+  origin              = local.base_url_with_quotes
 }
 
 module "user_restriction_id_gateway" {
@@ -19,7 +19,7 @@ module "user_restriction_id_gateway" {
   authorization       = "CUSTOM"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
+  origin              = local.base_url_with_quotes
 
   request_parameters = {
     "method.request.path.id" = true
@@ -35,5 +35,5 @@ module "user_restrictions_user_search_gateway" {
   authorization       = "CUSTOM"
   authorizer_id       = aws_api_gateway_authorizer.repo_authoriser.id
   require_credentials = true
-  origin              = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
+  origin              = local.base_url_with_quotes
 }

infrastructure/iam_roles/pre-prod_Github-Actions-pre-prod-role.json

@@ -78,6 +78,7 @@
           "ssm:CreateDocument",
           "iam:TagRole",
           "SNS:TagResource",
+          "SNS:SetSubscriptionAttributes",
           "cognito-idp:CreateUserPool",
           "cognito-idp:TagResource",
           "cognito-idp:SetUserPoolMfaConfig",

infrastructure/iam_roles/prod_github-access-role.json

@@ -96,6 +96,7 @@
           "ssm:CreateDocument",
           "iam:TagRole",
           "SNS:TagResource",
+          "SNS:SetSubscriptionAttributes",
           "cognito-idp:CreateUserPool",
           "cognito-idp:TagResource",
           "cognito-idp:SetUserPoolMfaConfig",

infrastructure/lambda-get-user-information.tf

@@ -12,10 +12,11 @@ module "get_user_information_lambda" {
   http_methods        = ["GET"]
   api_execution_arn   = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
   lambda_environment_variables = {
-    APPCONFIG_APPLICATION   = module.ndr-app-config.app_config_application_id
-    APPCONFIG_ENVIRONMENT   = module.ndr-app-config.app_config_environment_id
-    APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
-    WORKSPACE               = terraform.workspace
+    APPCONFIG_APPLICATION     = module.ndr-app-config.app_config_application_id
+    APPCONFIG_ENVIRONMENT     = module.ndr-app-config.app_config_environment_id
+    APPCONFIG_CONFIGURATION   = module.ndr-app-config.app_config_configuration_profile_id
+    WORKSPACE                 = terraform.workspace
+    HEALTHCARE_WORKER_API_URL = data.aws_ssm_parameter.healthcare_worker_api_base_url.value
   }
 
   depends_on = [

infrastructure/ssm_parameters_user_restrictions.tf

@@ -10,3 +10,6 @@ module "healthcare_worker_api_base_url" {
   ignore_value_changes = true
 }
 
+data "aws_ssm_parameter" "healthcare_worker_api_base_url" {
+  name = "/ndr/${var.shared_infra_workspace}/hcw_api_url"
+}