Skip to content

Commit a00082e

Browse files
steph-torres-nhssteph-torres-nhs
authored
Merge branch 'main' into PRMP-1475
2 parents 8a14b2b + 2479707 commit a00082e

17 files changed

Lines changed: 401 additions & 371 deletions

‎infrastructure/dns_email_auth.tf‎

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,9 @@
1-
resource "aws_route53_record" "dmarc" {
2-
count = local.is_shared_workspace ? 1 : 0
3-
zone_id = module.route53_fargate_ui.zone_id
4-
name = "_dmarc.${var.domain}"
5-
type = "TXT"
6-
ttl = 300
7-
8-
records = ["v=DMARC1; p=none; adkim=s; aspf=s"]
9-
}
1+
# resource "aws_route53_record" "dmarc" {
2+
# count = local.is_shared_workspace ? 1 : 0
3+
# zone_id = module.route53_fargate_ui.zone_id
4+
# name = "_dmarc.${var.domain}"
5+
# type = "TXT"
6+
# ttl = 300
7+
#
8+
# records = ["v=DMARC1; p=none; adkim=s; aspf=s"]
9+
# }

‎infrastructure/iam.tf‎

Lines changed: 34 additions & 34 deletions
Original file line numberDiff line numberDiff line change
@@ -354,37 +354,37 @@ resource "aws_iam_policy" "s3_document_data_policy_post_document_review_lambda"
354354
})
355355
}
356356

357-
data "aws_iam_policy_document" "reporting_ses" {
358-
statement {
359-
sid = "SESAccess"
360-
effect = "Allow"
361-
362-
actions = [
363-
"ses:SendEmail",
364-
"ses:SendRawEmail"
365-
]
366-
367-
resources = [
368-
"arn:aws:ses:${var.region}:${data.aws_caller_identity.current.account_id}:identity/*",
369-
"arn:aws:ses:${var.region}:${data.aws_caller_identity.current.account_id}:configuration-set/${aws_ses_configuration_set.reporting.name}"
370-
]
371-
372-
condition {
373-
test = "StringEquals"
374-
variable = "ses:FromAddress"
375-
values = [local.reporting_ses_from_address_value]
376-
}
377-
}
378-
}
379-
380-
data "aws_iam_policy_document" "ses_feedback_s3_put" {
381-
statement {
382-
effect = "Allow"
383-
actions = [
384-
"s3:PutObject"
385-
]
386-
resources = [
387-
"${module.ses-feedback-store.bucket_arn}/ses-feedback/*"
388-
]
389-
}
390-
}
357+
# data "aws_iam_policy_document" "reporting_ses" {
358+
# statement {
359+
# sid = "SESAccess"
360+
# effect = "Allow"
361+
#
362+
# actions = [
363+
# "ses:SendEmail",
364+
# "ses:SendRawEmail"
365+
# ]
366+
#
367+
# resources = [
368+
# "arn:aws:ses:${var.region}:${data.aws_caller_identity.current.account_id}:identity/*",
369+
# "arn:aws:ses:${var.region}:${data.aws_caller_identity.current.account_id}:configuration-set/${aws_ses_configuration_set.reporting.name}"
370+
# ]
371+
#
372+
# condition {
373+
# test = "StringEquals"
374+
# variable = "ses:FromAddress"
375+
# values = [local.reporting_ses_from_address_value]
376+
# }
377+
# }
378+
# }
379+
#
380+
# data "aws_iam_policy_document" "ses_feedback_s3_put" {
381+
# statement {
382+
# effect = "Allow"
383+
# actions = [
384+
# "s3:PutObject"
385+
# ]
386+
# resources = [
387+
# "${module.ses-feedback-store.bucket_arn}/ses-feedback/*"
388+
# ]
389+
# }
390+
# }

‎infrastructure/kms_sns.tf‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ module "sns_encryption_key" {
44
kms_key_description = "Custom KMS Key to enable server side encryption for sns subscriptions"
55
environment = var.environment
66
owner = var.owner
7-
service_identifiers = ["sns.amazonaws.com", "cloudwatch.amazonaws.com", "ses.amazonaws.com"]
7+
# service_identifiers = ["sns.amazonaws.com", "cloudwatch.amazonaws.com", "ses.amazonaws.com"]
8+
service_identifiers = ["sns.amazonaws.com", "cloudwatch.amazonaws.com"]
89
kms_deletion_window = var.kms_deletion_window
910
}

‎infrastructure/lambda-report-distribution.tf‎

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,30 @@
1-
module "report-distribution-lambda" {
2-
source = "./modules/lambda"
3-
name = "ReportDistribution"
4-
handler = "handlers.report_distribution_handler.lambda_handler"
5-
lambda_timeout = 300
6-
7-
iam_role_policy_documents = [
8-
module.ndr-report-store.s3_read_policy_document,
9-
module.bulk_upload_contact_lookup_table.dynamodb_read_policy_document,
10-
data.aws_iam_policy_document.reporting_ses.json,
11-
data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
12-
]
13-
14-
lambda_environment_variables = {
15-
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
16-
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
17-
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
18-
WORKSPACE = terraform.workspace
19-
20-
REPORT_BUCKET_NAME = module.ndr-report-store.bucket_id
21-
CONTACT_TABLE_NAME = module.bulk_upload_contact_lookup_table.table_name
22-
23-
PRM_MAILBOX_EMAIL = data.aws_ssm_parameter.prm_mailbox_email.value
24-
SES_FROM_ADDRESS = local.reporting_ses_from_address_value
25-
SES_CONFIGURATION_SET = aws_ses_configuration_set.reporting.name
26-
}
27-
28-
is_gateway_integration_needed = false
29-
is_invoked_from_gateway = false
30-
}
1+
# module "report-distribution-lambda" {
2+
# source = "./modules/lambda"
3+
# name = "ReportDistribution"
4+
# handler = "handlers.report_distribution_handler.lambda_handler"
5+
# lambda_timeout = 300
6+
#
7+
# iam_role_policy_documents = [
8+
# module.ndr-report-store.s3_read_policy_document,
9+
# module.bulk_upload_contact_lookup_table.dynamodb_read_policy_document,
10+
# data.aws_iam_policy_document.reporting_ses.json,
11+
# data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
12+
# ]
13+
#
14+
# lambda_environment_variables = {
15+
# APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
16+
# APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
17+
# APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
18+
# WORKSPACE = terraform.workspace
19+
#
20+
# REPORT_BUCKET_NAME = module.ndr-report-store.bucket_id
21+
# CONTACT_TABLE_NAME = module.bulk_upload_contact_lookup_table.table_name
22+
#
23+
# PRM_MAILBOX_EMAIL = data.aws_ssm_parameter.prm_mailbox_email.value
24+
# SES_FROM_ADDRESS = local.reporting_ses_from_address_value
25+
# SES_CONFIGURATION_SET = aws_ses_configuration_set.reporting.name
26+
# }
27+
#
28+
# is_gateway_integration_needed = false
29+
# is_invoked_from_gateway = false
30+
# }

‎infrastructure/lambda-ses-feedback-monitor.tf‎

Lines changed: 32 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,32 +1,32 @@
1-
module "ses-feedback-monitor-lambda" {
2-
source = "./modules/lambda"
3-
name = "SesFeedbackMonitor"
4-
handler = "handlers.ses_feedback_monitor_handler.lambda_handler"
5-
lambda_timeout = 60
6-
7-
iam_role_policy_documents = [
8-
data.aws_iam_policy_document.ses_feedback_s3_put.json,
9-
data.aws_iam_policy_document.reporting_ses.json,
10-
data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
11-
]
12-
13-
lambda_environment_variables = {
14-
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
15-
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
16-
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
17-
WORKSPACE = terraform.workspace
18-
19-
SES_FEEDBACK_BUCKET_NAME = module.ses-feedback-store.bucket_id
20-
SES_FEEDBACK_PREFIX = "ses-feedback/"
21-
PRM_MAILBOX_EMAIL = data.aws_ssm_parameter.prm_mailbox_email.value
22-
SES_FROM_ADDRESS = local.reporting_ses_from_address_value
23-
ALERT_ON_EVENT_TYPES = "BOUNCE,REJECT"
24-
}
25-
26-
is_gateway_integration_needed = false
27-
is_invoked_from_gateway = false
28-
29-
depends_on = [
30-
module.ses-feedback-store
31-
]
32-
}
1+
# module "ses-feedback-monitor-lambda" {
2+
# source = "./modules/lambda"
3+
# name = "SesFeedbackMonitor"
4+
# handler = "handlers.ses_feedback_monitor_handler.lambda_handler"
5+
# lambda_timeout = 60
6+
#
7+
# iam_role_policy_documents = [
8+
# data.aws_iam_policy_document.ses_feedback_s3_put.json,
9+
# data.aws_iam_policy_document.reporting_ses.json,
10+
# data.aws_iam_policy.aws_lambda_vpc_access_execution_role.policy,
11+
# ]
12+
#
13+
# lambda_environment_variables = {
14+
# APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
15+
# APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
16+
# APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
17+
# WORKSPACE = terraform.workspace
18+
#
19+
# SES_FEEDBACK_BUCKET_NAME = module.ses-feedback-store.bucket_id
20+
# SES_FEEDBACK_PREFIX = "ses-feedback/"
21+
# PRM_MAILBOX_EMAIL = data.aws_ssm_parameter.prm_mailbox_email.value
22+
# SES_FROM_ADDRESS = local.reporting_ses_from_address_value
23+
# ALERT_ON_EVENT_TYPES = "BOUNCE,REJECT"
24+
# }
25+
#
26+
# is_gateway_integration_needed = false
27+
# is_invoked_from_gateway = false
28+
#
29+
# depends_on = [
30+
# module.ses-feedback-store
31+
# ]
32+
# }

‎infrastructure/modules/app_config/configurations/dev.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@
2626
},
2727
"documentCorrectEnabled": {
2828
"name": "documentCorrectEnabled"
29+
},
30+
"userRestrictionEnabled": {
31+
"name": "userRestrictionEnabled"
2932
}
3033
},
3134
"values": {
@@ -55,6 +58,9 @@
5558
},
5659
"documentCorrectEnabled": {
5760
"enabled": "true"
61+
},
62+
"userRestrictionEnabled": {
63+
"enabled": "true"
5864
}
5965
},
6066
"version": "1"

‎infrastructure/modules/app_config/configurations/pre-prod.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@
2626
},
2727
"documentCorrectEnabled": {
2828
"name": "documentCorrectEnabled"
29+
},
30+
"userRestrictionEnabled": {
31+
"name": "userRestrictionEnabled"
2932
}
3033
},
3134
"values": {
@@ -55,6 +58,9 @@
5558
},
5659
"documentCorrectEnabled": {
5760
"enabled": "false"
61+
},
62+
"userRestrictionEnabled": {
63+
"enabled": "false"
5864
}
5965
},
6066
"version": "1"

‎infrastructure/modules/app_config/configurations/prod.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@
2626
},
2727
"documentCorrectEnabled": {
2828
"name": "documentCorrectEnabled"
29+
},
30+
"userRestrictionEnabled": {
31+
"name": "userRestrictionEnabled"
2932
}
3033
},
3134
"values": {
@@ -55,6 +58,9 @@
5558
},
5659
"documentCorrectEnabled": {
5760
"enabled": "false"
61+
},
62+
"userRestrictionEnabled": {
63+
"enabled": "false"
5864
}
5965
},
6066
"version": "1"

‎infrastructure/modules/app_config/configurations/sandbox.json‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,9 @@
2626
},
2727
"documentCorrectEnabled": {
2828
"name": "documentCorrectEnabled"
29+
},
30+
"userRestrictionEnabled": {
31+
"name": "userRestrictionEnabled"
2932
}
3033
},
3134
"values": {
@@ -55,6 +58,9 @@
5558
},
5659
"documentCorrectEnabled": {
5760
"enabled": "true"
61+
},
62+
"userRestrictionEnabled": {
63+
"enabled": "true"
5864
}
5965
},
6066
"version": "1"

‎infrastructure/modules/sns/README.md‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,6 @@ module "sns_topic" {
7979
| Name | Type |
8080
|------|------|
8181
| [aws_sns_topic.sns_topic](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic) | resource |
82-
| [aws_sns_topic_policy.this](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_policy) | resource |
8382
| [aws_sns_topic_subscription.sns_subscription_list](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription) | resource |
8483
| [aws_sns_topic_subscription.sns_subscription_single](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sns_topic_subscription) | resource |
8584

@@ -90,16 +89,13 @@ module "sns_topic" {
9089
| <a name="input_delivery_policy"></a> [delivery\_policy](#input\_delivery\_policy) | Attach delivery or IAM policy. (Legacy name; used as topic policy JSON in this module.) | `string` | n/a | yes |
9190
| <a name="input_enable_deduplication"></a> [enable\_deduplication](#input\_enable\_deduplication) | Prevent content based duplication in notification queue. | `bool` | `false` | no |
9291
| <a name="input_enable_fifo"></a> [enable\_fifo](#input\_enable\_fifo) | Attach first in first out policy to notification queue. | `bool` | `false` | no |
93-
| <a name="input_enable_ses_publish"></a> [enable\_ses\_publish](#input\_enable\_ses\_publish) | If true, module appends a statement allowing ses.amazonaws.com to SNS:Publish to this topic. | `bool` | `false` | no |
9492
| <a name="input_is_topic_endpoint_list"></a> [is\_topic\_endpoint\_list](#input\_is\_topic\_endpoint\_list) | Whether to use the topic\_endpoint\_list instead of a single topic\_endpoint. | `bool` | `false` | no |
9593
| <a name="input_raw_message_delivery"></a> [raw\_message\_delivery](#input\_raw\_message\_delivery) | Whether to enable raw message delivery for the SNS subscription. | `bool` | `false` | no |
96-
| <a name="input_ses_source_account_id"></a> [ses\_source\_account\_id](#input\_ses\_source\_account\_id) | AWS account ID used in the AWS:SourceAccount condition for SES publishing. | `string` | `""` | no |
9794
| <a name="input_sns_encryption_key_id"></a> [sns\_encryption\_key\_id](#input\_sns\_encryption\_key\_id) | The ARN (or ID) of the KMS key used for encrypting the SNS topic. | `string` | n/a | yes |
9895
| <a name="input_sqs_feedback"></a> [sqs\_feedback](#input\_sqs\_feedback) | Map of IAM role ARNs and sample rate for success and failure feedback. | `map(string)` | `{}` | no |
9996
| <a name="input_topic_endpoint"></a> [topic\_endpoint](#input\_topic\_endpoint) | A single endpoint (e.g., SQS queue or Lambda function ARN) to subscribe to the topic. | `any` | `null` | no |
10097
| <a name="input_topic_endpoint_list"></a> [topic\_endpoint\_list](#input\_topic\_endpoint\_list) | A list of endpoints (e.g., SQS ARNs) to subscribe to the topic. | `any` | `[]` | no |
10198
| <a name="input_topic_name"></a> [topic\_name](#input\_topic\_name) | Name of the SNS topic. | `string` | n/a | yes |
102-
| <a name="input_topic_policy_json"></a> [topic\_policy\_json](#input\_topic\_policy\_json) | Optional SNS topic access policy JSON. If set, it overrides delivery\_policy. | `string` | `null` | no |
10399
| <a name="input_topic_protocol"></a> [topic\_protocol](#input\_topic\_protocol) | The protocol to use for the subscription (e.g., 'sqs', 'lambda'). | `string` | n/a | yes |
104100

105101
## Outputs

0 commit comments

Comments
 (0)