Skip to content

Commit c1461c7

Browse files
steph-torres-nhssteph-torres-nhs
authored
[PRMP-1445] Create API Gateway Endpoints, Lambdas, and Alarms for UserRestriction Service (#610)
1 parent 2304449 commit c1461c7

8 files changed

Lines changed: 379 additions & 11 deletions

‎infrastructure/api.tf‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -52,43 +52,49 @@ resource "aws_api_gateway_deployment" "ndr_api_deploy" {
5252
module.create-token-gateway,
5353
module.create-token-lambda,
5454
module.delete-doc-ref-gateway,
55-
module.delete-document-references-fhir-lambda,
5655
module.delete-doc-ref-lambda,
56+
module.delete-document-references-fhir-lambda,
57+
module.update_user_restriction_lambda,
5758
module.document-manifest-job-gateway,
5859
module.document-manifest-job-lambda,
5960
module.document_reference_gateway,
61+
module.document-status-check-gateway,
62+
module.document-status-check-lambda,
6063
module.feature-flags-gateway,
6164
module.feature-flags-lambda,
6265
module.fhir_document_reference_gateway,
6366
module.get-doc-fhir-lambda,
64-
module.get_document_review_lambda,
6567
module.get-doc-ref-lambda,
68+
module.get_document_review_lambda,
6669
module.get-report-by-ods-gateway,
6770
module.get-report-by-ods-lambda,
6871
module.lloyd-george-stitch-gateway,
6972
module.lloyd-george-stitch-lambda,
7073
module.logout-gateway,
7174
module.logout_lambda,
75+
module.patch_document_review_lambda,
76+
module.post-document-references-fhir-lambda,
77+
module.post_document_review_lambda,
78+
module.create_user_restriction_lambda,
79+
module.review_document_status_gateway,
80+
module.review-document-status-check-lambda,
81+
module.review_document_version_gateway,
7282
module.search-document-references-gateway,
7383
module.search-document-references-lambda,
7484
module.search_document_review_lambda,
7585
module.search-patient-details-gateway,
7686
module.search-patient-details-lambda,
87+
module.get_user_information_lambda,
88+
module.search_user_restriction_lambda,
7789
module.send-feedback-gateway,
7890
module.send-feedback-lambda,
79-
module.review_document_version_gateway,
80-
module.review_document_status_gateway,
81-
module.review-document-status-check-lambda,
8291
module.update-doc-ref-lambda,
8392
module.update-upload-state-gateway,
8493
module.update-upload-state-lambda,
85-
module.document-status-check-gateway,
86-
module.document-status-check-lambda,
87-
module.post-document-references-fhir-lambda,
88-
module.post_document_review_lambda,
89-
module.patch_document_review_lambda,
94+
module.user_restrictions_gateway,
95+
module.user_restrictions_user_search_gateway,
9096
module.virus_scan_result_gateway,
91-
module.virus_scan_result_lambda
97+
module.virus_scan_result_lambda,
9298
]
9399

94100
lifecycle {

‎infrastructure/dynamo_db.tf‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -590,6 +590,61 @@ module "bulk_upload_contact_lookup_table" {
590590
},
591591
]
592592

593+
environment = var.environment
594+
owner = var.owner
595+
}
596+
597+
module "user_restriction_table" {
598+
source = "./modules/dynamo_db"
599+
table_name = var.user_restrictions_table_name
600+
hash_key = "ID"
601+
deletion_protection_enabled = var.deletion_protection_enabled
602+
point_in_time_recovery_enabled = !local.is_sandbox
603+
604+
attributes = [
605+
{
606+
name = "ID"
607+
type = "S"
608+
},
609+
{
610+
name = "RestrictedSmartcard"
611+
type = "S"
612+
},
613+
{
614+
name = "NhsNumber"
615+
type = "S"
616+
},
617+
{
618+
name = "Custodian"
619+
type = "S"
620+
},
621+
{
622+
name = "Created"
623+
type = "N"
624+
},
625+
]
626+
627+
global_secondary_indexes = [
628+
{
629+
name = "RestrictedSmartcardIndex"
630+
hash_key = "RestrictedSmartcard"
631+
range_key = "Created"
632+
projection_type = "ALL"
633+
},
634+
{
635+
name = "NhsNumberIndex"
636+
hash_key = "NhsNumber"
637+
range_key = "Created"
638+
projection_type = "ALL"
639+
},
640+
{
641+
name = "CustodianIndex"
642+
hash_key = "Custodian"
643+
range_key = "Created"
644+
projection_type = "ALL"
645+
}
646+
]
647+
593648
environment = var.environment
594649
owner = var.owner
595650
}

‎infrastructure/gateway-user-restrictions.tf‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
module "user_restrictions_gateway" {
2+
source = "./modules/gateway"
3+
api_gateway_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
4+
parent_id = aws_api_gateway_rest_api.ndr_doc_store_api.root_resource_id
5+
http_methods = ["GET", "POST"]
6+
authorization = "CUSTOM"
7+
gateway_path = "UserRestriction"
8+
authorizer_id = aws_api_gateway_authorizer.repo_authoriser.id
9+
require_credentials = true
10+
origin = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
11+
}
12+
13+
module "user_restriction_id_gateway" {
14+
source = "./modules/gateway"
15+
api_gateway_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
16+
parent_id = module.user_restrictions_gateway.gateway_resource_id
17+
http_methods = ["PATCH"]
18+
gateway_path = "{id}"
19+
authorization = "CUSTOM"
20+
authorizer_id = aws_api_gateway_authorizer.repo_authoriser.id
21+
require_credentials = true
22+
origin = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
23+
24+
request_parameters = {
25+
"method.request.path.id" = true
26+
}
27+
}
28+
29+
module "user_restrictions_user_search_gateway" {
30+
source = "./modules/gateway"
31+
api_gateway_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
32+
parent_id = module.user_restrictions_gateway.gateway_resource_id
33+
http_methods = ["GET"]
34+
gateway_path = "SearchUser"
35+
authorization = "CUSTOM"
36+
authorizer_id = aws_api_gateway_authorizer.repo_authoriser.id
37+
require_credentials = true
38+
origin = contains(["prod"], terraform.workspace) ? "'https://${var.domain}'" : "'https://${terraform.workspace}.${var.domain}'"
39+
}

‎infrastructure/lambda-create-user-restriction.tf‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
module "create_user_restriction_lambda" {
2+
source = "./modules/lambda"
3+
name = "CreateUserRestriction"
4+
handler = "handlers.create_user_restriction_handler.lambda_handler"
5+
iam_role_policy_documents = [
6+
module.ndr-app-config.app_config_policy,
7+
aws_iam_policy.ssm_access_policy.policy,
8+
module.user_restriction_table.dynamodb_write_policy_document
9+
]
10+
kms_deletion_window = var.kms_deletion_window
11+
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
12+
resource_id = module.user_restrictions_gateway.gateway_resource_id
13+
http_methods = ["POST"]
14+
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
15+
lambda_environment_variables = {
16+
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
17+
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
18+
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
19+
WORKSPACE = terraform.workspace
20+
RESTRICTIONS_TABLE_NAME = module.user_restriction_table.table_name
21+
}
22+
23+
depends_on = [
24+
aws_api_gateway_rest_api.ndr_doc_store_api,
25+
module.user_restrictions_gateway
26+
]
27+
}
28+
29+
module "create_user_restriction_lambda_alarms" {
30+
source = "./modules/lambda_alarms"
31+
lambda_function_name = module.create_user_restriction_lambda.function_name
32+
lambda_timeout = module.create_user_restriction_lambda.timeout
33+
lambda_name = module.create_user_restriction_lambda.function_name
34+
namespace = "AWS/Lambda"
35+
alarm_actions = [module.create_user_restriction_lambda_alarm_topic.arn]
36+
ok_actions = [module.create_user_restriction_lambda_alarm_topic.arn]
37+
}
38+
39+
module "create_user_restriction_lambda_alarm_topic" {
40+
source = "./modules/sns"
41+
sns_encryption_key_id = module.sns_encryption_key.id
42+
topic_name = "create-user-restriction-lambda-alarm-topic"
43+
topic_protocol = "email"
44+
is_topic_endpoint_list = true
45+
topic_endpoint_list = local.is_sandbox ? [] : nonsensitive(split(",", data.aws_ssm_parameter.cloud_security_notification_email_list.value))
46+
delivery_policy = jsonencode({
47+
"Version" : "2012-10-17",
48+
"Statement" : [
49+
{
50+
"Effect" : "Allow",
51+
"Principal" : {
52+
"Service" : "cloudwatch.amazonaws.com"
53+
},
54+
"Action" : [
55+
"SNS:Publish",
56+
],
57+
"Condition" : {
58+
"ArnLike" : {
59+
"aws:SourceArn" : "arn:aws:cloudwatch:eu-west-2:${data.aws_caller_identity.current.account_id}:alarm:*"
60+
}
61+
}
62+
"Resource" : "*"
63+
}
64+
]
65+
})
66+
}

‎infrastructure/lambda-get-user-information.tf‎

Lines changed: 64 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
module "get_user_information_lambda" {
2+
source = "./modules/lambda"
3+
name = "GetUserInformation"
4+
handler = "handlers.get_user_information_handler.lambda_handler"
5+
iam_role_policy_documents = [
6+
module.ndr-app-config.app_config_policy,
7+
aws_iam_policy.ssm_access_policy.policy,
8+
]
9+
kms_deletion_window = var.kms_deletion_window
10+
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
11+
resource_id = module.user_restrictions_user_search_gateway.gateway_resource_id
12+
http_methods = ["GET"]
13+
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
14+
lambda_environment_variables = {
15+
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
16+
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
17+
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
18+
WORKSPACE = terraform.workspace
19+
}
20+
21+
depends_on = [
22+
aws_api_gateway_rest_api.ndr_doc_store_api,
23+
module.user_restrictions_user_search_gateway
24+
]
25+
}
26+
27+
module "get_user_information_lambda_alarms" {
28+
source = "./modules/lambda_alarms"
29+
lambda_function_name = module.get_user_information_lambda.function_name
30+
lambda_timeout = module.get_user_information_lambda.timeout
31+
lambda_name = module.get_user_information_lambda.function_name
32+
namespace = "AWS/Lambda"
33+
alarm_actions = [module.get_user_information_lambda_alarm_topic.arn]
34+
ok_actions = [module.get_user_information_lambda_alarm_topic.arn]
35+
}
36+
37+
module "get_user_information_lambda_alarm_topic" {
38+
source = "./modules/sns"
39+
sns_encryption_key_id = module.sns_encryption_key.id
40+
topic_name = "get-user-information-lambda-alarm-topic"
41+
topic_protocol = "email"
42+
is_topic_endpoint_list = true
43+
topic_endpoint_list = local.is_sandbox ? [] : nonsensitive(split(",", data.aws_ssm_parameter.cloud_security_notification_email_list.value))
44+
delivery_policy = jsonencode({
45+
"Version" : "2012-10-17",
46+
"Statement" : [
47+
{
48+
"Effect" : "Allow",
49+
"Principal" : {
50+
"Service" : "cloudwatch.amazonaws.com"
51+
},
52+
"Action" : [
53+
"SNS:Publish",
54+
],
55+
"Condition" : {
56+
"ArnLike" : {
57+
"aws:SourceArn" : "arn:aws:cloudwatch:eu-west-2:${data.aws_caller_identity.current.account_id}:alarm:*"
58+
}
59+
}
60+
"Resource" : "*"
61+
}
62+
]
63+
})
64+
}

‎infrastructure/lambda-search-user-restriction.tf‎

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
module "search_user_restriction_lambda" {
2+
source = "./modules/lambda"
3+
name = "SearchUserRestriction"
4+
handler = "handlers.search_user_restriction_handler.lambda_handler"
5+
iam_role_policy_documents = [
6+
module.ndr-app-config.app_config_policy,
7+
aws_iam_policy.ssm_access_policy.policy,
8+
module.user_restriction_table.dynamodb_read_policy_document
9+
]
10+
kms_deletion_window = var.kms_deletion_window
11+
rest_api_id = aws_api_gateway_rest_api.ndr_doc_store_api.id
12+
resource_id = module.user_restrictions_gateway.gateway_resource_id
13+
http_methods = ["GET"]
14+
api_execution_arn = aws_api_gateway_rest_api.ndr_doc_store_api.execution_arn
15+
lambda_environment_variables = {
16+
APPCONFIG_APPLICATION = module.ndr-app-config.app_config_application_id
17+
APPCONFIG_ENVIRONMENT = module.ndr-app-config.app_config_environment_id
18+
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
19+
WORKSPACE = terraform.workspace
20+
RESTRICTIONS_TABLE_NAME = module.user_restriction_table.table_name
21+
}
22+
23+
depends_on = [
24+
aws_api_gateway_rest_api.ndr_doc_store_api,
25+
module.user_restrictions_gateway
26+
]
27+
}
28+
29+
module "search_user_restriction_lambda_alarms" {
30+
source = "./modules/lambda_alarms"
31+
lambda_timeout = module.search_user_restriction_lambda.timeout
32+
lambda_function_name = module.search_user_restriction_lambda.function_name
33+
lambda_name = module.search_user_restriction_lambda.function_name
34+
namespace = "AWS/Lambda"
35+
alarm_actions = [module.search_user_restriction_lambda_alarm_topic.arn]
36+
ok_actions = [module.search_user_restriction_lambda_alarm_topic.arn]
37+
}
38+
39+
module "search_user_restriction_lambda_alarm_topic" {
40+
source = "./modules/sns"
41+
sns_encryption_key_id = module.sns_encryption_key.id
42+
topic_name = "search-user-restriction-lambda-alarm-topic"
43+
topic_protocol = "email"
44+
is_topic_endpoint_list = true
45+
topic_endpoint_list = local.is_sandbox ? [] : nonsensitive(split(",", data.aws_ssm_parameter.cloud_security_notification_email_list.value))
46+
delivery_policy = jsonencode({
47+
"Version" : "2012-10-17",
48+
"Statement" : [
49+
{
50+
"Effect" : "Allow",
51+
"Principal" : {
52+
"Service" : "cloudwatch.amazonaws.com"
53+
},
54+
"Action" : [
55+
"SNS:Publish",
56+
],
57+
"Condition" : {
58+
"ArnLike" : {
59+
"aws:SourceArn" : "arn:aws:cloudwatch:eu-west-2:${data.aws_caller_identity.current.account_id}:alarm:*"
60+
}
61+
}
62+
"Resource" : "*"
63+
}
64+
]
65+
})
66+
}

0 commit comments

Comments
 (0)