Skip to content

Commit cd8f11b

Browse files
chrisbloechrisbloe
authored
Merge branch 'main' into PRM-526
2 parents 688ed9f + d3d60d7 commit cd8f11b

8 files changed

Lines changed: 25 additions & 108 deletions

File tree

‎bootstrap/README.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ No modules.
1919

2020
| Name | Type |
2121
|------|------|
22-
| [aws_dynamodb_table.dynamodb_terraform_state_lock](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/dynamodb_table) | resource |
2322
| [aws_kms_key.ndr_state_key](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/kms_key) | resource |
2423
| [aws_s3_bucket.ndr_lock_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket) | resource |
2524
| [aws_s3_bucket_acl.ndr_lock_bucket_acl](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_acl) | resource |

‎bootstrap/main.tf‎

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -67,21 +67,6 @@ resource "aws_s3_bucket_public_access_block" "public_access_block" {
6767
restrict_public_buckets = true
6868
}
6969

70-
resource "aws_dynamodb_table" "dynamodb_terraform_state_lock" {
71-
name = "ndr-terraform-locks"
72-
hash_key = "LockID"
73-
read_capacity = 20
74-
write_capacity = 20
75-
76-
attribute {
77-
name = "LockID"
78-
type = "S"
79-
}
80-
lifecycle {
81-
prevent_destroy = true
82-
}
83-
}
84-
8570
data "aws_caller_identity" "current" {}
8671

8772
variable "region" {

‎infrastructure/lambda-mns-notification.tf‎

Lines changed: 15 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,16 @@
11
module "mns-notification-lambda" {
2+
count = 1
23
source = "./modules/lambda"
34
name = "MNSNotificationLambda"
45
handler = "handlers.mns_notification_handler.lambda_handler"
56
iam_role_policy_documents = [
6-
module.sqs-mns-notification-queue.sqs_read_policy_document,
7-
module.sqs-mns-notification-queue.sqs_write_policy_document,
7+
module.sqs-mns-notification-queue[0].sqs_read_policy_document,
8+
module.sqs-mns-notification-queue[0].sqs_write_policy_document,
89
module.lloyd_george_reference_dynamodb_table.dynamodb_write_policy_document,
910
module.lloyd_george_reference_dynamodb_table.dynamodb_read_policy_document,
1011
aws_iam_policy.ssm_access_policy.policy,
1112
module.ndr-app-config.app_config_policy,
12-
aws_iam_policy.kms_mns_lambda_access.policy,
13+
aws_iam_policy.kms_mns_lambda_access[0].policy,
1314
]
1415
kms_deletion_window = var.kms_deletion_window
1516
rest_api_id = null
@@ -20,7 +21,7 @@ module "mns-notification-lambda" {
2021
APPCONFIG_CONFIGURATION = module.ndr-app-config.app_config_configuration_profile_id
2122
WORKSPACE = terraform.workspace
2223
LLOYD_GEORGE_DYNAMODB_NAME = "${terraform.workspace}_${var.lloyd_george_dynamodb_table_name}"
23-
MNS_NOTIFICATION_QUEUE_URL = module.sqs-mns-notification-queue.sqs_url
24+
MNS_NOTIFICATION_QUEUE_URL = module.sqs-mns-notification-queue[0].sqs_url
2425
PDS_FHIR_IS_STUBBED = local.is_sandbox
2526
}
2627
is_gateway_integration_needed = false
@@ -29,26 +30,27 @@ module "mns-notification-lambda" {
2930
}
3031

3132
resource "aws_lambda_event_source_mapping" "mns_notification_lambda" {
32-
event_source_arn = module.sqs-mns-notification-queue.endpoint
33-
function_name = module.mns-notification-lambda.lambda_arn
33+
event_source_arn = module.sqs-mns-notification-queue[0].endpoint
34+
function_name = module.mns-notification-lambda[0].lambda_arn
3435
}
3536

3637
module "mns-notification-alarm" {
3738
source = "./modules/lambda_alarms"
38-
lambda_function_name = module.mns-notification-lambda.function_name
39-
lambda_timeout = module.mns-notification-lambda.timeout
39+
lambda_function_name = module.mns-notification-lambda[0].function_name
40+
lambda_timeout = module.mns-notification-lambda[0].timeout
4041
lambda_name = "mns_notification_handler"
4142
namespace = "AWS/Lambda"
42-
alarm_actions = [module.mns-notification-alarm-topic.arn]
43-
ok_actions = [module.mns-notification-alarm-topic.arn]
43+
alarm_actions = [module.mns-notification-alarm-topic[0].arn]
44+
ok_actions = [module.mns-notification-alarm-topic[0].arn]
4445
}
4546

4647
module "mns-notification-alarm-topic" {
48+
count = 1
4749
source = "./modules/sns"
4850
sns_encryption_key_id = module.sns_encryption_key.id
4951
topic_name = "mns-notification-topic"
5052
topic_protocol = "lambda"
51-
topic_endpoint = module.mns-notification-lambda.lambda_arn
53+
topic_endpoint = module.mns-notification-lambda[0].lambda_arn
5254
delivery_policy = jsonencode({
5355
"Version" : "2012-10-17",
5456
"Statement" : [
@@ -72,6 +74,7 @@ module "mns-notification-alarm-topic" {
7274
}
7375

7476
resource "aws_iam_policy" "kms_mns_lambda_access" {
77+
count = 1
7578
name = "${terraform.workspace}_mns_notification_lambda_access_policy"
7679
description = "KMS policy to allow lambda to read and write MNS SQS messages"
7780

@@ -84,7 +87,7 @@ resource "aws_iam_policy" "kms_mns_lambda_access" {
8487
"kms:GenerateDataKey"
8588
]
8689
Effect = "Allow"
87-
Resource = module.mns_encryption_key.kms_arn
90+
Resource = module.mns_encryption_key[0].kms_arn
8891
},
8992
]
9093
})

‎infrastructure/mns.tf‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ data "aws_ssm_parameter" "mns_lambda_role" {
44

55

66
module "mns_encryption_key" {
7+
count = 1
78
source = "./modules/kms"
89
kms_key_name = "alias/mns-notification-encryption-key-kms-${terraform.workspace}"
910
kms_key_description = "Custom KMS Key to enable server side encryption for mns subscriptions"
@@ -16,6 +17,7 @@ module "mns_encryption_key" {
1617
}
1718

1819
module "sqs-mns-notification-queue" {
20+
count = 1
1921
source = "./modules/sqs"
2022
name = "mns-notification-queue"
2123
max_size_message = 256 * 1024 # allow message size up to 256 KB
@@ -25,14 +27,14 @@ module "sqs-mns-notification-queue" {
2527
max_visibility = 901
2628
delay = 60
2729
enable_sse = null
28-
kms_master_key_id = module.mns_encryption_key.id
30+
kms_master_key_id = module.mns_encryption_key[0].id
2931
enable_dlq = true
3032
dlq_visibility_timeout = 0
3133
max_receive_count = 3
3234
}
3335

3436
resource "aws_sqs_queue_policy" "mns_sqs_access" {
35-
queue_url = module.sqs-mns-notification-queue.sqs_url
37+
queue_url = module.sqs-mns-notification-queue[0].sqs_url
3638

3739
policy = jsonencode({
3840
Version = "2012-10-17"
@@ -43,7 +45,7 @@ resource "aws_sqs_queue_policy" "mns_sqs_access" {
4345
AWS = data.aws_ssm_parameter.mns_lambda_role.value
4446
},
4547
Action = "SQS:SendMessage",
46-
Resource = module.sqs-mns-notification-queue.sqs_arn
48+
Resource = module.sqs-mns-notification-queue[0].sqs_arn
4749
}
4850
]
4951
})
@@ -62,7 +64,7 @@ resource "aws_cloudwatch_metric_alarm" "msn_dlq_new_message" {
6264
alarm_actions = [module.mns-dlq-alarm-topic.arn]
6365

6466
dimensions = {
65-
QueueName = module.sqs-mns-notification-queue.dlq_name
67+
QueueName = module.sqs-mns-notification-queue[0].dlq_name
6668
}
6769
}
6870

@@ -93,5 +95,5 @@ module "mns-dlq-alarm-topic" {
9395
}
9496
]
9597
})
96-
depends_on = [module.sqs-mns-notification-queue]
98+
depends_on = [module.sqs-mns-notification-queue[0]]
9799
}

‎infrastructure/schedules.tf‎

Lines changed: 0 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -57,64 +57,6 @@ resource "aws_lambda_permission" "bulk_upload_report_schedule_permission" {
5757
]
5858
}
5959

60-
resource "aws_cloudwatch_event_rule" "data_collection_schedule" {
61-
name = "${terraform.workspace}_data_collection_schedule"
62-
description = "Schedule for Data Collection Lambda"
63-
schedule_expression = "cron(0 20 ? * SAT *)"
64-
}
65-
66-
resource "aws_cloudwatch_event_target" "data_collection_schedule_event" {
67-
rule = aws_cloudwatch_event_rule.data_collection_schedule.name
68-
target_id = "data_collection_schedule"
69-
70-
arn = module.data-collection-lambda.lambda_arn
71-
depends_on = [
72-
module.data-collection-lambda,
73-
aws_cloudwatch_event_rule.data_collection_schedule
74-
]
75-
}
76-
77-
resource "aws_lambda_permission" "data_collection_schedule_permission" {
78-
statement_id = "AllowExecutionFromCloudWatch"
79-
action = "lambda:InvokeFunction"
80-
function_name = module.data-collection-lambda.function_name
81-
principal = "events.amazonaws.com"
82-
source_arn = aws_cloudwatch_event_rule.data_collection_schedule.arn
83-
depends_on = [
84-
module.data-collection-lambda,
85-
aws_cloudwatch_event_rule.data_collection_schedule
86-
]
87-
}
88-
89-
resource "aws_cloudwatch_event_rule" "statistical_report_schedule" {
90-
name = "${terraform.workspace}_statistical_report_schedule"
91-
description = "Schedule for Statistical Report Lambda"
92-
schedule_expression = "cron(0 8 ? * MON *)"
93-
}
94-
95-
resource "aws_cloudwatch_event_target" "statistical_report_schedule_event" {
96-
rule = aws_cloudwatch_event_rule.statistical_report_schedule.name
97-
target_id = "statistical_report_schedule"
98-
99-
arn = module.statistical-report-lambda.lambda_arn
100-
depends_on = [
101-
module.statistical-report-lambda,
102-
aws_cloudwatch_event_rule.statistical_report_schedule
103-
]
104-
}
105-
106-
resource "aws_lambda_permission" "statistical_report_schedule_permission" {
107-
statement_id = "AllowExecutionFromCloudWatch"
108-
action = "lambda:InvokeFunction"
109-
function_name = module.statistical-report-lambda.function_name
110-
principal = "events.amazonaws.com"
111-
source_arn = aws_cloudwatch_event_rule.statistical_report_schedule.arn
112-
depends_on = [
113-
module.statistical-report-lambda,
114-
aws_cloudwatch_event_rule.statistical_report_schedule
115-
]
116-
}
117-
11860
resource "aws_scheduler_schedule" "data_collection_ecs" {
11961
count = local.is_sandbox ? 0 : 1
12062
name_prefix = "${terraform.workspace}_data_collection_ecs"

‎infrastructure/sqs_alarms.tf‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,11 @@ locals {
55
"stitching_main" = module.sqs-stitching-queue.sqs_name
66
"lg_bulk_main" = module.sqs-lg-bulk-upload-metadata-queue.sqs_name
77
"lg_inv_main" = module.sqs-lg-bulk-upload-invalid-queue.sqs_name
8-
"mns_main" = module.sqs-mns-notification-queue.sqs_name
8+
"mns_main" = module.sqs-mns-notification-queue[0].sqs_name
99
# dead-letter queues
1010
"nrl_dlq" = module.sqs-nrl-queue.dlq_name
1111
"stitching_dlq" = module.sqs-stitching-queue.dlq_name
12-
"mns_dlq" = module.sqs-mns-notification-queue.dlq_name
12+
"mns_dlq" = module.sqs-mns-notification-queue[0].dlq_name
1313
}
1414

1515

‎infrastructure/virusscanner.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ module "cloud_storage_security" {
6868
count = local.is_production ? 1 : 0
6969

7070
source = "cloudstoragesec/cloud-storage-security/aws"
71-
version = "1.8.8+css9.02.000" # Check https://help.cloudstoragesec.com/release-notes/latest-v9 for updates
71+
version = "1.8.9+css9.02.001" # Check https://help.cloudstoragesec.com/release-notes/latest-v9 for updates
7272
cidr = [var.cloud_security_console_black_hole_address] # This is a reserved address that does not lead anywhere to make sure CloudStorageSecurity console is not available
7373
email = data.aws_ssm_parameter.cloud_security_admin_email.value
7474
subnet_a_id = aws_subnet.virus_scanning_a[0].id

‎scripts/cleanup_terraform_states.py‎

Lines changed: 0 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ class CleanupTerraformStates:
88
def __init__(self):
99
self.env_folder = "env:/"
1010
self.s3_client = boto3.client("s3")
11-
self.dynamo_client = boto3.client("dynamodb")
1211
self.objects_paginator = self.s3_client.get_paginator('list_objects_v2')
1312
self.object_versions_paginator = self.s3_client.get_paginator('list_object_versions')
1413

@@ -47,18 +46,6 @@ def remove_object_versions(self, tf_bucket: str, folder_prefix: str) -> None:
4746
)
4847
print("All object versions deleted.")
4948

50-
def delete_record_in_dynamo(self, tf_bucket: str, file_key: str):
51-
print(f"Deleting sandbox tfstate DynamoDB record")
52-
table_name = "ndr-terraform-locks"
53-
lock_id = f'{tf_bucket}/{file_key}-md5'
54-
55-
self.dynamo_client.delete_item(
56-
TableName=table_name,
57-
Key={'LockID': {'S': lock_id}},
58-
ConditionExpression="attribute_exists(LockID)"
59-
)
60-
print("DynamoDB record deleted successfully")
61-
6249

6350
def main(self, sandbox: str):
6451
tf_bucket = self.get_terraform_bucket()
@@ -71,7 +58,6 @@ def main(self, sandbox: str):
7158
if parent_folder == sandbox:
7259
folder_prefix = f"{self.env_folder}{parent_folder}/"
7360
self.remove_object_versions(tf_bucket=tf_bucket, folder_prefix=folder_prefix)
74-
self.delete_record_in_dynamo(tf_bucket, key)
7561

7662
if __name__ == '__main__':
7763
sandbox = sys.argv[1]

0 commit comments

Comments
 (0)