Skip to content

Commit 292c616

Browse files
nhsd-angel-pastornhsd-angel-pastor
committed
CMM-13767: move file scanner lambda
1 parent 60ff384 commit 292c616

33 files changed

Lines changed: 2383 additions & 0 deletions

‎infrastructure/terraform/components/dl/README.md‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,7 @@ No requirements.
1616
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
1717
| <a name="input_component"></a> [component](#input\_component) | The variable encapsulating the name of this component | `string` | `"dl"` | no |
1818
| <a name="input_core_notify_url"></a> [core\_notify\_url](#input\_core\_notify\_url) | The URL used to send requests to Notify | `string` | `"https://sandbox.api.service.nhs.uk"` | no |
19+
| <a name="input_default_cloudwatch_event_bus_name"></a> [default\_cloudwatch\_event\_bus\_name](#input\_default\_cloudwatch\_event\_bus\_name) | The name of the default cloudwatch event bus. This is needed as GuardDuty Scan Result events are sent to the default bus | `string` | `"default"` | no |
1920
| <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
2021
| <a name="input_enable_dynamodb_delete_protection"></a> [enable\_dynamodb\_delete\_protection](#input\_enable\_dynamodb\_delete\_protection) | Enable DynamoDB Delete Protection on all Tables | `bool` | `true` | no |
2122
| <a name="input_enable_mock_mesh"></a> [enable\_mock\_mesh](#input\_enable\_mock\_mesh) | Enable mock mesh access (dev only). Grants lambda permission to read mock-mesh prefix in non-pii bucket. | `bool` | `false` | no |
@@ -48,12 +49,14 @@ No requirements.
4849
| <a name="module_lambda_lambda_apim_refresh_token"></a> [lambda\_lambda\_apim\_refresh\_token](#module\_lambda\_lambda\_apim\_refresh\_token) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
4950
| <a name="module_mesh_download"></a> [mesh\_download](#module\_mesh\_download) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5051
| <a name="module_mesh_poll"></a> [mesh\_poll](#module\_mesh\_poll) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
52+
| <a name="module_move_scanned_files"></a> [move\_scanned\_files](#module\_move\_scanned\_files) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5153
| <a name="module_pdm_mock"></a> [pdm\_mock](#module\_pdm\_mock) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5254
| <a name="module_pdm_poll"></a> [pdm\_poll](#module\_pdm\_poll) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5355
| <a name="module_pdm_uploader"></a> [pdm\_uploader](#module\_pdm\_uploader) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5456
| <a name="module_print_analyser"></a> [print\_analyser](#module\_print\_analyser) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5557
| <a name="module_print_status_handler"></a> [print\_status\_handler](#module\_print\_status\_handler) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
5658
| <a name="module_s3bucket_cf_logs"></a> [s3bucket\_cf\_logs](#module\_s3bucket\_cf\_logs) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
59+
| <a name="module_s3bucket_file_quarantine"></a> [s3bucket\_file\_quarantine](#module\_s3bucket\_file\_quarantine) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
5760
| <a name="module_s3bucket_file_safe"></a> [s3bucket\_file\_safe](#module\_s3bucket\_file\_safe) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
5861
| <a name="module_s3bucket_letters"></a> [s3bucket\_letters](#module\_s3bucket\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
5962
| <a name="module_s3bucket_non_pii_data"></a> [s3bucket\_non\_pii\_data](#module\_s3bucket\_non\_pii\_data) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
@@ -62,6 +65,7 @@ No requirements.
6265
| <a name="module_sqs_core_notifier"></a> [sqs\_core\_notifier](#module\_sqs\_core\_notifier) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
6366
| <a name="module_sqs_event_publisher_errors"></a> [sqs\_event\_publisher\_errors](#module\_sqs\_event\_publisher\_errors) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
6467
| <a name="module_sqs_mesh_download"></a> [sqs\_mesh\_download](#module\_sqs\_mesh\_download) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
68+
| <a name="module_sqs_move_scanned_files"></a> [sqs\_move\_scanned\_files](#module\_sqs\_move\_scanned\_files) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
6569
| <a name="module_sqs_pdm_poll"></a> [sqs\_pdm\_poll](#module\_sqs\_pdm\_poll) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
6670
| <a name="module_sqs_pdm_uploader"></a> [sqs\_pdm\_uploader](#module\_sqs\_pdm\_uploader) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
6771
| <a name="module_sqs_print_analyser"></a> [sqs\_print\_analyser](#module\_sqs\_print\_analyser) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.30/terraform-sqs.zip | n/a |

‎infrastructure/terraform/components/dl/cloudwatch_event_rule_guardduty_scan_result.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
resource "aws_cloudwatch_event_rule" "guardduty_scan_result" {
2+
name = "${local.csi}-guardduty_scan_result"
3+
description = "guardduty Scan Result event rule"
4+
event_bus_name = var.default_cloudwatch_event_bus_name
5+
event_pattern = jsonencode({
6+
"source": ["aws.guardduty"]
7+
"detail" : {
8+
"resourceType": ["S3_OBJECT"],
9+
"s3ObjectDetails": {
10+
"bucketName": [ local.unscanned_files_bucket ],
11+
"objectKey": [{ "prefix": "${local.csi}/" }]
12+
}
13+
}
14+
})
15+
}
16+
17+
resource "aws_cloudwatch_event_target" "guardduty_scan_result_move_scanned_files" {
18+
rule = aws_cloudwatch_event_rule.guardduty_scan_result.name
19+
arn = module.sqs_move_scanned_files.sqs_queue_arn
20+
event_bus_name = var.default_cloudwatch_event_bus_name
21+
}

‎infrastructure/terraform/components/dl/lambda_event_source_mapping_move_scanned_files_lambda.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
resource "aws_lambda_event_source_mapping" "move_scanned_files_lambda" {
2+
event_source_arn = module.sqs_move_scanned_files.sqs_queue_arn
3+
function_name = module.move_scanned_files.function_arn
4+
batch_size = var.queue_batch_size
5+
maximum_batching_window_in_seconds = var.queue_batch_window_seconds
6+
7+
function_response_types = [
8+
"ReportBatchItemFailures"
9+
]
10+
}

‎infrastructure/terraform/components/dl/module_lambda_move_scanned_files.tf‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
module "move_scanned_files" {
2+
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip"
3+
4+
function_name = "move-scanned-files"
5+
description = "A function that handles GuardDuty Malware Protection Object Scan Result and depending on the result moves objects from the unscanned bucket to the file safe or quarantined bucket. "
6+
7+
aws_account_id = var.aws_account_id
8+
component = local.component
9+
environment = var.environment
10+
project = var.project
11+
region = var.region
12+
group = var.group
13+
14+
log_retention_in_days = var.log_retention_in_days
15+
kms_key_arn = module.kms.key_arn
16+
17+
iam_policy_document = {
18+
body = data.aws_iam_policy_document.move_scanned_files.json
19+
}
20+
21+
function_s3_bucket = local.acct.s3_buckets["lambda_function_artefacts"]["id"]
22+
function_code_base_path = local.aws_lambda_functions_dir_path
23+
function_code_dir = "move-scanned-files-lambda/dist"
24+
function_include_common = true
25+
handler_function_name = "handler"
26+
runtime = "nodejs22.x"
27+
memory = 128
28+
timeout = 60
29+
log_level = var.log_level
30+
31+
force_lambda_code_deploy = var.force_lambda_code_deploy
32+
enable_lambda_insights = false
33+
34+
log_destination_arn = local.log_destination_arn
35+
log_subscription_role_arn = local.acct.log_subscription_role_arn
36+
37+
lambda_env_vars = {
38+
"EVENT_PUBLISHER_EVENT_BUS_ARN" = aws_cloudwatch_event_bus.main.arn
39+
"EVENT_PUBLISHER_DLQ_URL" = module.sqs_event_publisher_errors.sqs_queue_url
40+
"ENVIRONMENT" = var.environment
41+
"KEY_PREFIX_UNSCANNED_FILES" = local.csi
42+
"UNSCANNED_FILE_S3_BUCKET_NAME" = local.unscanned_files_bucket
43+
"SAFE_FILE_S3_BUCKET_NAME" = module.s3bucket_file_safe.bucket
44+
"QUARANTINE_FILE_S3_BUCKET_NAME" = module.s3bucket_file_quarantine.bucket
45+
}
46+
}
47+
48+
data "aws_iam_policy_document" "move_scanned_files" {
49+
statement {
50+
sid = "KMSPermissions"
51+
effect = "Allow"
52+
53+
actions = [
54+
"kms:Encrypt",
55+
"kms:Decrypt",
56+
"kms:GenerateDataKey",
57+
]
58+
59+
resources = [
60+
module.kms.key_arn,
61+
]
62+
}
63+
64+
statement {
65+
sid = "SQSPermissionsFileScannerMoveScannedFiles"
66+
effect = "Allow"
67+
68+
actions = [
69+
"sqs:ReceiveMessage",
70+
"sqs:DeleteMessage",
71+
"sqs:GetQueueAttributes",
72+
"sqs:GetQueueUrl",
73+
]
74+
75+
resources = [
76+
module.sqs_move_scanned_files.sqs_queue_arn,
77+
]
78+
}
79+
80+
statement {
81+
sid = "PutEvents"
82+
effect = "Allow"
83+
84+
actions = [
85+
"events:PutEvents",
86+
]
87+
88+
resources = [
89+
aws_cloudwatch_event_bus.main.arn,
90+
]
91+
}
92+
93+
statement {
94+
sid = "SQSPermissionsDLQ"
95+
effect = "Allow"
96+
97+
actions = [
98+
"sqs:SendMessage",
99+
"sqs:SendMessageBatch",
100+
]
101+
102+
resources = [
103+
module.sqs_event_publisher_errors.sqs_queue_arn,
104+
]
105+
}
106+
107+
statement {
108+
sid = "PermissionsToUnscannedBucket"
109+
effect = "Allow"
110+
111+
actions = [
112+
"s3:GetObject",
113+
"s3:GetObjectTagging",
114+
"s3:DeleteObject",
115+
]
116+
117+
resources = [
118+
"arn:aws:s3:::${local.unscanned_files_bucket}/*",
119+
]
120+
}
121+
122+
statement {
123+
sid = "PermissionsToSafeFileBucket"
124+
effect = "Allow"
125+
126+
actions = [
127+
"s3:PutObject",
128+
"s3:PutObjectTagging",
129+
]
130+
131+
resources = [
132+
"${module.s3bucket_file_safe.arn}/*"
133+
]
134+
}
135+
136+
statement {
137+
sid = "PermissionsToQuarantineFileBucket"
138+
effect = "Allow"
139+
140+
actions = [
141+
"s3:PutObject",
142+
"s3:PutObjectTagging",
143+
]
144+
145+
resources = [
146+
"${module.s3bucket_file_quarantine.arn}/*"
147+
]
148+
}
149+
150+
}

‎infrastructure/terraform/components/dl/module_s3bucket_file_quarantine.tf‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
module "s3bucket_file_quarantine" {
2+
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip"
3+
4+
name = "file-quarantine"
5+
6+
aws_account_id = var.aws_account_id
7+
region = var.region
8+
project = var.project
9+
environment = var.environment
10+
component = local.component
11+
12+
kms_key_arn = module.kms.key_arn
13+
14+
policy_documents = [data.aws_iam_policy_document.s3bucket_file_quarantine.json]
15+
16+
force_destroy = var.force_destroy
17+
18+
lifecycle_rules = [
19+
{
20+
enabled = true
21+
22+
expiration = {
23+
days = "90"
24+
}
25+
26+
noncurrent_version_transition = [
27+
{
28+
noncurrent_days = "30"
29+
storage_class = "STANDARD_IA"
30+
}
31+
]
32+
33+
noncurrent_version_expiration = {
34+
noncurrent_days = "90"
35+
}
36+
37+
abort_incomplete_multipart_upload = {
38+
days = "1"
39+
}
40+
}
41+
]
42+
}
43+
44+
data "aws_iam_policy_document" "s3bucket_file_quarantine" {
45+
statement {
46+
sid = "AllowManagedAccountsToList"
47+
effect = "Allow"
48+
49+
actions = [
50+
"s3:ListBucket",
51+
]
52+
53+
resources = [
54+
module.s3bucket_file_quarantine.arn,
55+
]
56+
57+
principals {
58+
type = "AWS"
59+
identifiers = [
60+
"arn:aws:iam::${var.aws_account_id}:root"
61+
]
62+
}
63+
}
64+
65+
statement {
66+
sid = "AllowManagedAccountsToGetPut"
67+
effect = "Allow"
68+
69+
actions = [
70+
"s3:GetObject",
71+
"s3:PutObject",
72+
]
73+
74+
resources = [
75+
"${module.s3bucket_file_quarantine.arn}/*",
76+
]
77+
78+
principals {
79+
type = "AWS"
80+
identifiers = [
81+
"arn:aws:iam::${var.aws_account_id}:root"
82+
]
83+
}
84+
}
85+
}

‎infrastructure/terraform/components/dl/module_sqs_move_scanned_files.tf‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
module "sqs_move_scanned_files" {
2+
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip"
3+
4+
aws_account_id = var.aws_account_id
5+
component = local.component
6+
environment = var.environment
7+
project = var.project
8+
region = var.region
9+
name = "move-scanned-files"
10+
11+
sqs_kms_key_arn = module.kms.key_arn
12+
13+
visibility_timeout_seconds = 60
14+
15+
create_dlq = true
16+
17+
sqs_policy_overload = data.aws_iam_policy_document.sqs_move_scanned_files.json
18+
}
19+
20+
data "aws_iam_policy_document" "sqs_move_scanned_files" {
21+
statement {
22+
sid = "AllowEventBridgeToSendMessage"
23+
effect = "Allow"
24+
25+
principals {
26+
type = "Service"
27+
identifiers = ["events.amazonaws.com"]
28+
}
29+
30+
actions = [
31+
"sqs:SendMessage"
32+
]
33+
34+
resources = [
35+
"arn:aws:sqs:${var.region}:${var.aws_account_id}:${local.csi}-move-scanned-files-queue"
36+
]
37+
38+
condition {
39+
test = "ArnLike"
40+
variable = "aws:SourceArn"
41+
values = [ aws_cloudwatch_event_rule.guardduty_scan_result.arn ]
42+
}
43+
}
44+
}

‎infrastructure/terraform/components/dl/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -176,3 +176,9 @@ variable "enable_pdm_mock" {
176176
description = "Flag indicating whether to deploy PDM mock API (should be false in production environments)"
177177
default = true
178178
}
179+
180+
variable "default_cloudwatch_event_bus_name" {
181+
type = string
182+
description = "The name of the default cloudwatch event bus. This is needed as GuardDuty Scan Result events are sent to the default bus"
183+
default = "default"
184+
}

‎lambdas/move-scanned-files-lambda/jest.config.ts‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
import { baseJestConfig } from '../../jest.config.base';
2+
3+
const config = baseJestConfig;
4+
5+
export default config;

‎lambdas/move-scanned-files-lambda/package.json‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
{
2+
"dependencies": {
3+
"aws-lambda": "^1.0.7",
4+
"axios": "^1.13.2",
5+
"digital-letters-events": "^0.0.1",
6+
"utils": "^0.0.1"
7+
},
8+
"devDependencies": {
9+
"@tsconfig/node22": "^22.0.2",
10+
"@types/aws-lambda": "^8.10.155",
11+
"@types/jest": "^29.5.14",
12+
"jest": "^29.7.0",
13+
"jest-mock-extended": "^3.0.7",
14+
"typescript": "^5.9.3"
15+
},
16+
"name": "nhs-notify-digital-move-scanned-files-lambda",
17+
"private": true,
18+
"scripts": {
19+
"lambda-build": "rm -rf dist && npx esbuild --bundle --minify --sourcemap --target=es2020 --platform=node --loader:.node=file --entry-names=[name] --outdir=dist src/index.ts",
20+
"lint": "eslint .",
21+
"lint:fix": "eslint . --fix",
22+
"test:unit": "jest",
23+
"typecheck": "tsc --noEmit"
24+
},
25+
"version": "0.0.1"
26+
}

0 commit comments

Comments
 (0)