Skip to content

Commit 4401d13

Browse files
sidnhssidnhs
committed
CCM-16776: Enable S3 ABAC
1 parent 3210487 commit 4401d13

6 files changed

Lines changed: 73 additions & 8 deletions

File tree

‎infrastructure/terraform/components/dl/README.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,6 +54,7 @@ No requirements.
5454
| <a name="input_report_scheduler_schedule"></a> [report\_scheduler\_schedule](#input\_report\_scheduler\_schedule) | Schedule to trigger sender reports | `string` | `"cron(30 4 * * ? *)"` | no |
5555
| <a name="input_reports_data_retention_non_current_days"></a> [reports\_data\_retention\_non\_current\_days](#input\_reports\_data\_retention\_non\_current\_days) | The number of non current days for data retention policy for reports generated by Athena in the reporting bucket | `number` | `14` | no |
5656
| <a name="input_reports_data_retention_policy_days"></a> [reports\_data\_retention\_policy\_days](#input\_reports\_data\_retention\_policy\_days) | The number of days for data retention policy for reports generated by Athena in the reporting bucket | `number` | `90` | no |
57+
| <a name="input_restrict_pii_data_access"></a> [restrict\_pii\_data\_access](#input\_restrict\_pii\_data\_access) | Whether to restrict access to PII data in the bucket using a bucket policy | `bool` | `true` | no |
5758
| <a name="input_shared_infra_account_id"></a> [shared\_infra\_account\_id](#input\_shared\_infra\_account\_id) | The AWS Shared Infra Account ID (numeric) | `string` | n/a | yes |
5859
| <a name="input_sns_success_logging_sample_percent"></a> [sns\_success\_logging\_sample\_percent](#input\_sns\_success\_logging\_sample\_percent) | Enable SNS Delivery Successful Sample Percentage | `number` | `0` | no |
5960
| <a name="input_sqs_max_receive_count"></a> [sqs\_max\_receive\_count](#input\_sqs\_max\_receive\_count) | Maximum number of times a message can be received before being sent to the DLQ | `string` | `"3"` | no |
@@ -85,10 +86,10 @@ No requirements.
8586
| <a name="module_report_scheduler"></a> [report\_scheduler](#module\_report\_scheduler) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.6/terraform-lambda.zip | n/a |
8687
| <a name="module_report_sender"></a> [report\_sender](#module\_report\_sender) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.6/terraform-lambda.zip | n/a |
8788
| <a name="module_s3bucket_file_quarantine"></a> [s3bucket\_file\_quarantine](#module\_s3bucket\_file\_quarantine) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.6/terraform-s3bucket.zip | n/a |
88-
| <a name="module_s3bucket_file_safe"></a> [s3bucket\_file\_safe](#module\_s3bucket\_file\_safe) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.6/terraform-s3bucket.zip | n/a |
89+
| <a name="module_s3bucket_file_safe"></a> [s3bucket\_file\_safe](#module\_s3bucket\_file\_safe) | git::ssh://git@github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/terraform/modules/s3bucket | feature/CCM-16776_s3_pii_access |
8990
| <a name="module_s3bucket_letters"></a> [s3bucket\_letters](#module\_s3bucket\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.6/terraform-s3bucket.zip | n/a |
9091
| <a name="module_s3bucket_non_pii_data"></a> [s3bucket\_non\_pii\_data](#module\_s3bucket\_non\_pii\_data) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.6/terraform-s3bucket.zip | n/a |
91-
| <a name="module_s3bucket_pii_data"></a> [s3bucket\_pii\_data](#module\_s3bucket\_pii\_data) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.6/terraform-s3bucket.zip | n/a |
92+
| <a name="module_s3bucket_pii_data"></a> [s3bucket\_pii\_data](#module\_s3bucket\_pii\_data) | git::ssh://git@github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/terraform/modules/s3bucket | feature/CCM-16776_s3_pii_access |
9293
| <a name="module_s3bucket_reporting"></a> [s3bucket\_reporting](#module\_s3bucket\_reporting) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.6/terraform-s3bucket.zip | n/a |
9394
| <a name="module_s3bucket_static_assets"></a> [s3bucket\_static\_assets](#module\_s3bucket\_static\_assets) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.6/terraform-s3bucket.zip | n/a |
9495
| <a name="module_sqs_core_notifier"></a> [sqs\_core\_notifier](#module\_sqs\_core\_notifier) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.6/terraform-sqs.zip | n/a |

‎infrastructure/terraform/components/dl/data_iam_roles_sso_dev.tf‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
data "aws_iam_roles" "sso_bc_restricted_dev" {
2+
count = var.restrict_pii_data_access ? 1 : 0
3+
name_regex = "AWSReservedSSO_nhs-notify-bc-developer_.*"
4+
path_prefix = "/aws-reserved/sso.amazonaws.com/"
5+
}

‎infrastructure/terraform/components/dl/locals.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,4 +16,6 @@ locals {
1616
ssm_senders_prefix = "${local.ssm_prefix}/senders"
1717
ttl_shard_count = 3
1818
unscanned_files_bucket = local.acct.additional_s3_buckets["digital-letters_unscanned-files"]["id"]
19+
20+
bc_restricted_dev_role = try(tolist(data.aws_iam_roles.sso_bc_restricted_dev[0].arns)[0], null)
1921
}

‎infrastructure/terraform/components/dl/module_s3bucket_file_safe.tf‎

Lines changed: 28 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
module "s3bucket_file_safe" {
2-
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.6/terraform-s3bucket.zip"
2+
source = "git::ssh://git@github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/terraform/modules/s3bucket?ref=feature/CCM-16776_s3_pii_access" #Change this later to actual tag
33

44
name = "file-safe"
55

@@ -10,6 +10,7 @@ module "s3bucket_file_safe" {
1010
component = local.component
1111

1212
kms_key_arn = module.kms.key_arn
13+
enable_abac = var.restrict_pii_data_access ? true : false
1314

1415
policy_documents = [data.aws_iam_policy_document.s3bucket_file_safe.json]
1516

@@ -41,7 +42,8 @@ module "s3bucket_file_safe" {
4142
]
4243

4344
default_tags = {
44-
NHSE-Enable-S3-Backup-Acct = "True"
45+
NHSE-Enable-S3-Backup-Acct = "True",
46+
NHSE-PII-Data = "True"
4547
}
4648
}
4749

@@ -85,4 +87,28 @@ data "aws_iam_policy_document" "s3bucket_file_safe" {
8587
]
8688
}
8789
}
90+
91+
# dynamic "statement" {
92+
# for_each = var.restrict_pii_data_access ? [1] : []
93+
# content {
94+
# effect = "Deny"
95+
# actions = [
96+
# "s3:GetObject",
97+
# "s3:GetObjectVersion",
98+
# "s3:PutObject",
99+
# "s3:DeleteObject"
100+
# ]
101+
# resources = [
102+
# module.s3bucket_file_safe.arn,
103+
# "${module.s3bucket_file_safe.arn}/*",
104+
# ]
105+
106+
# principals {
107+
# type = "AWS"
108+
# identifiers = [
109+
# local.bc_restricted_dev_role
110+
# ]
111+
# }
112+
# }
113+
# }
88114
}

‎infrastructure/terraform/components/dl/module_s3bucket_pii_data.tf‎

Lines changed: 29 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
module "s3bucket_pii_data" {
2-
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.6/terraform-s3bucket.zip"
2+
source = "git::ssh://git@github.com/NHSDigital/nhs-notify-shared-modules.git//infrastructure/terraform/modules/s3bucket?ref=feature/CCM-16776_s3_pii_access" #Change this later to actual tag
33

44
name = "pii-data"
55

@@ -9,14 +9,15 @@ module "s3bucket_pii_data" {
99
environment = var.environment
1010
component = local.component
1111

12-
kms_key_arn = module.kms.key_arn
13-
12+
kms_key_arn = module.kms.key_arn
13+
enable_abac = var.restrict_pii_data_access ? true : false
1414
policy_documents = [data.aws_iam_policy_document.s3bucket_pii_data.json]
1515

1616
force_destroy = var.force_destroy
1717

1818
default_tags = {
19-
NHSE-Enable-S3-Backup-Acct = "True"
19+
NHSE-Enable-S3-Backup-Acct = "True",
20+
NHSE-PII-Data = "True",
2021
}
2122
}
2223

@@ -61,4 +62,28 @@ data "aws_iam_policy_document" "s3bucket_pii_data" {
6162
]
6263
}
6364
}
65+
66+
# dynamic "statement" {
67+
# for_each = var.restrict_pii_data_access ? [1] : []
68+
# content {
69+
# effect = "Deny"
70+
# actions = [
71+
# "s3:GetObject",
72+
# "s3:GetObjectVersion",
73+
# "s3:PutObject",
74+
# "s3:DeleteObject"
75+
# ]
76+
# resources = [
77+
# module.s3bucket_pii_data.arn,
78+
# "${module.s3bucket_pii_data.arn}/*",
79+
# ]
80+
81+
# principals {
82+
# type = "AWS"
83+
# identifiers = [
84+
# local.bc_restricted_dev_role
85+
# ]
86+
# }
87+
# }
88+
# }
6489
}

‎infrastructure/terraform/components/dl/variables.tf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -319,3 +319,9 @@ variable "event_anomaly_band_width" {
319319
error_message = "Band width must be between 2 and 10"
320320
}
321321
}
322+
323+
variable "restrict_pii_data_access" {
324+
type = bool
325+
description = "Whether to restrict access to PII data in the bucket using a bucket policy"
326+
default = true
327+
}

0 commit comments

Comments
 (0)