Skip to content

Commit 7f9e6b7

Browse files
nhsd-angel-pastornhsd-angel-pastor
authored
CCM-12858 Core Notifier lambda
* CCM-12858: When the conditions are met it sends a message to Core Notify and publish an event.
1 parent 2c29dbb commit 7f9e6b7

37 files changed

Lines changed: 2777 additions & 5 deletions

‎infrastructure/terraform/components/dl/README.md‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,10 +11,11 @@ No requirements.
1111
|------|-------------|------|---------|:--------:|
1212
| <a name="input_apim_auth_token_schedule"></a> [apim\_auth\_token\_schedule](#input\_apim\_auth\_token\_schedule) | Schedule to renew the APIM auth token | `string` | `"rate(9 minutes)"` | no |
1313
| <a name="input_apim_auth_token_url"></a> [apim\_auth\_token\_url](#input\_apim\_auth\_token\_url) | URL to generate an APIM auth token | `string` | `"https://int.api.service.nhs.uk/oauth2/token"` | no |
14-
| <a name="input_apim_base_url"></a> [apim\_base\_url](#input\_apim\_base\_url) | The URL used to send requests to Notify and PDM | `string` | `"https://int.api.service.nhs.uk"` | no |
14+
| <a name="input_apim_base_url"></a> [apim\_base\_url](#input\_apim\_base\_url) | The URL used to send requests to PDM | `string` | `"https://int.api.service.nhs.uk"` | no |
1515
| <a name="input_apim_keygen_schedule"></a> [apim\_keygen\_schedule](#input\_apim\_keygen\_schedule) | Schedule to refresh key pairs if necessary | `string` | `"cron(0 14 * * ? *)"` | no |
1616
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
1717
| <a name="input_component"></a> [component](#input\_component) | The variable encapsulating the name of this component | `string` | `"dl"` | no |
18+
| <a name="input_core_notify_url"></a> [core\_notify\_url](#input\_core\_notify\_url) | The URL used to send requests to Notify | `string` | `"https://sandbox.api.service.nhs.uk"` | no |
1819
| <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
1920
| <a name="input_enable_dynamodb_delete_protection"></a> [enable\_dynamodb\_delete\_protection](#input\_enable\_dynamodb\_delete\_protection) | Enable DynamoDB Delete Protection on all Tables | `bool` | `true` | no |
2021
| <a name="input_enable_mock_mesh"></a> [enable\_mock\_mesh](#input\_enable\_mock\_mesh) | Enable mock mesh access (dev only). Grants lambda permission to read mock-mesh prefix in non-pii bucket. | `bool` | `false` | no |
@@ -40,6 +41,7 @@ No requirements.
4041

4142
| Name | Source | Version |
4243
|------|--------|---------|
44+
| <a name="module_core_notifier"></a> [core\_notifier](#module\_core\_notifier) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
4345
| <a name="module_kms"></a> [kms](#module\_kms) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-kms.zip | n/a |
4446
| <a name="module_lambda_apim_key_generation"></a> [lambda\_apim\_key\_generation](#module\_lambda\_apim\_key\_generation) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
4547
| <a name="module_lambda_lambda_apim_refresh_token"></a> [lambda\_lambda\_apim\_refresh\_token](#module\_lambda\_lambda\_apim\_refresh\_token) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
@@ -53,6 +55,7 @@ No requirements.
5355
| <a name="module_s3bucket_non_pii_data"></a> [s3bucket\_non\_pii\_data](#module\_s3bucket\_non\_pii\_data) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
5456
| <a name="module_s3bucket_pii_data"></a> [s3bucket\_pii\_data](#module\_s3bucket\_pii\_data) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
5557
| <a name="module_s3bucket_static_assets"></a> [s3bucket\_static\_assets](#module\_s3bucket\_static\_assets) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
58+
| <a name="module_sqs_core_notifier"></a> [sqs\_core\_notifier](#module\_sqs\_core\_notifier) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
5659
| <a name="module_sqs_event_publisher_errors"></a> [sqs\_event\_publisher\_errors](#module\_sqs\_event\_publisher\_errors) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
5760
| <a name="module_sqs_mesh_download"></a> [sqs\_mesh\_download](#module\_sqs\_mesh\_download) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
5861
| <a name="module_sqs_pdm_poll"></a> [sqs\_pdm\_poll](#module\_sqs\_pdm\_poll) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |

‎infrastructure/terraform/components/dl/cloudwatch_event_rule_pdm_resource_available.tf‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
resource "aws_cloudwatch_event_rule" "pdm_resource_available" {
2+
name = "${local.csi}-pdm-resource-available"
3+
description = "PDM resource available event rule"
4+
event_bus_name = aws_cloudwatch_event_bus.main.name
5+
event_pattern = jsonencode({
6+
"detail" : {
7+
"type" : [
8+
"uk.nhs.notify.digital.letters.pdm.resource.available.v1"
9+
],
10+
}
11+
})
12+
}
13+
14+
resource "aws_cloudwatch_event_target" "pdm_resource_available_core_notifier" {
15+
rule = aws_cloudwatch_event_rule.pdm_resource_available.name
16+
arn = module.sqs_core_notifier.sqs_queue_arn
17+
event_bus_name = aws_cloudwatch_event_bus.main.name
18+
}

‎infrastructure/terraform/components/dl/lambda_event_source_mapping_core_notifier_lambda.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
resource "aws_lambda_event_source_mapping" "core_notifier_lambda" {
2+
event_source_arn = module.sqs_core_notifier.sqs_queue_arn
3+
function_name = module.core_notifier.function_arn
4+
batch_size = var.queue_batch_size
5+
maximum_batching_window_in_seconds = var.queue_batch_window_seconds
6+
7+
function_response_types = [
8+
"ReportBatchItemFailures"
9+
]
10+
}

‎infrastructure/terraform/components/dl/module_lambda_core_notifier.tf‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
module "core_notifier" {
2+
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip"
3+
4+
function_name = "core-notifier"
5+
description = "A function to send messages to core Notify when a PDM resource is available"
6+
7+
aws_account_id = var.aws_account_id
8+
component = local.component
9+
environment = var.environment
10+
project = var.project
11+
region = var.region
12+
group = var.group
13+
14+
log_retention_in_days = var.log_retention_in_days
15+
kms_key_arn = module.kms.key_arn
16+
17+
iam_policy_document = {
18+
body = data.aws_iam_policy_document.core_notifier_lambda.json
19+
}
20+
21+
function_s3_bucket = local.acct.s3_buckets["lambda_function_artefacts"]["id"]
22+
function_code_base_path = local.aws_lambda_functions_dir_path
23+
function_code_dir = "core-notifier-lambda/dist"
24+
function_include_common = true
25+
handler_function_name = "handler"
26+
runtime = "nodejs22.x"
27+
memory = 128
28+
timeout = 60
29+
log_level = var.log_level
30+
31+
force_lambda_code_deploy = var.force_lambda_code_deploy
32+
enable_lambda_insights = false
33+
34+
log_destination_arn = local.log_destination_arn
35+
log_subscription_role_arn = local.acct.log_subscription_role_arn
36+
37+
lambda_env_vars = {
38+
"APIM_BASE_URL" = var.core_notify_url
39+
"APIM_ACCESS_TOKEN_SSM_PARAMETER_NAME" = local.apim_access_token_ssm_parameter_name
40+
"EVENT_PUBLISHER_EVENT_BUS_ARN" = aws_cloudwatch_event_bus.main.arn
41+
"EVENT_PUBLISHER_DLQ_URL" = module.sqs_event_publisher_errors.sqs_queue_url
42+
"ENVIRONMENT" = var.environment
43+
}
44+
}
45+
46+
data "aws_iam_policy_document" "core_notifier_lambda" {
47+
statement {
48+
sid = "AllowSSMParam"
49+
effect = "Allow"
50+
51+
actions = [
52+
"ssm:GetParameter",
53+
"ssm:GetParameters",
54+
"ssm:GetParametersByPath"
55+
]
56+
57+
resources = [
58+
"arn:aws:ssm:${var.region}:${var.aws_account_id}:parameter/${var.component}/${var.environment}/apim/*",
59+
"arn:aws:ssm:${var.region}:${var.aws_account_id}:parameter/${var.component}/${var.environment}/senders/*"
60+
]
61+
}
62+
63+
statement {
64+
sid = "KMSPermissions"
65+
effect = "Allow"
66+
67+
actions = [
68+
"kms:Decrypt",
69+
"kms:GenerateDataKey",
70+
]
71+
72+
resources = [
73+
module.kms.key_arn,
74+
]
75+
}
76+
77+
statement {
78+
sid = "SQSPermissionsUploadToCoreNotifierQueue"
79+
effect = "Allow"
80+
81+
actions = [
82+
"sqs:ReceiveMessage",
83+
"sqs:DeleteMessage",
84+
"sqs:GetQueueAttributes",
85+
"sqs:GetQueueUrl",
86+
]
87+
88+
resources = [
89+
module.sqs_core_notifier.sqs_queue_arn,
90+
]
91+
}
92+
93+
statement {
94+
sid = "PutEvents"
95+
effect = "Allow"
96+
97+
actions = [
98+
"events:PutEvents",
99+
]
100+
101+
resources = [
102+
aws_cloudwatch_event_bus.main.arn,
103+
]
104+
}
105+
106+
statement {
107+
sid = "SQSPermissionsDLQ"
108+
effect = "Allow"
109+
110+
actions = [
111+
"sqs:SendMessage",
112+
"sqs:SendMessageBatch",
113+
]
114+
115+
resources = [
116+
module.sqs_event_publisher_errors.sqs_queue_arn,
117+
]
118+
}
119+
}

‎infrastructure/terraform/components/dl/module_sqs_core_notifier.tf‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
module "sqs_core_notifier" {
2+
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip"
3+
4+
aws_account_id = var.aws_account_id
5+
component = local.component
6+
environment = var.environment
7+
project = var.project
8+
region = var.region
9+
name = "core-notifier"
10+
11+
sqs_kms_key_arn = module.kms.key_arn
12+
13+
visibility_timeout_seconds = 60
14+
15+
create_dlq = true
16+
17+
sqs_policy_overload = data.aws_iam_policy_document.sqs_inbound_event.json
18+
}
19+
20+
data "aws_iam_policy_document" "sqs_inbound_event" {
21+
statement {
22+
sid = "AllowEventBridgeToSendMessage"
23+
effect = "Allow"
24+
25+
principals {
26+
type = "Service"
27+
identifiers = ["events.amazonaws.com"]
28+
}
29+
30+
actions = [
31+
"sqs:SendMessage"
32+
]
33+
34+
resources = [
35+
"arn:aws:sqs:${var.region}:${var.aws_account_id}:${local.csi}-core-notifier-queue"
36+
]
37+
38+
condition {
39+
test = "ArnLike"
40+
variable = "aws:SourceArn"
41+
values = [ aws_cloudwatch_event_rule.pdm_resource_available.arn ]
42+
}
43+
}
44+
}

‎infrastructure/terraform/components/dl/variables.tf‎

Lines changed: 8 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -136,10 +136,17 @@ variable "pdm_use_non_mock_token" {
136136

137137
variable "apim_base_url" {
138138
type = string
139-
description = "The URL used to send requests to Notify and PDM"
139+
description = "The URL used to send requests to PDM"
140140
default = "https://int.api.service.nhs.uk"
141141
}
142142

143+
144+
variable "core_notify_url" {
145+
type = string
146+
description = "The URL used to send requests to Notify"
147+
default = "https://sandbox.api.service.nhs.uk"
148+
}
149+
143150
variable "apim_auth_token_url" {
144151
type = string
145152
description = "URL to generate an APIM auth token"

‎lambdas/core-notifier-lambda/jest.config.ts‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
import { baseJestConfig } from '../../jest.config.base';
2+
3+
const config = baseJestConfig;
4+
5+
export default config;

‎lambdas/core-notifier-lambda/package.json‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
{
2+
"dependencies": {
3+
"aws-lambda": "^1.0.7",
4+
"axios": "^1.13.2",
5+
"digital-letters-events": "^0.0.1",
6+
"sender-management": "^0.0.1",
7+
"utils": "^0.0.1"
8+
},
9+
"devDependencies": {
10+
"@tsconfig/node22": "^22.0.2",
11+
"@types/aws-lambda": "^8.10.155",
12+
"@types/jest": "^29.5.14",
13+
"jest": "^29.7.0",
14+
"jest-mock-extended": "^3.0.7",
15+
"typescript": "^5.9.3"
16+
},
17+
"name": "nhs-notify-digital-core-notifier-lambda",
18+
"private": true,
19+
"scripts": {
20+
"lambda-build": "rm -rf dist && npx esbuild --bundle --minify --sourcemap --target=es2020 --platform=node --loader:.node=file --entry-names=[name] --outdir=dist src/index.ts",
21+
"lint": "eslint .",
22+
"lint:fix": "eslint . --fix",
23+
"test:unit": "jest",
24+
"typecheck": "tsc --noEmit"
25+
},
26+
"version": "0.0.1"
27+
}

0 commit comments

Comments
 (0)