Skip to content

Commit e75d9e2

Browse files
lapenna-bjssgareth-allansimonlabarere
authored
CCM-12616 mesh poll retrieve (#104)
* CCM-12616: Added py-mock-mesh module * CCM-12616: Replaced mesh-poll Lambda with a skeleton Python version * CCM-12616: test * CCM-12616: add false positive to .gitleaksignore * CCM-12616: fix sonarcloud issues * CCM-12616: fix sonarcloud issues * CCM-12616: Exclude mesh poll lambda from SonarCloud coverage temporarily * CCM-12616: add poetry install to pre.sh * CCM-12616: update .gitignore * CCM-12616: mesh-poll lambda * CCM-12616: terraform code * CCM-12616: metric publisher * CCM-12616: mock mesh only when enabled * CCM-12616: add senderId to CloudEvent data * CCM-12616: mesh-download lambda * CCM-12616: add document_store tests * CCM-12616: update mesh download tests * CCM-12616: add S3 putObject statement for storing messages when mock enabled * CCM-12616: add messageReference to the event data * CCM-12616: rename client to sender * CCM-12616: fix sonar issue * CCM-12616: move docs dependencies to a separate make command * CCM-12616: update python runtime * CCM-12616: update ssm prefixes with the correct paths * CCM-12616: add shared MESH config * CCM-12616: update pipeline * CCM-12616: update config and tests * CCM-12616: resolve comments * CCM-12616: resolve comments * CCM-12616: fix pipeline issues * CCM-12616: fix pipeline issues * CCM-12616: test * CCM-12616: test * CCM-12616: test * CCM-12616: test * CCM-12616: test * CCM-12616: revert changes * CCM-12616: test * CCM-12616: test * CCM-12616: test * CCM-12616: fix sonarcloud coverage issues * CCM-12616: fix sonarcloud coverage issues * CCM-12616: convert poetry to pip * CCM-12616: test * CCM-12616: test * CCM-12616: test * CCM-12616: add setup.py files * CCM-12616: update coverage.xml paths * CCM-12616: update coverage.xml paths * CCM-12616: update sonar-scanner.properties * CCM-12616: update sonar-scanner.properties * CCM-12616: remove poetry from pre.sh * CCM-12616: fix Unsupported attribute error * CCM-12616: fix lambda env vars * CCM-12616: skip build docs step * CCM-12616: test deployment * CCM-12616: test deployment * CCM-12616: Restore previously disabled pipeline steps * CCM-12616: Update Readme * CCM-12616: Update Makefile * CCM-12616: Update sonar properties * CCM-12616: Remove mesh-poll lambda from workspace Jest folders * CCM-12616: Update events published to match latest schemas * CCM-12616: Updated base CloudEvent model to match latest schemas * CCM-12616: Attempt to fix mesh-poll lambda's packaging * CCM-12616: Attempt to fix mesh-poll lambda entrypoint * CCM-12616: Another mesh-poll packaging tweak * CCM-12616: Fix mesh-poll SSM parameters * CCM-12616: Fix import module error * CCM-12616: Update runtime version * CCM-12616: Test * CCM-12616: Test * CCM-12616: Don't zip Python lambda output when packaging * CCM-12616: Allow mesh_poll lambda to call ssm:GetParameter * CCM-12616: Fix SSM parameter format in mesh_poll IAM policy * CCM-12616: Update mesh download package script * CCM-12616: Add setup file to mesh download * CCM-12616: Fix mesh download tests * CCM-12616: Add SSM statement to mesh download * CCM-12616: Add MESH SSM parameter configuration * CCM-12616: Add false positive to .gitleaksignore * CCM-12616: Increase mesh poll timeout * CCM-12616: Update mesh poll S3 terraform statement * CCM-12616: Fix pydantic model * CCM-12616: Update the Eventbridge rule * CCM-12616: Update package-lock file * CCM-12616: Fix linting error * CCM-12616: Fix linting error * CCM-12616: Add a retrieve_message method * CCM-12616: 100 * CCM-12616: Update ssm prefix path * CCM-12616: Add mesh to SSM prefix * CCM-12616: Update Mock Mesh doc * CCM-12616: Force destroy s3 buckets --------- Co-authored-by: Gareth Allan <157592212+gareth-allan@users.noreply.github.com> Co-authored-by: simonlabarere <simon.labarere1@nhs.net>
1 parent a474d08 commit e75d9e2

96 files changed

Lines changed: 5247 additions & 4205 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.coverage‎

-52 KB
Binary file not shown.

‎.github/workflows/stage-2-test.yaml‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -72,9 +72,10 @@ jobs:
7272
- uses: actions/setup-node@v6
7373
with:
7474
node-version: 24.10.0
75-
- uses: actions/setup-python@v6
75+
- name: "Setup Python"
76+
uses: actions/setup-python@v6
7677
with:
77-
python-version: '3.14'
78+
python-version: ${{ inputs.python_version }}
7879
- name: "Run unit test suite"
7980
run: |
8081
make test-unit
@@ -94,14 +95,21 @@ jobs:
9495
uses: actions/upload-artifact@v4
9596
with:
9697
name: python-coverage-reports
97-
path: "src/**/coverage.xml"
98+
path: |
99+
src/**/coverage.xml
100+
utils/**/coverage.xml
101+
lambdas/**/coverage.xml
98102
test-lint:
99103
name: "Linting"
100104
runs-on: ubuntu-latest
101105
timeout-minutes: 5
102106
steps:
103107
- name: "Checkout code"
104108
uses: actions/checkout@v5
109+
- name: "Setup Python"
110+
uses: actions/setup-python@v6
111+
with:
112+
python-version: ${{ inputs.python_version }}
105113
- uses: actions/setup-node@v6
106114
with:
107115
node-version: 24.10.0
@@ -156,7 +164,7 @@ jobs:
156164
uses: actions/download-artifact@v5
157165
with:
158166
name: python-coverage-reports
159-
path: src/
167+
path: .
160168
- name: "Perform static analysis"
161169
uses: ./.github/actions/perform-static-analysis
162170
with:

‎.gitignore‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,15 @@ version.json
1212

1313
# Please, add your custom content below!
1414

15+
# Don't track ephemeral local build files
16+
target/
17+
18+
# Python build artifacts
19+
*.egg-info/
20+
.eggs/
21+
build/
22+
dist/
23+
1524
# dependencies
1625
node_modules
1726
.node-version
@@ -25,6 +34,7 @@ dist
2534
output
2635
/schemas
2736
.env
37+
**/__pycache__
2838

2939
# Python
3040
__pycache__/

‎.tool-versions‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,8 +8,6 @@ terraform 1.10.1
88
terraform-docs 0.19.0
99
trivy 0.61.0
1010
vale 3.6.0
11-
12-
1311
# ==============================================================================
1412
# The section below is reserved for Docker image versions.
1513

‎Makefile‎

Lines changed: 22 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -9,15 +9,26 @@ include scripts/init.mk
99

1010
quick-start: config clean build serve-docs # Quick start target to setup, build and serve docs @Pipeline
1111

12-
dependencies: # Install dependencies needed to build and test the project @Pipeline
13-
# TODO: Implement installation of your project dependencies
12+
dependencies:: # Install dependencies needed to build and test the project @Pipeline
13+
$(MAKE) -C src/cloudevents install
14+
$(MAKE) -C src/eventcatalogasyncapiimporter install
15+
$(MAKE) -C lambdas/mesh-poll install
16+
$(MAKE) -C lambdas/mesh-download install
17+
$(MAKE) -C utils/metric-publishers install
18+
$(MAKE) -C utils/event-publisher-py install
19+
$(MAKE) -C utils/py-mock-mesh install
20+
npm install --workspaces
21+
$(MAKE) generate
1422

15-
generate: # Generate any autogenerated output @Pipeline
16-
npm run generate-dependencies
23+
dependencies-docs:: # Install documentation dependencies @Pipeline
24+
$(MAKE) -C docs install
1725

18-
build: # Build the project artefact @Pipeline
26+
build: dependencies-docs # Build the project artefact @Pipeline
1927
$(MAKE) -C docs build
2028

29+
generate: # Generate any autogenerated output @Pipeline
30+
npm run generate-dependencies
31+
2132
debug:
2233
$(MAKE) -C docs debug
2334

@@ -32,16 +43,16 @@ clean:: # Clean-up project resources (main) @Operations
3243
$(MAKE) -C src/cloudevents clean && \
3344
$(MAKE) -C src/eventcatalogasyncapiimporter clean && \
3445
$(MAKE) -C src/eventcatalogasyncapiimporter clean-output && \
46+
$(MAKE) -C lambdas/mesh-poll clean && \
47+
$(MAKE) -C lambdas/mesh-download clean && \
48+
$(MAKE) -C utils/metric-publishers clean && \
49+
$(MAKE) -C utils/event-publisher-py clean && \
50+
$(MAKE) -C utils/py-mock-mesh clean && \
3551
$(MAKE) -C src/python-schema-generator clean && \
3652
rm -f .version
3753
npm run clean
3854

39-
config:: _install-dependencies version # Configure development environment (main) @Configuration
40-
$(MAKE) -C docs install
41-
$(MAKE) -C src/cloudevents install
42-
$(MAKE) -C src/eventcatalogasyncapiimporter install
43-
npm install
44-
$(MAKE) generate
55+
config:: _install-dependencies version dependencies # Configure development environment (main) @Configuration
4556

4657
serve-docs:
4758
$(MAKE) -C docs s

‎infrastructure/terraform/components/dl/README.md‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ No requirements.
1717
| <a name="input_component"></a> [component](#input\_component) | The variable encapsulating the name of this component | `string` | `"dl"` | no |
1818
| <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
1919
| <a name="input_enable_dynamodb_delete_protection"></a> [enable\_dynamodb\_delete\_protection](#input\_enable\_dynamodb\_delete\_protection) | Enable DynamoDB Delete Protection on all Tables | `bool` | `true` | no |
20+
| <a name="input_enable_mock_mesh"></a> [enable\_mock\_mesh](#input\_enable\_mock\_mesh) | Enable mock mesh access (dev only). Grants lambda permission to read mock-mesh prefix in non-pii bucket. | `bool` | `false` | no |
2021
| <a name="input_enable_pdm_mock"></a> [enable\_pdm\_mock](#input\_enable\_pdm\_mock) | Flag indicating whether to deploy PDM mock API (should be false in production environments) | `bool` | `true` | no |
2122
| <a name="input_environment"></a> [environment](#input\_environment) | The name of the tfscaffold environment | `string` | n/a | yes |
2223
| <a name="input_force_destroy"></a> [force\_destroy](#input\_force\_destroy) | Flag to force deletion of S3 buckets | `bool` | `false` | no |
@@ -25,7 +26,7 @@ No requirements.
2526
| <a name="input_kms_deletion_window"></a> [kms\_deletion\_window](#input\_kms\_deletion\_window) | When a kms key is deleted, how long should it wait in the pending deletion state? | `string` | `"30"` | no |
2627
| <a name="input_log_level"></a> [log\_level](#input\_log\_level) | The log level to be used in lambda functions within the component. Any log with a lower severity than the configured value will not be logged: https://docs.python.org/3/library/logging.html#levels | `string` | `"INFO"` | no |
2728
| <a name="input_log_retention_in_days"></a> [log\_retention\_in\_days](#input\_log\_retention\_in\_days) | The retention period in days for the Cloudwatch Logs events to be retained, default of 0 is indefinite | `number` | `0` | no |
28-
| <a name="input_mesh_poll_schedule"></a> [mesh\_poll\_schedule](#input\_mesh\_poll\_schedule) | Schedule to poll MESH for messages | `string` | `"cron(0,30 8-16 ? * MON-FRI *)"` | no |
29+
| <a name="input_mesh_poll_schedule"></a> [mesh\_poll\_schedule](#input\_mesh\_poll\_schedule) | Schedule to poll MESH for messages | `string` | `"rate(5 minutes)"` | no |
2930
| <a name="input_parent_acct_environment"></a> [parent\_acct\_environment](#input\_parent\_acct\_environment) | Name of the environment responsible for the acct resources used, affects things like DNS zone. Useful for named dev environments | `string` | `"main"` | no |
3031
| <a name="input_pdm_mock_access_token"></a> [pdm\_mock\_access\_token](#input\_pdm\_mock\_access\_token) | Mock access token for PDM API authentication (used in local/dev environments) | `string` | `"mock-pdm-token"` | no |
3132
| <a name="input_pdm_use_non_mock_token"></a> [pdm\_use\_non\_mock\_token](#input\_pdm\_use\_non\_mock\_token) | Whether to use the shared APIM access token from SSM (/component/environment/apim/access\_token) instead of the mock token | `bool` | `false` | no |
@@ -42,14 +43,18 @@ No requirements.
4243
| <a name="module_kms"></a> [kms](#module\_kms) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-kms.zip | n/a |
4344
| <a name="module_lambda_apim_key_generation"></a> [lambda\_apim\_key\_generation](#module\_lambda\_apim\_key\_generation) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
4445
| <a name="module_lambda_lambda_apim_refresh_token"></a> [lambda\_lambda\_apim\_refresh\_token](#module\_lambda\_lambda\_apim\_refresh\_token) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
46+
| <a name="module_mesh_download"></a> [mesh\_download](#module\_mesh\_download) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
4547
| <a name="module_mesh_poll"></a> [mesh\_poll](#module\_mesh\_poll) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
4648
| <a name="module_pdm_mock"></a> [pdm\_mock](#module\_pdm\_mock) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
4749
| <a name="module_pdm_poll"></a> [pdm\_poll](#module\_pdm\_poll) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
4850
| <a name="module_pdm_uploader"></a> [pdm\_uploader](#module\_pdm\_uploader) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
4951
| <a name="module_s3bucket_cf_logs"></a> [s3bucket\_cf\_logs](#module\_s3bucket\_cf\_logs) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
5052
| <a name="module_s3bucket_letters"></a> [s3bucket\_letters](#module\_s3bucket\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
53+
| <a name="module_s3bucket_non_pii_data"></a> [s3bucket\_non\_pii\_data](#module\_s3bucket\_non\_pii\_data) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
54+
| <a name="module_s3bucket_pii_data"></a> [s3bucket\_pii\_data](#module\_s3bucket\_pii\_data) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
5155
| <a name="module_s3bucket_static_assets"></a> [s3bucket\_static\_assets](#module\_s3bucket\_static\_assets) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
5256
| <a name="module_sqs_event_publisher_errors"></a> [sqs\_event\_publisher\_errors](#module\_sqs\_event\_publisher\_errors) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
57+
| <a name="module_sqs_mesh_download"></a> [sqs\_mesh\_download](#module\_sqs\_mesh\_download) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
5358
| <a name="module_sqs_pdm_poll"></a> [sqs\_pdm\_poll](#module\_sqs\_pdm\_poll) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
5459
| <a name="module_sqs_pdm_uploader"></a> [sqs\_pdm\_uploader](#module\_sqs\_pdm\_uploader) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
5560
| <a name="module_sqs_ttl"></a> [sqs\_ttl](#module\_sqs\_ttl) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |

‎infrastructure/terraform/components/dl/cloudwatch_event_rule_mesh_inbox_message_received.tf‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
resource "aws_cloudwatch_event_rule" "mesh_inbox_message_received" {
2+
name = "${local.csi}-mesh-inbox-message-received"
3+
description = "Route MESHInboxMessageReceived events from mesh-poll lambda to mesh-download queue"
4+
event_bus_name = aws_cloudwatch_event_bus.main.name
5+
6+
event_pattern = jsonencode({
7+
"detail" : {
8+
"type" : [
9+
"uk.nhs.notify.digital.letters.mesh.inbox.message.received.v1"
10+
]
11+
}
12+
})
13+
}
14+
15+
# EventBridge target to send events to SQS queue
16+
resource "aws_cloudwatch_event_target" "mesh_download_sqs" {
17+
rule = aws_cloudwatch_event_rule.mesh_inbox_message_received.name
18+
target_id = "mesh-inbox-message-received-sqs-target"
19+
arn = module.sqs_mesh_download.sqs_queue_arn
20+
event_bus_name = aws_cloudwatch_event_bus.main.name
21+
}

‎infrastructure/terraform/components/dl/lambda_event_source_mapping_mesh_download.tf‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
resource "aws_lambda_event_source_mapping" "mesh_download" {
2+
event_source_arn = module.sqs_mesh_download.sqs_queue_arn
3+
function_name = module.mesh_download.function_name
4+
batch_size = var.queue_batch_size
5+
maximum_batching_window_in_seconds = var.queue_batch_window_seconds
6+
7+
function_response_types = [
8+
"ReportBatchItemFailures"
9+
]
10+
}

‎infrastructure/terraform/components/dl/locals.tf‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ locals {
55
apim_api_key_ssm_parameter_name = "/${var.component}/${var.environment}/apim/api_key"
66
apim_private_key_ssm_parameter_name = "/${var.component}/${var.environment}/apim/private_key"
77
apim_keystore_s3_bucket = "nhs-${var.aws_account_id}-${var.region}-${var.environment}-${var.component}-static-assets"
8+
ssm_mesh_prefix = "/${var.component}/${var.environment}/mesh"
9+
mock_mesh_endpoint = "s3://${module.s3bucket_non_pii_data.bucket}/mock-mesh"
810
root_domain_name = "${var.environment}.${local.acct.route53_zone_names["digital-letters"]}"
911
root_domain_id = local.acct.route53_zone_ids["digital-letters"]
1012
ttl_shard_count = 3

‎infrastructure/terraform/components/dl/module_lambda_mesh_download.tf‎

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
module "mesh_download" {
2+
source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip"
3+
4+
function_name = "mesh-download"
5+
description = "A lambda function for downloading MESH messages and storing in S3"
6+
7+
aws_account_id = var.aws_account_id
8+
component = local.component
9+
environment = var.environment
10+
project = var.project
11+
region = var.region
12+
group = var.group
13+
14+
log_retention_in_days = var.log_retention_in_days
15+
kms_key_arn = module.kms.key_arn
16+
17+
iam_policy_document = {
18+
body = data.aws_iam_policy_document.mesh_download_lambda.json
19+
}
20+
21+
function_s3_bucket = local.acct.s3_buckets["lambda_function_artefacts"]["id"]
22+
function_code_base_path = local.aws_lambda_functions_dir_path
23+
function_code_dir = "mesh-download/target/dist"
24+
function_include_common = true
25+
function_module_name = "mesh_download"
26+
handler_function_name = "handler.handler"
27+
runtime = "python3.14"
28+
memory = 256
29+
timeout = 60
30+
log_level = var.log_level
31+
32+
force_lambda_code_deploy = var.force_lambda_code_deploy
33+
enable_lambda_insights = false
34+
35+
send_to_firehose = true
36+
log_destination_arn = local.log_destination_arn
37+
log_subscription_role_arn = local.acct.log_subscription_role_arn
38+
39+
lambda_env_vars = {
40+
CERTIFICATE_EXPIRY_METRIC_NAME = "mesh-download-client-certificate-near-expiry"
41+
CERTIFICATE_EXPIRY_METRIC_NAMESPACE = "dl-mesh-download"
42+
DOWNLOAD_METRIC_NAME = "mesh-download-successful-downloads"
43+
DOWNLOAD_METRIC_NAMESPACE = "dl-mesh-download"
44+
ENVIRONMENT = var.environment
45+
EVENT_PUBLISHER_DLQ_URL = module.sqs_event_publisher_errors.sqs_queue_url
46+
EVENT_PUBLISHER_EVENT_BUS_ARN = aws_cloudwatch_event_bus.main.arn
47+
PII_BUCKET = module.s3bucket_pii_data.bucket
48+
SSM_PREFIX = "${local.ssm_mesh_prefix}"
49+
USE_MESH_MOCK = var.enable_mock_mesh ? "true" : "false"
50+
}
51+
52+
}
53+
54+
data "aws_iam_policy_document" "mesh_download_lambda" {
55+
# Mock S3 ListBucket only when enabled
56+
dynamic "statement" {
57+
for_each = var.enable_mock_mesh ? [1] : []
58+
content {
59+
sid = "MockMeshListBucket"
60+
effect = "Allow"
61+
62+
actions = [
63+
"s3:ListBucket"
64+
]
65+
66+
resources = [
67+
module.s3bucket_non_pii_data.arn
68+
]
69+
70+
condition {
71+
test = "StringLike"
72+
variable = "s3:prefix"
73+
values = ["mock-mesh/*"]
74+
}
75+
}
76+
}
77+
78+
dynamic "statement" {
79+
for_each = var.enable_mock_mesh ? [1] : []
80+
content {
81+
sid = "AllowMockMeshActions"
82+
effect = "Allow"
83+
84+
actions = [
85+
"s3:GetObject",
86+
"s3:DeleteObject"
87+
]
88+
89+
resources = [
90+
"${module.s3bucket_non_pii_data.arn}/mock-mesh/*"
91+
]
92+
}
93+
}
94+
95+
statement {
96+
sid = "KMSPermissions"
97+
effect = "Allow"
98+
99+
actions = [
100+
"kms:Decrypt",
101+
"kms:GenerateDataKey",
102+
]
103+
104+
resources = [
105+
module.kms.key_arn,
106+
]
107+
}
108+
109+
statement {
110+
sid = "S3BucketPermissions"
111+
effect = "Allow"
112+
113+
actions = [
114+
"s3:PutObject",
115+
"s3:GetObject",
116+
]
117+
118+
resources = [
119+
"${module.s3bucket_pii_data.arn}/*",
120+
]
121+
}
122+
123+
statement {
124+
sid = "SQSPermissions"
125+
effect = "Allow"
126+
127+
actions = [
128+
"sqs:ReceiveMessage",
129+
"sqs:DeleteMessage",
130+
"sqs:GetQueueAttributes",
131+
]
132+
133+
resources = [
134+
module.sqs_mesh_download.sqs_queue_arn,
135+
]
136+
}
137+
138+
statement {
139+
sid = "EventBridgePermissions"
140+
effect = "Allow"
141+
142+
actions = [
143+
"events:PutEvents",
144+
]
145+
146+
resources = [
147+
aws_cloudwatch_event_bus.main.arn,
148+
]
149+
}
150+
151+
statement {
152+
sid = "DLQPermissions"
153+
effect = "Allow"
154+
155+
actions = [
156+
"sqs:SendMessage",
157+
"sqs:SendMessageBatch",
158+
]
159+
160+
resources = [
161+
module.sqs_event_publisher_errors.sqs_queue_arn,
162+
]
163+
}
164+
165+
statement {
166+
sid = "SSMPermissions"
167+
effect = "Allow"
168+
169+
actions = [
170+
"ssm:GetParameter",
171+
"ssm:GetParametersByPath",
172+
]
173+
174+
resources = [
175+
"arn:aws:ssm:${var.region}:${var.aws_account_id}:parameter${local.ssm_mesh_prefix}/*"
176+
]
177+
}
178+
}

0 commit comments

Comments
 (0)