CCM-13303: Create report scheduler

.trivyignore

@@ -2,3 +2,4 @@
 CVE-2024-49761 # https://avd.aquasec.com/nvd/cve-2024-49761 ## latest Jekyll Webpack (0.2.7) installs old version of rexml
 CVE-2024-47220 # https://avd.aquasec.com/nvd/cve-2024-47220 ## latest lint_roller (1.1.0) installs old version of rexml
 CVE-2024-7254 # https://avd.aquasec.com/nvd/cve-2024-7254 ## latest Jekyll Webpack (0.2.7) installs old version of google-protobuf
+CVE-2026-25128

infrastructure/terraform/components/dl/README.md

@@ -35,6 +35,7 @@ No requirements.
 | <a name="input_queue_batch_size"></a> [queue\_batch\_size](#input\_queue\_batch\_size) | maximum number of queue items to process | `number` | `10` | no |
 | <a name="input_queue_batch_window_seconds"></a> [queue\_batch\_window\_seconds](#input\_queue\_batch\_window\_seconds) | maximum time in seconds between processing events | `number` | `1` | no |
 | <a name="input_region"></a> [region](#input\_region) | The AWS Region | `string` | n/a | yes |
+| <a name="input_report_scheduler_schedule"></a> [report\_scheduler\_schedule](#input\_report\_scheduler\_schedule) | Schedule to trigger sender reports | `string` | `"cron(30 4 * * ? *)"` | no |
 | <a name="input_shared_infra_account_id"></a> [shared\_infra\_account\_id](#input\_shared\_infra\_account\_id) | The AWS Shared Infra Account ID (numeric) | `string` | n/a | yes |
 | <a name="input_ttl_poll_schedule"></a> [ttl\_poll\_schedule](#input\_ttl\_poll\_schedule) | Schedule to poll for any overdue TTL records | `string` | `"rate(10 minutes)"` | no |
 ## Modules
@@ -53,6 +54,7 @@ No requirements.
 | <a name="module_pdm_uploader"></a> [pdm\_uploader](#module\_pdm\_uploader) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_print_analyser"></a> [print\_analyser](#module\_print\_analyser) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_print_status_handler"></a> [print\_status\_handler](#module\_print\_status\_handler) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
+| <a name="module_report_scheduler"></a> [report\_scheduler](#module\_report\_scheduler) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
 | <a name="module_s3bucket_cf_logs"></a> [s3bucket\_cf\_logs](#module\_s3bucket\_cf\_logs) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
 | <a name="module_s3bucket_file_safe"></a> [s3bucket\_file\_safe](#module\_s3bucket\_file\_safe) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |
 | <a name="module_s3bucket_letters"></a> [s3bucket\_letters](#module\_s3bucket\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-s3bucket.zip | n/a |

infrastructure/terraform/components/dl/locals.tf

@@ -7,6 +7,7 @@ locals {
   apim_keystore_s3_bucket              = "nhs-${var.aws_account_id}-${var.region}-${var.environment}-${var.component}-static-assets"
   unscanned_files_bucket               = local.acct.additional_s3_buckets["digital-letters_unscanned-files"]["id"]
   ssm_mesh_prefix                      = "/${var.component}/${var.environment}/mesh"
+  ssm_senders_prefix                   = "/${var.component}/${var.environment}/senders"
   mock_mesh_endpoint                   = "s3://${module.s3bucket_non_pii_data.bucket}/mock-mesh"
   root_domain_name                     = "${var.environment}.${local.acct.route53_zone_names["digital-letters"]}"
   root_domain_id                       = local.acct.route53_zone_ids["digital-letters"]

infrastructure/terraform/components/dl/module_lambda_core_notifier.tf

@@ -56,7 +56,7 @@ data "aws_iam_policy_document" "core_notifier_lambda" {
 
     resources = [
       "arn:aws:ssm:${var.region}:${var.aws_account_id}:parameter/${var.component}/${var.environment}/apim/*",
-      "arn:aws:ssm:${var.region}:${var.aws_account_id}:parameter/${var.component}/${var.environment}/senders/*"
+      "arn:aws:ssm:${var.region}:${var.aws_account_id}:parameter/${local.ssm_senders_prefix}/*"
     ]
   }
 

infrastructure/terraform/components/dl/module_lambda_file_scanner.tf

@@ -35,11 +35,11 @@ module "file_scanner" {
   log_subscription_role_arn = local.acct.log_subscription_role_arn
 
   lambda_env_vars = {
-    "DOCUMENT_REFERENCE_BUCKET"    = module.s3bucket_pii_data.bucket
-    "UNSCANNED_FILES_BUCKET"       = local.unscanned_files_bucket
-    "UNSCANNED_FILES_PATH_PREFIX"  = var.environment
+    "DOCUMENT_REFERENCE_BUCKET"     = module.s3bucket_pii_data.bucket
+    "UNSCANNED_FILES_BUCKET"        = local.unscanned_files_bucket
+    "UNSCANNED_FILES_PATH_PREFIX"   = var.environment
     "EVENT_PUBLISHER_EVENT_BUS_ARN" = aws_cloudwatch_event_bus.main.arn
-    "EVENT_PUBLISHER_DLQ_URL"      = module.sqs_event_publisher_errors.sqs_queue_url
+    "EVENT_PUBLISHER_DLQ_URL"       = module.sqs_event_publisher_errors.sqs_queue_url
   }
 }
 

infrastructure/terraform/components/dl/module_lambda_mesh_poll.tf

@@ -42,7 +42,7 @@ module "mesh_poll" {
     ENVIRONMENT                         = var.environment
     EVENT_PUBLISHER_DLQ_URL             = module.sqs_event_publisher_errors.sqs_queue_url
     EVENT_PUBLISHER_EVENT_BUS_ARN       = aws_cloudwatch_event_bus.main.arn
-    MAXIMUM_RUNTIME_MILLISECONDS        = "240000"  # 4 minutes (Lambda has 5 min timeout)
+    MAXIMUM_RUNTIME_MILLISECONDS        = "240000" # 4 minutes (Lambda has 5 min timeout)
     POLLING_METRIC_NAME                 = "mesh-poll-successful-polls"
     POLLING_METRIC_NAMESPACE            = "dl-mesh-poll"
     SSM_PREFIX                          = "${local.ssm_mesh_prefix}"

infrastructure/terraform/components/dl/module_lambda_print_analyser.tf

@@ -35,8 +35,8 @@ module "print_analyser" {
   log_subscription_role_arn = local.acct.log_subscription_role_arn
 
   lambda_env_vars = {
-    "EVENT_PUBLISHER_EVENT_BUS_ARN"        = aws_cloudwatch_event_bus.main.arn
-    "EVENT_PUBLISHER_DLQ_URL"              = module.sqs_event_publisher_errors.sqs_queue_url
+    "EVENT_PUBLISHER_EVENT_BUS_ARN" = aws_cloudwatch_event_bus.main.arn
+    "EVENT_PUBLISHER_DLQ_URL"       = module.sqs_event_publisher_errors.sqs_queue_url
   }
 }
 

infrastructure/terraform/components/dl/module_lambda_print_status_handler.tf

@@ -35,8 +35,8 @@ module "print_status_handler" {
   log_subscription_role_arn = local.acct.log_subscription_role_arn
 
   lambda_env_vars = {
-    "EVENT_PUBLISHER_EVENT_BUS_ARN"        = aws_cloudwatch_event_bus.main.arn
-    "EVENT_PUBLISHER_DLQ_URL"              = module.sqs_event_publisher_errors.sqs_queue_url
+    "EVENT_PUBLISHER_EVENT_BUS_ARN" = aws_cloudwatch_event_bus.main.arn
+    "EVENT_PUBLISHER_DLQ_URL"       = module.sqs_event_publisher_errors.sqs_queue_url
   }
 }
 

infrastructure/terraform/components/dl/module_lambda_report_scheduler.tf

@@ -0,0 +1,100 @@
+module "report_scheduler" {
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip"
+
+  function_name = "report-scheduler"
+  description   = "A function for triggering reports"
+
+  aws_account_id = var.aws_account_id
+  component      = local.component
+  environment    = var.environment
+  project        = var.project
+  region         = var.region
+  group          = var.group
+
+  log_retention_in_days = var.log_retention_in_days
+  kms_key_arn           = module.kms.key_arn
+
+  iam_policy_document = {
+    body = data.aws_iam_policy_document.report_scheduler_lambda.json
+  }
+
+  function_s3_bucket      = local.acct.s3_buckets["lambda_function_artefacts"]["id"]
+  function_code_base_path = local.aws_lambda_functions_dir_path
+  function_code_dir       = "report-scheduler/dist"
+  function_include_common = true
+  handler_function_name   = "handler"
+  runtime                 = "nodejs22.x"
+  memory                  = 128
+  timeout                 = 360
+  log_level               = var.log_level
+  schedule                = var.report_scheduler_schedule
+
+  force_lambda_code_deploy = var.force_lambda_code_deploy
+  enable_lambda_insights   = false
+
+  log_destination_arn       = local.log_destination_arn
+  log_subscription_role_arn = local.acct.log_subscription_role_arn
+
+  lambda_env_vars = {
+    "EVENT_PUBLISHER_EVENT_BUS_ARN" = aws_cloudwatch_event_bus.main.arn
+    "EVENT_PUBLISHER_DLQ_URL"       = module.sqs_event_publisher_errors.sqs_queue_url
+    "ENVIRONMENT"                   = var.environment
+  }
+}
+
+data "aws_iam_policy_document" "report_scheduler_lambda" {
+  statement {
+    sid    = "KMSPermissions"
+    effect = "Allow"
+
+    actions = [
+      "kms:Decrypt",
+      "kms:GenerateDataKey",
+    ]
+
+    resources = [
+      module.kms.key_arn,
+    ]
+  }
+
+  statement {
+    sid    = "EventBridgePermissions"
+    effect = "Allow"
+
+    actions = [
+      "events:PutEvents",
+    ]
+
+    resources = [
+      aws_cloudwatch_event_bus.main.arn,
+    ]
+  }
+
+  statement {
+    sid    = "DLQPermissions"
+    effect = "Allow"
+
+    actions = [
+      "sqs:SendMessage",
+      "sqs:SendMessageBatch",
+    ]
+
+    resources = [
+      module.sqs_event_publisher_errors.sqs_queue_arn,
+    ]
+  }
+
+  statement {
+    sid    = "SSMPermissions"
+    effect = "Allow"
+
+    actions = [
+      "ssm:GetParameter",
+      "ssm:GetParametersByPath",
+    ]
+
+    resources = [
+      "arn:aws:ssm:${var.region}:${var.aws_account_id}:parameter${local.ssm_senders_prefix}/*"
+    ]
+  }
+}

infrastructure/terraform/components/dl/module_lambda_ttl_create.tf

@@ -125,7 +125,7 @@ data "aws_iam_policy_document" "ttl_create_lambda" {
     ]
 
     resources = [
-      "arn:aws:ssm:${var.region}:${var.aws_account_id}:parameter/${var.component}/${var.environment}/senders/*"
+      "arn:aws:ssm:${var.region}:${var.aws_account_id}:parameter/${local.ssm_senders_prefix}/*"
     ]
   }
 }

infrastructure/terraform/components/dl/module_sqs_core_notifier.tf

@@ -38,7 +38,7 @@ data "aws_iam_policy_document" "sqs_inbound_event" {
     condition {
       test     = "ArnLike"
       variable = "aws:SourceArn"
-      values   = [ aws_cloudwatch_event_rule.pdm_resource_available.arn ]
+      values   = [aws_cloudwatch_event_rule.pdm_resource_available.arn]
     }
   }
 }

infrastructure/terraform/components/dl/ssm_parameter_mesh_config.tf

@@ -10,15 +10,15 @@ resource "aws_ssm_parameter" "mesh_config" {
     mesh_mailbox          = "mock-mailbox"
     mesh_mailbox_password = "mock-password"
     mesh_shared_key       = "mock-shared-key"
-  }) : jsonencode({
+    }) : jsonencode({
     mesh_endpoint         = "UNSET"
     mesh_mailbox          = "UNSET"
     mesh_mailbox_password = "UNSET"
     mesh_shared_key       = "UNSET"
   })
 
   tags = merge(local.default_tags, {
-    Backup = "true"
+    Backup      = "true"
     Description = "MESH configuration"
   })
 
@@ -37,7 +37,7 @@ resource "aws_ssm_parameter" "mesh_client_cert" {
   value       = var.enable_mock_mesh ? "mock-cert" : "UNSET"
 
   tags = merge(local.default_tags, {
-    Backup = "true"
+    Backup      = "true"
     Description = "MESH client certificate"
   })
 
@@ -56,7 +56,7 @@ resource "aws_ssm_parameter" "mesh_client_key" {
   value       = var.enable_mock_mesh ? "mock-key" : "UNSET"
 
   tags = merge(local.default_tags, {
-    Backup = "true"
+    Backup      = "true"
     Description = "MESH client private key"
   })
 

infrastructure/terraform/components/dl/variables.tf

@@ -89,7 +89,7 @@ variable "parent_acct_environment" {
 variable "mesh_poll_schedule" {
   type        = string
   description = "Schedule to poll MESH for messages"
-  default     = "rate(5 minutes)"  # Every 5 minutes
+  default     = "rate(5 minutes)" # Every 5 minutes
 }
 
 variable "enable_mock_mesh" {
@@ -176,3 +176,9 @@ variable "enable_pdm_mock" {
   description = "Flag indicating whether to deploy PDM mock API (should be false in production environments)"
   default     = true
 }
+
+variable "report_scheduler_schedule" {
+  type        = string
+  description = "Schedule to trigger sender reports"
+  default     = "cron(30 4 * * ? *)" # Daily at 04:30
+}

lambdas/report-scheduler/jest.config.ts

@@ -0,0 +1,5 @@
+import { baseJestConfig } from '../../jest.config.base';
+
+const config = baseJestConfig;
+
+export default config;

lambdas/report-scheduler/package.json

@@ -0,0 +1,29 @@
+{
+  "dependencies": {
+    "aws-lambda": "^1.0.7",
+    "digital-letters-events": "^0.0.1",
+    "sender-management": "^0.0.1",
+    "utils": "^0.0.1"
+  },
+  "devDependencies": {
+    "@tsconfig/node22": "^22.0.2",
+    "@types/aws-lambda": "^8.10.155",
+    "@types/jest": "^29.5.14",
+    "@types/lodash": "^4.17.20",
+    "aws-sdk-client-mock": "^4.1.0",
+    "aws-sdk-client-mock-jest": "^4.1.0",
+    "jest": "^29.7.0",
+    "jest-mock-extended": "^3.0.7",
+    "typescript": "^5.9.3"
+  },
+  "name": "nhs-notify-digital-letters-report-scheduler-lambda",
+  "private": true,
+  "scripts": {
+    "lambda-build": "rm -rf dist && npx esbuild --bundle --minify --sourcemap --target=es2020 --platform=node --loader:.node=file --entry-names=[name] --outdir=dist src/index.ts",
+    "lint": "eslint .",
+    "lint:fix": "eslint . --fix",
+    "test:unit": "jest",
+    "typecheck": "tsc --noEmit"
+  },
+  "version": "0.0.1"
+}