[PRMP-629] - new s3 bucket

nhsconnect · Jul 24, 2024 · ef34064 · ef34064
1 parent fbbab7a
commit ef34064
Show file tree

Hide file tree

Showing 6 changed files with 89 additions and 12 deletions.
diff --git a/gocd/gp-registrations-mi.pipeline.gocd.yaml b/gocd/gp-registrations-mi.pipeline.gocd.yaml
@@ -59,6 +59,9 @@ pipelines:
                       - TF_VAR_gp_registrations_mi_image_tag=$GO_DEPENDENCY_LABEL_GP_REGISTRATIONS_MI_IMAGE ./tasks dojo-plan gp-registrations-mi dev
       - apply_dev:
           clean_workspace: true
+          approval:
+            type: manual
+            allow_only_on_success: true
           jobs:
             apply:
               resources:

diff --git a/sonar-project.properties b/sonar-project.properties
@@ -9,7 +9,7 @@ sonar.python.version=3.9
 
 # Path is relative to the sonar-project.properties file. Replace "\" by "/" on Windows.
 #sonar.sources=.
-sonar.sources=lambda/
+sonar.sources=lambda/, stacks/
 
 # Encoding of the source code. Default is default system encoding
 #sonar.sourceEncoding=UTF-8
diff --git a/stacks/gp-registrations-mi/terraform/iam-event-enrichment.tf b/stacks/gp-registrations-mi/terraform/iam-event-enrichment.tf
@@ -19,7 +19,8 @@ resource "aws_iam_role" "bulk_ods_lambda_role" {
   managed_policy_arns = [
     aws_iam_policy.dynamodb_policy_bulk_icb_ods_data_lambda.arn,
     aws_iam_policy.dynamodb_policy_bulk_ods_data_lambda.arn,
-    aws_iam_policy.bulk_ods_update_lambda_cloudwatch_log_access.arn
+    aws_iam_policy.bulk_ods_update_lambda_cloudwatch_log_access.arn,
+    aws_iam_policy.s3_ods_csv_document_data_policy.arn
   ]
 }
 

diff --git a/stacks/gp-registrations-mi/terraform/icb-ods-dynamo.tf b/stacks/gp-registrations-mi/terraform/icb-ods-dynamo.tf
@@ -15,7 +15,7 @@ resource "aws_dynamodb_table" "mi-api-icb-ods_dynamodb_table" {
   }
 
   tags = {
-    Name        = "dynamodb-table-1"
+    Name        = "mi_enrichment_icb_ods"
     Environment = var.environment
   }
 }

diff --git a/stacks/gp-registrations-mi/terraform/s3-ods-csv-updates.tf b/stacks/gp-registrations-mi/terraform/s3-ods-csv-updates.tf
@@ -0,0 +1,69 @@
+resource "aws_s3_bucket" "ods-csv-files-bucket" {
+  bucket        = "${terraform.workspace}-ods-csv-files"
+  force_destroy = true
+
+  tags = {
+    Name        = "${terraform.workspace}-ods-csv-files"
+    Environment = var.environment
+  }
+}
+
+resource "aws_s3_bucket_lifecycle_configuration" "mi_events_lifecycle" {
+  bucket = aws_s3_bucket.mi_events_output.id
+
+  rule {
+    id = "expire-ods-csv-after-3-months"
+    status = "Enabled"
+
+    expiration {
+      days = 90
+    }
+  }
+}
+
+resource "aws_s3_bucket_public_access_block" "ods-csv-files-bucket_output" {
+  bucket = aws_s3_bucket.ods-csv-files-bucket.id
+
+  block_public_acls       = true
+  block_public_policy     = true
+  ignore_public_acls      = true
+  restrict_public_buckets = true
+}
+
+resource "aws_s3_bucket_versioning" "mi_events_output" {
+  bucket = aws_s3_bucket.ods-csv-files-bucket.id
+
+  versioning_configuration {
+    status = "Enabled"
+  }
+}
+
+resource "aws_s3_bucket_ownership_controls" "s3_bucket_acl_ownership" {
+  bucket = aws_s3_bucket.ods-csv-files-bucket.id
+  rule {
+    object_ownership = "ObjectWriter"
+  }
+}
+
+resource "aws_s3_bucket_acl" "bucket_acl" {
+  bucket     = aws_s3_bucket.ods-csv-files-bucket.id
+  acl        = "private"
+}
+
+resource "aws_iam_policy" "s3_ods_csv_document_data_policy" {
+  name = "${terraform.workspace}_${aws_s3_bucket.ods-csv-files-bucket.bucket}_get_document_data_policy"
+
+  policy = jsonencode({
+    "Version" : "2012-10-17",
+    "Statement" : [
+      {
+        "Effect" : "Allow",
+        "Action" : [
+          "s3:GetObject",
+          "s3:PutObject",
+        ],
+        "Resource" : ["${aws_s3_bucket.ods-csv-files-bucket}/*"]
+      }
+    ]
+  })
+}
diff --git a/stacks/gp-registrations-mi/terraform/s3.tf b/stacks/gp-registrations-mi/terraform/s3.tf
@@ -5,15 +5,6 @@ resource "aws_s3_bucket" "mi_events_output" {
     prevent_destroy = true
   }
 
-  lifecycle_rule {
-    enabled = true
-    id      = "expire-mi-objects-after-2-years"
-
-    expiration {
-      days = 730
-    }
-  }
-
   tags = merge(
     local.common_tags,
     {
@@ -23,6 +14,19 @@ resource "aws_s3_bucket" "mi_events_output" {
   )
 }
 
+resource "aws_s3_bucket_lifecycle_configuration" "mi_events_lifecycle" {
+  bucket = aws_s3_bucket.mi_events_output.id
+
+  rule {
+    id = "expire-mi-objects-after-2-years"
+    status = "Enabled"
+
+    expiration {
+      days = 730
+    }
+  }
+}
+
 resource "aws_s3_bucket_acl" "mi_events_output" {
   bucket = aws_s3_bucket.mi_events_output.id
   acl    = "private"