CCM-18334: Bump Eventpub to 4.0.10 and add KMS perms to Eventsub local module

jamesthompson26-nhs · jamesthompson26-nhs · commit 0bfa34d0f35b · 2026-06-23T09:58:21.000+01:00
diff --git a/infrastructure/terraform/components/api/modules_eventpub.tf b/infrastructure/terraform/components/api/modules_eventpub.tf
@@ -1,5 +1,5 @@
 module "eventpub" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.6/terraform-eventpub.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/4.0.10/terraform-eventpub.zip"
 
   name = "eventpub"
 
diff --git a/infrastructure/terraform/modules/eventsub/iam_role_sns.tf b/infrastructure/terraform/modules/eventsub/iam_role_sns.tf
@@ -48,4 +48,17 @@ data "aws_iam_policy_document" "firehose_delivery" {
       "${aws_kinesis_firehose_delivery_stream.main[0].arn}",
     ]
   }
+  statement {
+    sid    = "AllowKmsAccessForFirehoseDelivery"
+    effect = "Allow"
+
+    actions = [
+      "kms:GenerateDataKey",
+      "kms:Decrypt",
+    ]
+
+    resources = [
+      var.kms_key_arn,
+    ]
+  }
 }

Original file line number	Diff line number	Diff line change
`@@ -48,4 +48,17 @@ data "aws_iam_policy_document" "firehose_delivery" {`
`48`	`48`	`"${aws_kinesis_firehose_delivery_stream.main[0].arn}",`
`49`	`49`	`]`
`50`	`50`	`}`
	`51`	`+ statement {`
	`52`	`+ sid = "AllowKmsAccessForFirehoseDelivery"`
	`53`	`+ effect = "Allow"`
	`54`	`+`
	`55`	`+ actions = [`
	`56`	`+ "kms:GenerateDataKey",`
	`57`	`+ "kms:Decrypt",`
	`58`	`+ ]`
	`59`	`+`
	`60`	`+ resources = [`
	`61`	`+ var.kms_key_arn,`
	`62`	`+ ]`
	`63`	`+ }`
`51`	`64`	`}`