CCM-12995 adding event pub infra

.tool-versions

@@ -3,7 +3,7 @@ gitleaks 8.24.0
 jq 1.6
 nodejs 22.15.0
 pre-commit 3.6.0
-python 3.12.11
+python 3.13.2
 terraform 1.10.1
 terraform-docs 0.19.0
 trivy 0.61.0

infrastructure/terraform/components/api/README.md

@@ -15,6 +15,8 @@ No requirements.
 | <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
 | <a name="input_enable_backups"></a> [enable\_backups](#input\_enable\_backups) | Enable backups | `bool` | `false` | no |
 | <a name="input_environment"></a> [environment](#input\_environment) | The name of the tfscaffold environment | `string` | n/a | yes |
+| <a name="input_eventpub_control_plane_bus_arn"></a> [eventpub\_control\_plane\_bus\_arn](#input\_eventpub\_control\_plane\_bus\_arn) | ARN of the EventBridge control plane bus for eventpub | `string` | `""` | no |
+| <a name="input_eventpub_data_plane_bus_arn"></a> [eventpub\_data\_plane\_bus\_arn](#input\_eventpub\_data\_plane\_bus\_arn) | ARN of the EventBridge data plane bus for eventpub | `string` | `""` | no |
 | <a name="input_force_destroy"></a> [force\_destroy](#input\_force\_destroy) | Flag to force deletion of S3 buckets | `bool` | `false` | no |
 | <a name="input_force_lambda_code_deploy"></a> [force\_lambda\_code\_deploy](#input\_force\_lambda\_code\_deploy) | If the lambda package in s3 has the same commit id tag as the terraform build branch, the lambda will not update automatically. Set to True if making changes to Lambda code from on the same commit for example during development | `bool` | `false` | no |
 | <a name="input_group"></a> [group](#input\_group) | The group variables are being inherited from (often synonmous with account short-name) | `string` | n/a | yes |

infrastructure/terraform/components/api/lambda_event_source_mapping_upsert_letter.tf

@@ -0,0 +1,9 @@
+resource "aws_lambda_event_source_mapping" "upsert_letter" {
+  event_source_arn                   = module.sqs_letter_updates.sqs_queue_arn
+  function_name                      = module.upsert_letter.function_name
+  batch_size                         = 10
+  maximum_batching_window_in_seconds = 5
+  function_response_types = [
+    "ReportBatchItemFailures"
+  ]
+}

infrastructure/terraform/components/api/module_authorizer_lambda.tf

@@ -1,5 +1,5 @@
 module "authorizer_lambda" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
 
   aws_account_id = var.aws_account_id
   component      = var.component

infrastructure/terraform/components/api/module_domain_truststore.tf

@@ -1,5 +1,5 @@
 module "domain_truststore" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-s3bucket.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip"
 
   name           = "truststore"
   aws_account_id = var.aws_account_id

infrastructure/terraform/components/api/module_kms.tf

@@ -1,5 +1,5 @@
 module "kms" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-kms.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-kms.zip"
 
   providers = {
     aws           = aws
@@ -31,6 +31,7 @@ data "aws_iam_policy_document" "kms" {
       type = "Service"
 
       identifiers = [
+        "sns.amazonaws.com",
         "logs.${var.region}.amazonaws.com",
       ]
     }
@@ -46,4 +47,24 @@ data "aws_iam_policy_document" "kms" {
       "*",
     ]
   }
+
+  statement {
+    sid    = "AllowEventsFromSharedInfraAccount"
+    effect = "Allow"
+
+    principals {
+      type        = "AWS"
+      identifiers = ["arn:aws:iam::${var.shared_infra_account_id}:root"]
+    }
+
+    actions = [
+      "kms:Encrypt",
+      "kms:Decrypt",
+      "kms:GenerateDataKey"
+    ]
+
+    resources = [
+      "*",
+    ]
+  }
 }

infrastructure/terraform/components/api/module_lambda_get_letter.tf

@@ -1,5 +1,5 @@
 module "get_letter" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
 
   function_name = "get_letter"
   description   = "Get letter status"

infrastructure/terraform/components/api/module_lambda_get_letter_data.tf

@@ -1,5 +1,5 @@
 module "get_letter_data" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
 
   function_name = "get_letter_data"
   description   = "Get the letter data"

infrastructure/terraform/components/api/module_lambda_get_letters.tf

@@ -1,5 +1,5 @@
 module "get_letters" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
 
   function_name = "get_letters"
   description   = "Get paginated letter ids"

infrastructure/terraform/components/api/module_lambda_letter_updates_transformer.tf

@@ -0,0 +1,70 @@
+module "letter_updates_transformer" {
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
+
+  function_name = "letter-updates-transformer"
+  description   = "Letter Update Filter/Producer"
+
+  aws_account_id = var.aws_account_id
+  component      = var.component
+  environment    = var.environment
+  project        = var.project
+  region         = var.region
+  group          = var.group
+
+  log_retention_in_days = var.log_retention_in_days
+  kms_key_arn           = module.kms.key_arn
+
+  iam_policy_document = {
+    body = data.aws_iam_policy_document.letter_updates_transformer_lambda.json
+  }
+
+  function_s3_bucket      = local.acct.s3_buckets["lambda_function_artefacts"]["id"]
+  function_code_base_path = local.aws_lambda_functions_dir_path
+  function_code_dir       = "letter-updates-transformer/dist"
+  function_include_common = true
+  handler_function_name   = "handler"
+  runtime                 = "nodejs22.x"
+  memory                  = 128
+  timeout                 = 5
+  log_level               = var.log_level
+
+  force_lambda_code_deploy = var.force_lambda_code_deploy
+  enable_lambda_insights   = false
+
+  send_to_firehose          = true
+  log_destination_arn       = local.destination_arn
+  log_subscription_role_arn = local.acct.log_subscription_role_arn
+
+  lambda_env_vars = merge(local.common_lambda_env_vars, {
+    EVENTPUB_SNS_TOPIC_ARN = module.eventpub.sns_topic.arn
+  })
+}
+
+data "aws_iam_policy_document" "letter_updates_transformer_lambda" {
+  statement {
+    sid    = "KMSPermissions"
+    effect = "Allow"
+
+    actions = [
+      "kms:Decrypt",
+      "kms:GenerateDataKey",
+    ]
+
+    resources = [
+      module.kms.key_arn,
+    ]
+  }
+
+  statement {
+    sid    = "AllowSNSPublish"
+    effect = "Allow"
+
+    actions = [
+      "sns:Publish"
+    ]
+
+    resources = [
+      module.eventpub.sns_topic.arn
+    ]
+  }
+}

infrastructure/terraform/components/api/module_lambda_patch_letter.tf

@@ -1,5 +1,5 @@
 module "patch_letter" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
 
   function_name = "patch_letter"
   description   = "Update the status of a letter"

infrastructure/terraform/components/api/module_lambda_post_mi.tf

@@ -1,5 +1,5 @@
 module "post_mi" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-lambda.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
 
   function_name = "post_mi"
   description   = "Add management information"

infrastructure/terraform/components/api/module_lambda_upsert_letter.tf

@@ -0,0 +1,84 @@
+module "upsert_letter" {
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip"
+
+  function_name = "upsert-letter"
+  description   = "Update or Insert the letter data in the letters table"
+
+  aws_account_id = var.aws_account_id
+  component      = var.component
+  environment    = var.environment
+  project        = var.project
+  region         = var.region
+  group          = var.group
+
+  log_retention_in_days = var.log_retention_in_days
+  kms_key_arn           = module.kms.key_arn
+
+  iam_policy_document = {
+    body = data.aws_iam_policy_document.upsert_letter_lambda.json
+  }
+
+  function_s3_bucket      = local.acct.s3_buckets["lambda_function_artefacts"]["id"]
+  function_code_base_path = local.aws_lambda_functions_dir_path
+  function_code_dir       = "upsert-letter/dist"
+  function_include_common = true
+  handler_function_name   = "handler"
+  runtime                 = "nodejs22.x"
+  memory                  = 128
+  timeout                 = 5
+  log_level               = var.log_level
+
+  force_lambda_code_deploy = var.force_lambda_code_deploy
+  enable_lambda_insights   = false
+
+  send_to_firehose          = true
+  log_destination_arn       = local.destination_arn
+  log_subscription_role_arn = local.acct.log_subscription_role_arn
+
+  lambda_env_vars = merge(local.common_lambda_env_vars, {})
+}
+
+data "aws_iam_policy_document" "upsert_letter_lambda" {
+  statement {
+    sid    = "KMSPermissions"
+    effect = "Allow"
+
+    actions = [
+      "kms:Decrypt",
+      "kms:GenerateDataKey",
+    ]
+
+    resources = [
+      module.kms.key_arn,
+    ]
+  }
+
+  statement {
+    sid    = "AllowDynamoDBWrite"
+    effect = "Allow"
+
+    actions = [
+      "dynamodb:PutItem"
+    ]
+
+    resources = [
+      aws_dynamodb_table.letters.arn,
+      "${aws_dynamodb_table.letters.arn}/index/supplierStatus-index"
+    ]
+  }
+
+  statement {
+    sid    = "AllowSQSRead"
+    effect = "Allow"
+
+    actions = [
+      "sqs:ReceiveMessage",
+      "sqs:DeleteMessage",
+      "sqs:GetQueueAttributes"
+    ]
+
+    resources = [
+      module.sqs_letter_updates.sqs_queue_arn
+    ]
+  }
+}

infrastructure/terraform/components/api/module_logging_bucket.tf

@@ -1,5 +1,5 @@
 module "logging_bucket" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-s3bucket.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip"
 
   name           = "bucket-logs"
   aws_account_id = var.aws_account_id

infrastructure/terraform/components/api/module_sqs_letter_updates.tf

@@ -0,0 +1,16 @@
+module "sqs_letter_updates" {
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-sqs.zip"
+
+  aws_account_id = var.aws_account_id
+  component      = var.component
+  environment    = var.environment
+  project        = var.project
+  region         = var.region
+  name           = "letter-updates"
+
+  sqs_kms_key_arn = module.kms.key_arn
+
+  visibility_timeout_seconds = 60
+
+  create_dlq = true
+}

infrastructure/terraform/components/api/module_supplier_ssl.tf

@@ -1,7 +1,7 @@
 module "supplier_ssl" {
   count = var.manually_configure_mtls_truststore ? 0 : 1
 
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-ssl.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-ssl.zip"
 
   name                = "sapi_trust"
   aws_account_id      = var.aws_account_id

infrastructure/terraform/components/api/modules_eventpub.tf

@@ -0,0 +1,28 @@
+module "eventpub" {
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-eventpub.zip"
+
+  name = "eventpub"
+
+  aws_account_id = var.aws_account_id
+  component      = var.component
+  environment    = var.environment
+  project        = var.project
+  region         = var.region
+  group          = var.group
+
+  default_tags = local.default_tags
+
+  kms_key_arn           = module.kms.key_arn
+  log_retention_in_days = var.log_retention_in_days
+  log_level             = "INFO"
+
+  event_cache_buffer_interval        = 500
+  enable_sns_delivery_logging        = true
+  sns_success_logging_sample_percent = 0
+
+  event_cache_expiry_days = 30
+  enable_event_cache      = true
+
+  data_plane_bus_arn    = var.eventpub_data_plane_bus_arn
+  control_plane_bus_arn = var.eventpub_control_plane_bus_arn
+}

infrastructure/terraform/components/api/modules_eventsub.tf

@@ -0,0 +1,26 @@
+module "eventsub" {
+  source = "../../modules/eventsub"
+
+  name = "eventsub"
+
+  aws_account_id = var.aws_account_id
+  component      = var.component
+  environment    = var.environment
+  project        = var.project
+  region         = var.region
+  group          = var.group
+
+  default_tags = local.default_tags
+
+  kms_key_arn           = module.kms.key_arn
+  log_retention_in_days = var.log_retention_in_days
+  log_level             = "INFO"
+
+  event_cache_buffer_interval        = 500
+  enable_sns_delivery_logging        = true
+  sns_success_logging_sample_percent = 0
+
+  event_cache_expiry_days = 30
+  enable_event_cache      = true
+  shared_infra_account_id = var.shared_infra_account_id
+}

infrastructure/terraform/components/api/s3_test_letters.tf

@@ -1,5 +1,5 @@
 module "s3bucket_test_letters" {
-  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.20/terraform-s3bucket.zip"
+  source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip"
 
   name = "test-letters"
 

infrastructure/terraform/components/api/sns_topic_subscription_eventsub_sqs_letter_updates.tf

@@ -0,0 +1,5 @@
+resource "aws_sns_topic_subscription" "eventsub_sqs_letter_updates" {
+  topic_arn = module.eventsub.sns_topic.arn
+  protocol  = "sqs"
+  endpoint  = module.sqs_letter_updates.sqs_queue_arn
+}