Skip to content

CCM-23434: Add DL getLetterData permissions #684

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
masl2 merged 7 commits into from
Sep 4, 2026
Merged

CCM-23434: Add DL getLetterData permissions #684

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
3cc7a03
add DL variable feed for pdf perms
masl2 Sep 3, 2026
329dcfb
Merge branch 'main' into fix/CCM-23434_dl-bucket-perms
masl2 Sep 3, 2026
b68a9c5
remove unneeded put permission
masl2 Sep 4, 2026
cb9a8fe
missing KMS
masl2 Sep 4, 2026
2df71f4
Merge branch 'main' into fix/CCM-23434_dl-bucket-perms
masl2 Sep 4, 2026
6b2a520
consolidate policy
masl2 Sep 4, 2026
ebd430c
undo consolidate
masl2 Sep 4, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 5 additions & 3 deletions infrastructure/terraform/components/api/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ No requirements.
## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
| <a name="input_ca_pem_filename"></a> [ca\_pem\_filename](#input\_ca\_pem\_filename) | Filename for the CA truststore file within the s3 bucket | `string` | `null` | no |
| <a name="input_commit_id"></a> [commit\_id](#input\_commit\_id) | The commit to deploy. Must be in the tree for branch\_name | `string` | `"HEAD"` | no |
Expand All @@ -19,6 +19,8 @@ No requirements.
| <a name="input_csoc_log_forwarding"></a> [csoc\_log\_forwarding](#input\_csoc\_log\_forwarding) | Enable forwarding of API Gateway logs to CSOC | `bool` | `true` | no |
| <a name="input_default_tags"></a> [default\_tags](#input\_default\_tags) | A map of default tags to apply to all taggable resources within the component | `map(string)` | `{}` | no |
| <a name="input_deploy_supplier_mock_scheduler"></a> [deploy\_supplier\_mock\_scheduler](#input\_deploy\_supplier\_mock\_scheduler) | Deploy EventBridge Scheduler trigger for supplier mock lambda | `bool` | `false` | no |
| <a name="input_digital_letters_account_id"></a> [digital\_letters\_account\_id](#input\_digital\_letters\_account\_id) | AWS Account ID for Digital Letters | `string` | `"000000000000"` | no |
| <a name="input_digital_letters_environment"></a> [digital\_letters\_environment](#input\_digital\_letters\_environment) | Environment of Digital Letters | `string` | `"main"` | no |
| <a name="input_disable_gateway_execute_endpoint"></a> [disable\_gateway\_execute\_endpoint](#input\_disable\_gateway\_execute\_endpoint) | Disable the execution endpoint for the API Gateway | `bool` | `true` | no |
| <a name="input_download_url_ttl_seconds"></a> [download\_url\_ttl\_seconds](#input\_download\_url\_ttl\_seconds) | TTL in seconds for generated download URLs | `number` | `60` | no |
| <a name="input_enable_alarms"></a> [enable\_alarms](#input\_enable\_alarms) | Enable CloudWatch alarms for this deployed environment | `bool` | `true` | no |
Expand Down Expand Up @@ -57,7 +59,7 @@ No requirements.
## Modules

| Name | Source | Version |
|------|--------|---------|
| ---- | ------ | ------- |
| <a name="module_amendment_event_transformer"></a> [amendment\_event\_transformer](#module\_amendment\_event\_transformer) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/4.0.2/terraform-lambda.zip | n/a |
| <a name="module_amendments_queue"></a> [amendments\_queue](#module\_amendments\_queue) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.1.5/terraform-sqs.zip | n/a |
| <a name="module_authorizer_lambda"></a> [authorizer\_lambda](#module\_authorizer\_lambda) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/4.0.2/terraform-lambda.zip | n/a |
Expand Down Expand Up @@ -96,7 +98,7 @@ No requirements.
## Outputs

| Name | Description |
|------|-------------|
| ---- | ----------- |
| <a name="output_api_urll"></a> [api\_urll](#output\_api\_urll) | n/a |
| <a name="output_deployment"></a> [deployment](#output\_deployment) | Deployment details used for post-deployment scripts |
<!-- vale on -->
Expand Down
4 changes: 4 additions & 0 deletions infrastructure/terraform/components/api/locals.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,10 @@ locals {
core_pdf_bucket_arn = "arn:aws:s3:::comms-${var.core_account_id}-eu-west-2-${var.core_environment}-api-stg-pdf-pipeline"
core_s3_kms_key_alias_name = "alias/comms-${var.core_environment}-api-s3"

digital_letters_pdf_bucket_arn = "arn:aws:s3:::nhs-${var.digital_letters_account_id}-eu-west-2-${var.digital_letters_environment}-dl-file-safe"
digital_letters_s3_kms_key_alias_name = "alias/nhs-${var.digital_letters_environment}-dl"


event_cache_bucket_name = lookup(module.eventpub.s3_bucket_event_cache, "bucket", null)
eventsub_event_cache_bucket_name = lookup(module.eventsub.s3_bucket_event_cache, "bucket", null)

Expand Down
24 changes: 21 additions & 3 deletions infrastructure/terraform/components/api/module_lambda_get_letter_data.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,19 +74,20 @@ data "aws_iam_policy_document" "get_letter_data_lambda" {
]
resources = [
module.s3bucket_test_letters.arn,
local.core_pdf_bucket_arn
local.core_pdf_bucket_arn,
local.digital_letters_pdf_bucket_arn,
]
}

statement {
sid = "S3GetObjectForPresign"
actions = [
"s3:GetObject",
"s3:PutObject",
"s3:GetObject"
] # allows 404 response instead of 403 if object missing
Comment thread
masl2 marked this conversation as resolved.
resources = [
"${module.s3bucket_test_letters.arn}/*",
"${local.core_pdf_bucket_arn}/*",
"${local.digital_letters_pdf_bucket_arn}/*",
Comment thread
masl2 marked this conversation as resolved.
]
}

Expand All @@ -106,4 +107,21 @@ data "aws_iam_policy_document" "get_letter_data_lambda" {
values = [local.core_s3_kms_key_alias_name]
}
}

statement {
sid = "KMSForDigitalLettersS3Access"
actions = [
"kms:Decrypt",
"kms:GenerateDataKey",
"kms:DescribeKey"
]
resources = [
"arn:aws:kms:${var.region}:${var.digital_letters_account_id}:key/*"
]
condition {
test = "ForAnyValue:StringEquals"
variable = "kms:ResourceAliases"
values = [local.digital_letters_s3_kms_key_alias_name]
}
}
}
11 changes: 11 additions & 0 deletions infrastructure/terraform/components/api/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -181,7 +181,18 @@ variable "core_environment" {
type = string
description = "Environment of Core"
default = "prod"
}

variable "digital_letters_account_id" {
type = string
description = "AWS Account ID for Digital Letters"
default = "000000000000"
}

variable "digital_letters_environment" {
type = string
description = "Environment of Digital Letters"
default = "main"
}

variable "enable_backups" {
Expand Down
4 changes: 2 additions & 2 deletions infrastructure/terraform/modules/alarms-ddb/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,12 @@
## Requirements

| Name | Version |
|------|---------|
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |
## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_alarm_prefix"></a> [alarm\_prefix](#input\_alarm\_prefix) | n/a | `string` | n/a | yes |
| <a name="input_evaluation_periods"></a> [evaluation\_periods](#input\_evaluation\_periods) | n/a | `number` | `1` | no |
| <a name="input_period_seconds"></a> [period\_seconds](#input\_period\_seconds) | n/a | `number` | `60` | no |
Expand Down
4 changes: 2 additions & 2 deletions infrastructure/terraform/modules/alarms-lambda/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,12 @@
## Requirements

| Name | Version |
|------|---------|
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |
## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_alarm_prefix"></a> [alarm\_prefix](#input\_alarm\_prefix) | n/a | `string` | n/a | yes |
| <a name="input_enable_error_log_metric"></a> [enable\_error\_log\_metric](#input\_enable\_error\_log\_metric) | n/a | `bool` | `true` | no |
| <a name="input_error_log_evaluation_periods"></a> [error\_log\_evaluation\_periods](#input\_error\_log\_evaluation\_periods) | n/a | `number` | `1` | no |
Expand Down
4 changes: 2 additions & 2 deletions infrastructure/terraform/modules/alarms-sqs/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,12 @@
## Requirements

| Name | Version |
|------|---------|
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |
## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_age_anomaly_datapoints_to_alarm"></a> [age\_anomaly\_datapoints\_to\_alarm](#input\_age\_anomaly\_datapoints\_to\_alarm) | n/a | `number` | `3` | no |
| <a name="input_age_anomaly_evaluation_periods"></a> [age\_anomaly\_evaluation\_periods](#input\_age\_anomaly\_evaluation\_periods) | n/a | `number` | `3` | no |
| <a name="input_age_period_seconds"></a> [age\_period\_seconds](#input\_age\_period\_seconds) | n/a | `number` | `300` | no |
Expand Down
8 changes: 4 additions & 4 deletions infrastructure/terraform/modules/eventsub/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,12 +5,12 @@
## Requirements

| Name | Version |
|------|---------|
| ---- | ------- |
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 1.9.0 |
## Inputs

| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| ---- | ----------- | ---- | ------- | :------: |
| <a name="input_access_logging_bucket"></a> [access\_logging\_bucket](#input\_access\_logging\_bucket) | Name of S3 bucket to use for access logging | `string` | `""` | no |
| <a name="input_aws_account_id"></a> [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
| <a name="input_component"></a> [component](#input\_component) | The name of the terraformscaffold component calling this module | `string` | n/a | yes |
Expand Down Expand Up @@ -39,12 +39,12 @@
## Modules

| Name | Source | Version |
|------|--------|---------|
| ---- | ------ | ------- |
| <a name="module_s3bucket_event_cache"></a> [s3bucket\_event\_cache](#module\_s3bucket\_event\_cache) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.6/terraform-s3bucket.zip | n/a |
## Outputs

| Name | Description |
|------|-------------|
| ---- | ----------- |
| <a name="output_s3_bucket_event_cache"></a> [s3\_bucket\_event\_cache](#output\_s3\_bucket\_event\_cache) | S3 Bucket ARN and Name for event cache |
| <a name="output_sns_topic"></a> [sns\_topic](#output\_sns\_topic) | SNS Topic ARN and Name |
<!-- vale on -->
Expand Down
Loading