diff --git a/infrastructure/terraform/components/api/README.md b/infrastructure/terraform/components/api/README.md
index 4fc886b42..2d0a72d9a 100644
--- a/infrastructure/terraform/components/api/README.md
+++ b/infrastructure/terraform/components/api/README.md
@@ -51,8 +51,8 @@ No requirements.
| [ddb\_alarms\_letters](#module\_ddb\_alarms\_letters) | ../../modules/alarms-ddb | n/a |
| [ddb\_alarms\_mi](#module\_ddb\_alarms\_mi) | ../../modules/alarms-ddb | n/a |
| [ddb\_alarms\_suppliers](#module\_ddb\_alarms\_suppliers) | ../../modules/alarms-ddb | n/a |
-| [domain\_truststore](#module\_domain\_truststore) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip | n/a |
-| [eventpub](#module\_eventpub) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.31/terraform-eventpub.zip | n/a |
+| [domain\_truststore](#module\_domain\_truststore) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.4/terraform-s3bucket.zip | n/a |
+| [eventpub](#module\_eventpub) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.4/terraform-eventpub.zip | n/a |
| [eventsub](#module\_eventsub) | ../../modules/eventsub | n/a |
| [get\_letter](#module\_get\_letter) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
| [get\_letter\_data](#module\_get\_letter\_data) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
@@ -62,7 +62,6 @@ No requirements.
| [lambda\_alarms](#module\_lambda\_alarms) | ../../modules/alarms-lambda | n/a |
| [letter\_status\_updates\_queue](#module\_letter\_status\_updates\_queue) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a |
| [letter\_updates\_transformer](#module\_letter\_updates\_transformer) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
-| [logging\_bucket](#module\_logging\_bucket) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip | n/a |
| [mi\_updates\_transformer](#module\_mi\_updates\_transformer) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip | n/a |
| [patch\_letter](#module\_patch\_letter) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
| [post\_letters](#module\_post\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a |
diff --git a/infrastructure/terraform/components/api/module_domain_truststore.tf b/infrastructure/terraform/components/api/module_domain_truststore.tf
index cd15c58d1..77a927101 100644
--- a/infrastructure/terraform/components/api/module_domain_truststore.tf
+++ b/infrastructure/terraform/components/api/module_domain_truststore.tf
@@ -1,5 +1,5 @@
module "domain_truststore" {
- source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip"
+ source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.4/terraform-s3bucket.zip"
name = "truststore"
aws_account_id = var.aws_account_id
@@ -12,11 +12,9 @@ module "domain_truststore" {
kms_key_arn = module.kms.key_id
bucket_logging_target = {
- bucket = module.logging_bucket.bucket
- prefix = "truststore/"
+ bucket = local.acct.s3_buckets["access_logs"]["id"]
}
policy_documents = [
]
-
}
diff --git a/infrastructure/terraform/components/api/module_logging_bucket.tf b/infrastructure/terraform/components/api/module_logging_bucket.tf
deleted file mode 100644
index ace1eac80..000000000
--- a/infrastructure/terraform/components/api/module_logging_bucket.tf
+++ /dev/null
@@ -1,35 +0,0 @@
-module "logging_bucket" {
- source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip"
-
- name = "bucket-logs"
- aws_account_id = var.aws_account_id
- component = var.component
- environment = var.environment
- project = var.project
- region = var.region
-
- default_tags = local.default_tags
- kms_key_arn = module.kms.key_id
-
- policy_documents = [
- data.aws_iam_policy_document.logging.json
- ]
-}
-
-data "aws_iam_policy_document" "logging" {
- statement {
- sid = "s3-log-delivery"
- effect = "Allow"
-
- principals {
- type = "Service"
- identifiers = ["logging.s3.amazonaws.com"]
- }
-
- actions = ["s3:PutObject"]
-
- resources = [
- "${module.logging_bucket.arn}/*",
- ]
- }
-}
diff --git a/infrastructure/terraform/components/api/modules_eventpub.tf b/infrastructure/terraform/components/api/modules_eventpub.tf
index 83547ea62..d9145fe3d 100644
--- a/infrastructure/terraform/components/api/modules_eventpub.tf
+++ b/infrastructure/terraform/components/api/modules_eventpub.tf
@@ -1,5 +1,5 @@
module "eventpub" {
- source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.31/terraform-eventpub.zip"
+ source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.4/terraform-eventpub.zip"
name = "eventpub"
@@ -28,6 +28,8 @@ module "eventpub" {
data_plane_bus_arn = var.eventpub_data_plane_bus_arn
control_plane_bus_arn = var.eventpub_control_plane_bus_arn
+ access_logging_bucket = local.acct.s3_buckets["access_logs"]["id"]
+
additional_policies_for_event_cache_bucket = [
data.aws_iam_policy_document.eventcache[0].json
]
diff --git a/infrastructure/terraform/components/api/modules_eventsub.tf b/infrastructure/terraform/components/api/modules_eventsub.tf
index c97b5a908..3b6d624ec 100644
--- a/infrastructure/terraform/components/api/modules_eventsub.tf
+++ b/infrastructure/terraform/components/api/modules_eventsub.tf
@@ -27,4 +27,6 @@ module "eventsub" {
enable_event_cache = var.enable_event_cache
shared_infra_account_id = var.shared_infra_account_id
+
+ access_logging_bucket = local.acct.s3_buckets["access_logs"]["id"]
}
diff --git a/infrastructure/terraform/modules/eventsub/README.md b/infrastructure/terraform/modules/eventsub/README.md
index 9aadbb3f2..2b4a7369a 100644
--- a/infrastructure/terraform/modules/eventsub/README.md
+++ b/infrastructure/terraform/modules/eventsub/README.md
@@ -11,6 +11,7 @@
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
+| [access\_logging\_bucket](#input\_access\_logging\_bucket) | Name of S3 bucket to use for access logging | `string` | `""` | no |
| [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes |
| [component](#input\_component) | The name of the terraformscaffold component calling this module | `string` | n/a | yes |
| [default\_tags](#input\_default\_tags) | Default tag map for application to all taggable resources in the module | `map(string)` | `{}` | no |
@@ -35,7 +36,7 @@
| Name | Source | Version |
|------|--------|---------|
-| [s3bucket\_event\_cache](#module\_s3bucket\_event\_cache) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip | n/a |
+| [s3bucket\_event\_cache](#module\_s3bucket\_event\_cache) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.4/terraform-s3bucket.zip | n/a |
## Outputs
| Name | Description |
diff --git a/infrastructure/terraform/modules/eventsub/module_s3bucket_event_cache.tf b/infrastructure/terraform/modules/eventsub/module_s3bucket_event_cache.tf
index 0d072a76c..9e610641f 100644
--- a/infrastructure/terraform/modules/eventsub/module_s3bucket_event_cache.tf
+++ b/infrastructure/terraform/modules/eventsub/module_s3bucket_event_cache.tf
@@ -1,5 +1,5 @@
module "s3bucket_event_cache" {
- source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip"
+ source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.4/terraform-s3bucket.zip"
count = var.enable_event_cache ? 1 : 0
@@ -40,6 +40,10 @@ module "s3bucket_event_cache" {
data.aws_iam_policy_document.s3bucket_event_cache[0].json
]
+ bucket_logging_target = {
+ bucket = "${var.access_logging_bucket}"
+ }
+
public_access = {
block_public_acls = true
block_public_policy = true
diff --git a/infrastructure/terraform/modules/eventsub/variables.tf b/infrastructure/terraform/modules/eventsub/variables.tf
index f808bcb4a..02a8ae85e 100644
--- a/infrastructure/terraform/modules/eventsub/variables.tf
+++ b/infrastructure/terraform/modules/eventsub/variables.tf
@@ -119,3 +119,9 @@ variable "glue_role_arn" {
type = string
description = "ARN of the Glue execution role from the parent"
}
+
+variable "access_logging_bucket" {
+ type = string
+ description = "Name of S3 bucket to use for access logging"
+ default = ""
+}