diff --git a/infrastructure/terraform/components/api/README.md b/infrastructure/terraform/components/api/README.md index 4fc886b42..2d0a72d9a 100644 --- a/infrastructure/terraform/components/api/README.md +++ b/infrastructure/terraform/components/api/README.md @@ -51,8 +51,8 @@ No requirements. | [ddb\_alarms\_letters](#module\_ddb\_alarms\_letters) | ../../modules/alarms-ddb | n/a | | [ddb\_alarms\_mi](#module\_ddb\_alarms\_mi) | ../../modules/alarms-ddb | n/a | | [ddb\_alarms\_suppliers](#module\_ddb\_alarms\_suppliers) | ../../modules/alarms-ddb | n/a | -| [domain\_truststore](#module\_domain\_truststore) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip | n/a | -| [eventpub](#module\_eventpub) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.31/terraform-eventpub.zip | n/a | +| [domain\_truststore](#module\_domain\_truststore) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.4/terraform-s3bucket.zip | n/a | +| [eventpub](#module\_eventpub) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.4/terraform-eventpub.zip | n/a | | [eventsub](#module\_eventsub) | ../../modules/eventsub | n/a | | [get\_letter](#module\_get\_letter) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a | | [get\_letter\_data](#module\_get\_letter\_data) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a | @@ -62,7 +62,6 @@ No requirements. | [lambda\_alarms](#module\_lambda\_alarms) | ../../modules/alarms-lambda | n/a | | [letter\_status\_updates\_queue](#module\_letter\_status\_updates\_queue) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.24/terraform-sqs.zip | n/a | | [letter\_updates\_transformer](#module\_letter\_updates\_transformer) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a | -| [logging\_bucket](#module\_logging\_bucket) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip | n/a | | [mi\_updates\_transformer](#module\_mi\_updates\_transformer) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-lambda.zip | n/a | | [patch\_letter](#module\_patch\_letter) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a | | [post\_letters](#module\_post\_letters) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.29/terraform-lambda.zip | n/a | diff --git a/infrastructure/terraform/components/api/module_domain_truststore.tf b/infrastructure/terraform/components/api/module_domain_truststore.tf index cd15c58d1..77a927101 100644 --- a/infrastructure/terraform/components/api/module_domain_truststore.tf +++ b/infrastructure/terraform/components/api/module_domain_truststore.tf @@ -1,5 +1,5 @@ module "domain_truststore" { - source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip" + source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.4/terraform-s3bucket.zip" name = "truststore" aws_account_id = var.aws_account_id @@ -12,11 +12,9 @@ module "domain_truststore" { kms_key_arn = module.kms.key_id bucket_logging_target = { - bucket = module.logging_bucket.bucket - prefix = "truststore/" + bucket = local.acct.s3_buckets["access_logs"]["id"] } policy_documents = [ ] - } diff --git a/infrastructure/terraform/components/api/module_logging_bucket.tf b/infrastructure/terraform/components/api/module_logging_bucket.tf deleted file mode 100644 index ace1eac80..000000000 --- a/infrastructure/terraform/components/api/module_logging_bucket.tf +++ /dev/null @@ -1,35 +0,0 @@ -module "logging_bucket" { - source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip" - - name = "bucket-logs" - aws_account_id = var.aws_account_id - component = var.component - environment = var.environment - project = var.project - region = var.region - - default_tags = local.default_tags - kms_key_arn = module.kms.key_id - - policy_documents = [ - data.aws_iam_policy_document.logging.json - ] -} - -data "aws_iam_policy_document" "logging" { - statement { - sid = "s3-log-delivery" - effect = "Allow" - - principals { - type = "Service" - identifiers = ["logging.s3.amazonaws.com"] - } - - actions = ["s3:PutObject"] - - resources = [ - "${module.logging_bucket.arn}/*", - ] - } -} diff --git a/infrastructure/terraform/components/api/modules_eventpub.tf b/infrastructure/terraform/components/api/modules_eventpub.tf index 83547ea62..d9145fe3d 100644 --- a/infrastructure/terraform/components/api/modules_eventpub.tf +++ b/infrastructure/terraform/components/api/modules_eventpub.tf @@ -1,5 +1,5 @@ module "eventpub" { - source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.31/terraform-eventpub.zip" + source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.4/terraform-eventpub.zip" name = "eventpub" @@ -28,6 +28,8 @@ module "eventpub" { data_plane_bus_arn = var.eventpub_data_plane_bus_arn control_plane_bus_arn = var.eventpub_control_plane_bus_arn + access_logging_bucket = local.acct.s3_buckets["access_logs"]["id"] + additional_policies_for_event_cache_bucket = [ data.aws_iam_policy_document.eventcache[0].json ] diff --git a/infrastructure/terraform/components/api/modules_eventsub.tf b/infrastructure/terraform/components/api/modules_eventsub.tf index c97b5a908..3b6d624ec 100644 --- a/infrastructure/terraform/components/api/modules_eventsub.tf +++ b/infrastructure/terraform/components/api/modules_eventsub.tf @@ -27,4 +27,6 @@ module "eventsub" { enable_event_cache = var.enable_event_cache shared_infra_account_id = var.shared_infra_account_id + + access_logging_bucket = local.acct.s3_buckets["access_logs"]["id"] } diff --git a/infrastructure/terraform/modules/eventsub/README.md b/infrastructure/terraform/modules/eventsub/README.md index 9aadbb3f2..2b4a7369a 100644 --- a/infrastructure/terraform/modules/eventsub/README.md +++ b/infrastructure/terraform/modules/eventsub/README.md @@ -11,6 +11,7 @@ | Name | Description | Type | Default | Required | |------|-------------|------|---------|:--------:| +| [access\_logging\_bucket](#input\_access\_logging\_bucket) | Name of S3 bucket to use for access logging | `string` | `""` | no | | [aws\_account\_id](#input\_aws\_account\_id) | The AWS Account ID (numeric) | `string` | n/a | yes | | [component](#input\_component) | The name of the terraformscaffold component calling this module | `string` | n/a | yes | | [default\_tags](#input\_default\_tags) | Default tag map for application to all taggable resources in the module | `map(string)` | `{}` | no | @@ -35,7 +36,7 @@ | Name | Source | Version | |------|--------|---------| -| [s3bucket\_event\_cache](#module\_s3bucket\_event\_cache) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip | n/a | +| [s3bucket\_event\_cache](#module\_s3bucket\_event\_cache) | https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.4/terraform-s3bucket.zip | n/a | ## Outputs | Name | Description | diff --git a/infrastructure/terraform/modules/eventsub/module_s3bucket_event_cache.tf b/infrastructure/terraform/modules/eventsub/module_s3bucket_event_cache.tf index 0d072a76c..9e610641f 100644 --- a/infrastructure/terraform/modules/eventsub/module_s3bucket_event_cache.tf +++ b/infrastructure/terraform/modules/eventsub/module_s3bucket_event_cache.tf @@ -1,5 +1,5 @@ module "s3bucket_event_cache" { - source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/v2.0.26/terraform-s3bucket.zip" + source = "https://github.com/NHSDigital/nhs-notify-shared-modules/releases/download/3.0.4/terraform-s3bucket.zip" count = var.enable_event_cache ? 1 : 0 @@ -40,6 +40,10 @@ module "s3bucket_event_cache" { data.aws_iam_policy_document.s3bucket_event_cache[0].json ] + bucket_logging_target = { + bucket = "${var.access_logging_bucket}" + } + public_access = { block_public_acls = true block_public_policy = true diff --git a/infrastructure/terraform/modules/eventsub/variables.tf b/infrastructure/terraform/modules/eventsub/variables.tf index f808bcb4a..02a8ae85e 100644 --- a/infrastructure/terraform/modules/eventsub/variables.tf +++ b/infrastructure/terraform/modules/eventsub/variables.tf @@ -119,3 +119,9 @@ variable "glue_role_arn" { type = string description = "ARN of the Glue execution role from the parent" } + +variable "access_logging_bucket" { + type = string + description = "Name of S3 bucket to use for access logging" + default = "" +}