Merge pull request #662 from NHSDigital/bugfix/eja-eli-710-remove-lambda-insights-to-allow-preprod-code-signing

eja - removing lambda insights as the  layer is signed by an AWS account with  no accessible ARN, so we can't  include it in  code  signing

Author: eddalmond1

infrastructure/modules/lambda/lambda.tf

@@ -41,10 +41,8 @@ resource "aws_lambda_function" "eligibility_signposting_lambda" {
   }
 
   layers = compact([
-    var.environment == "prod" || var.environment == "preprod" ?
-    "arn:aws:lambda:${var.region}:580247275435:layer:LambdaInsightsExtension:${var.lambda_insights_extension_version}"
-    :
-    null
+    # LambdaInsightsExtension excluded: incompatible with Lambda code signing enforcement.
+    # AWS signs the layer with an internal profile not available via the API.
   ])
 
 

infrastructure/modules/lambda/variables.tf

@@ -74,11 +74,6 @@ variable "provisioned_concurrency_count" {
   type        = number
 }
 
-variable "lambda_insights_extension_version" {
-  description = "version number of LambdaInsightsExtension"
-  type        = number
-}
-
 variable "api_domain_name" {
   description = "api domain name - env variable for status endpoint response"
   type        = string

infrastructure/stacks/api-layer/iam_policies.tf

@@ -250,12 +250,6 @@ resource "aws_iam_role_policy_attachment" "lambda_logs_policy_attachment" {
   policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
 }
 
-#Attach CloudWatchLambdaInsightsExecutionRolePolicy to lambda for enhanced monitoring
-resource "aws_iam_role_policy_attachment" "lambda_insights_policy" {
-  role       = aws_iam_role.eligibility_lambda_role.name
-  policy_arn = "arn:aws:iam::aws:policy/CloudWatchLambdaInsightsExecutionRolePolicy"
-}
-
 # Policy document to read from Kinesis Source stream
 data "aws_iam_policy_document" "kinesis_source_access" {
   statement {

infrastructure/stacks/api-layer/lambda.tf

@@ -27,7 +27,6 @@ module "eligibility_signposting_lambda_function" {
   eligibility_status_table_name             = module.eligibility_status_table.table_name
   kinesis_audit_stream_name                 = aws_kinesis_stream.kinesis_source_stream.name
   hashing_secret_name                       = module.secrets_manager.aws_hashing_secret_name
-  lambda_insights_extension_version         = 38
   log_level                                 = "INFO"
   enable_xray_patching                      = "true"
   stack_name                                = local.stack_name

infrastructure/stacks/iams-developer-roles/github_actions_policies.tf

@@ -145,8 +145,7 @@ resource "aws_iam_policy" "lambda_management" {
           "arn:aws:lambda:*:${data.aws_caller_identity.current.account_id}:function:eligibility_signposting_api",
           "arn:aws:lambda:*:${data.aws_caller_identity.current.account_id}:function:eligibility_signposting_api:*",
           "arn:aws:lambda:*:${data.aws_caller_identity.current.account_id}:function:default-CreatePendingSecretFunction",
-          "arn:aws:lambda:*:${data.aws_caller_identity.current.account_id}:function:default-PromoteToCurrentFunction",
-          "arn:aws:lambda:*:580247275435:layer:LambdaInsightsExtension:*"
+          "arn:aws:lambda:*:${data.aws_caller_identity.current.account_id}:function:default-PromoteToCurrentFunction"
         ]
       }
     ]