Feature/rgjb aa eli 329 add xray tracing for lambda (#243)

* Added xray permissions policy for lambda

* Add xray vpc endpoint

* Added xray to the permissions boundary

* Added xray to the assumed role permissions boundary

* Testing permission boundary.

* testing perm bound.

---------

Co-authored-by: ayeshalshukri1-nhs <112615598+ayeshalshukri1-nhs@users.noreply.github.com>

Author: robbailiff2

infrastructure/stacks/api-layer/assumed_role_permissions_boundary.tf

@@ -33,7 +33,8 @@ data "aws_iam_policy_document" "assumed_role_permissions_boundary" {
       "support:*",
       "sqs:*",
       "tag:*",
-      "trustedadvisor:*"
+      "trustedadvisor:*",
+      "xray:*"
     ]
 
     resources = ["*"]

infrastructure/stacks/api-layer/iam_policies.tf

@@ -1,7 +1,7 @@
 # Read-only policy for DynamoDB
 data "aws_iam_policy_document" "dynamodb_read_policy_doc" {
   statement {
-    actions   = ["dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan"]
+    actions = ["dynamodb:GetItem", "dynamodb:Query", "dynamodb:Scan"]
     resources = [module.eligibility_status_table.arn]
   }
 }
@@ -16,7 +16,7 @@ resource "aws_iam_role_policy" "lambda_dynamodb_read_policy" {
 # Write-only policy for DynamoDB
 data "aws_iam_policy_document" "dynamodb_write_policy_doc" {
   statement {
-    actions   = ["dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem"]
+    actions = ["dynamodb:PutItem", "dynamodb:UpdateItem", "dynamodb:DeleteItem", "dynamodb:BatchWriteItem"]
     resources = [module.eligibility_status_table.arn]
   }
 }
@@ -37,15 +37,15 @@ data "aws_iam_policy_document" "dynamo_kms_access_policy_doc" {
 
 # Attach dynamoDB write policy to external write role
 resource "aws_iam_role_policy" "external_dynamodb_write_policy" {
-  count  = length(aws_iam_role.write_access_role)
+  count = length(aws_iam_role.write_access_role)
   name   = "DynamoDBWriteAccess"
   role   = aws_iam_role.write_access_role[count.index].id
   policy = data.aws_iam_policy_document.dynamodb_write_policy_doc.json
 }
 
 # Attach dynamo KMS policy to external write role
 resource "aws_iam_role_policy" "external_kms_access_policy" {
-  count  = length(aws_iam_role.write_access_role)
+  count = length(aws_iam_role.write_access_role)
   name   = "KMSAccessForDynamoDB"
   role   = aws_iam_role.write_access_role[count.index].id
   policy = data.aws_iam_policy_document.dynamo_kms_access_policy_doc.json
@@ -65,7 +65,7 @@ data "aws_iam_policy_document" "s3_rules_bucket_policy" {
     ]
     condition {
       test     = "Bool"
-      values   = ["true"]
+      values = ["true"]
       variable = "aws:SecureTransport"
     }
   }
@@ -90,7 +90,7 @@ data "aws_iam_policy_document" "rules_s3_bucket_policy" {
       "${module.s3_rules_bucket.storage_bucket_arn}/*",
     ]
     principals {
-      type        = "*"
+      type = "*"
       identifiers = ["*"]
     }
     condition {
@@ -121,7 +121,7 @@ data "aws_iam_policy_document" "audit_s3_bucket_policy" {
       "${module.s3_audit_bucket.storage_bucket_arn}/*",
     ]
     principals {
-      type        = "*"
+      type = "*"
       identifiers = ["*"]
     }
     condition {
@@ -192,15 +192,15 @@ resource "aws_iam_role_policy_attachment" "lambda_logs_policy_attachment" {
 # Policy doc for S3 Audit bucket
 data "aws_iam_policy_document" "s3_audit_bucket_policy" {
   statement {
-    sid     = "AllowSSLRequestsOnly"
+    sid = "AllowSSLRequestsOnly"
     actions = ["s3:*"]
     resources = [
       module.s3_audit_bucket.storage_bucket_arn,
       "${module.s3_audit_bucket.storage_bucket_arn}/*",
     ]
     condition {
       test     = "Bool"
-      values   = ["true"]
+      values = ["true"]
       variable = "aws:SecureTransport"
     }
   }
@@ -222,18 +222,18 @@ data "aws_iam_policy_document" "dynamodb_kms_key_policy" {
     sid    = "EnableIamUserPermissions"
     effect = "Allow"
     principals {
-      type        = "AWS"
+      type = "AWS"
       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
     }
-    actions   = ["kms:*"]
+    actions = ["kms:*"]
     resources = ["*"]
   }
 
   statement {
     sid    = "AllowLambdaDecrypt"
     effect = "Allow"
     principals {
-      type        = "AWS"
+      type = "AWS"
       identifiers = [aws_iam_role.eligibility_lambda_role.arn]
     }
     actions = [
@@ -260,21 +260,21 @@ data "aws_iam_policy_document" "s3_rules_kms_key_policy" {
     sid    = "EnableIamUserPermissions"
     effect = "Allow"
     principals {
-      type        = "AWS"
+      type = "AWS"
       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
     }
-    actions   = ["kms:*"]
+    actions = ["kms:*"]
     resources = ["*"]
   }
 
   statement {
     sid    = "AllowLambdaDecrypt"
     effect = "Allow"
     principals {
-      type        = "AWS"
+      type = "AWS"
       identifiers = [aws_iam_role.eligibility_lambda_role.arn]
     }
-    actions   = ["kms:Decrypt"]
+    actions = ["kms:Decrypt"]
     resources = ["*"]
   }
 }
@@ -293,17 +293,17 @@ data "aws_iam_policy_document" "s3_audit_kms_key_policy" {
     sid    = "EnableIamUserPermissions"
     effect = "Allow"
     principals {
-      type        = "AWS"
+      type = "AWS"
       identifiers = ["arn:aws:iam::${data.aws_caller_identity.current.account_id}:root"]
     }
-    actions   = ["kms:*"]
+    actions = ["kms:*"]
     resources = ["*"]
   }
   statement {
     sid    = "AllowLambdaFullWrite"
     effect = "Allow"
     principals {
-      type        = "AWS"
+      type = "AWS"
       identifiers = [aws_iam_role.eligibility_lambda_role.arn, aws_iam_role.eligibility_audit_firehose_role.arn]
     }
     actions = [
@@ -340,3 +340,21 @@ resource "aws_iam_role_policy" "lambda_firehose_policy" {
   role   = aws_iam_role.eligibility_lambda_role.id
   policy = data.aws_iam_policy_document.lambda_firehose_write_policy.json
 }
+
+data "aws_iam_policy_document" "lambda_xray_tracing_permissions_policy" {
+  statement {
+    sid    = "AllowLambdaToPutToXRay"
+    effect = "Allow"
+    actions = [
+      "xray:PutTraceSegments",
+      "xray:PutTelemetryRecords"
+    ]
+    resources = ["*"]
+  }
+}
+
+resource "aws_iam_role_policy" "lambda_xray_tracing_policy" {
+  name   = "LambdaXRayWritePolicy"
+  role   = aws_iam_role.eligibility_lambda_role.id
+  policy = data.aws_iam_policy_document.lambda_xray_tracing_permissions_policy.json
+}

infrastructure/stacks/iams-developer-roles/iams_permissions_boundary.tf

@@ -33,7 +33,8 @@ data "aws_iam_policy_document" "permissions_boundary" {
       "support:*",
       "sqs:*",
       "tag:*",
-      "trustedadvisor:*"
+      "trustedadvisor:*",
+      "xray:*"
     ]
 
     resources = ["*"]

infrastructure/stacks/networking/locals.tf

@@ -22,6 +22,8 @@ locals {
     sts               = "com.amazonaws.${local.region}.sts"
     sqs               = "com.amazonaws.${local.region}.sqs"
     kinesis-firehose  = "com.amazonaws.${local.region}.kinesis-firehose"
+    xray              = "com.amazonaws.${local.region}.xray"
+
   }
 
   # VPC Gateway Endpoints