[ELI-702] pulling in main

Author: TOEL2

infrastructure/modules/lambda/outputs.tf

@@ -16,3 +16,7 @@ output "aws_lambda_invoke_arn" {
 output "lambda_cmk_arn" {
   value = aws_kms_key.lambda_cmk.arn
 }
+
+output "lambda_signing_profile_name" {
+  value = aws_signer_signing_profile.lambda_signing.name
+}

infrastructure/modules/lambda/signing.tf

@@ -23,7 +23,3 @@ resource "aws_lambda_code_signing_config" "signing_config" {
 
   description = "Only allow Lambda bundles signed by our trusted signer profile"
 }
-
-output "lambda_signing_profile_name" {
-  value = aws_signer_signing_profile.lambda_signing.name
-}

infrastructure/stacks/api-layer/lambda.tf

@@ -35,6 +35,12 @@ module "eligibility_signposting_lambda_function" {
   api_domain_name                           = local.api_domain_name
 }
 
+
+# Needed by github workflows to sign the lambda artifacts
+output "signing_profile_name" {
+  value = module.eligibility_signposting_lambda_function.lambda_signing_profile_name
+}
+
 # -----------------------------------------------------------------------------
 # Secret rotation lambdas
 # -----------------------------------------------------------------------------

infrastructure/stacks/iams-developer-roles/github_actions_policies.tf

@@ -91,6 +91,8 @@ data "aws_iam_policy_document" "permissions_boundary" {
 
       # Kinesis Stream - audit log streaming
       "kinesis:*",
+      # signing - code signing for Lambda functions
+      "signer:*",
 
       # CodeSigning
       "signer:*",

infrastructure/stacks/iams-developer-roles/iams_permissions_boundary.tf

@@ -1,3 +1,5 @@
 locals {
   stack_name = "iams-developer-roles"
+  lambda_signing_profile_name = "${terraform.workspace == "default" ? "" : "${terraform.workspace}"}EligibilityApiLambdaSigningProfile"
+  lambda_signing_profile_arn  = "arn:aws:signer:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:/signing-profiles/${local.lambda_signing_profile_name}"
 }

infrastructure/stacks/iams-developer-roles/locals.tf

@@ -57,7 +57,7 @@ pytest-docker = "^3.2.3"
 stamina = "^25.2.0"
 pytest-freezer = "^0.4.9"
 moto = "^5.1.19"
-requests = "^2.32.5"
+requests = "^2.33.0"
 jsonschema = "^4.25.1"
 behave = "^1.3.3"
 python-dotenv = "^1.2.1"