eli-537 added US to permitted geos, for preprod only, to allow github action tests to still flow

Author: eddalmond1

infrastructure/stacks/api-layer/waf.tf

@@ -118,8 +118,9 @@ resource "aws_wafv2_web_acl" "api_gateway" {
   }
 
   # Rule 5: Geographic Block Rule - Block non-UK traffic
-  # NHS-specific requirement: block requests originating from outside GB
-  # Defence-in-depth against stolen mTLS certificates being used from outside the UK
+  # Blocks requests from outside the allowed country list.
+  # In prod: GB only - all legitimate traffic must originate from within the UK
+  # In preprod: GB + US - GitHub Actions integration tests run from US-based servers
   rule {
     name     = "BlockNonUK"
     priority = 50
@@ -132,7 +133,7 @@ resource "aws_wafv2_web_acl" "api_gateway" {
       not_statement {
         statement {
           geo_match_statement {
-            country_codes = ["GB"] # United Kingdom only (does NOT include Crown Dependencies)
+            country_codes = var.environment == "preprod" ? ["GB", "US"] : ["GB"]
           }
         }
       }

infrastructure/stacks/api-layer/waf_alarms.tf

@@ -130,6 +130,8 @@ resource "aws_cloudwatch_metric_alarm" "waf_rate_limit_blocks" {
 }
 
 # Alarm for blocked non-UK requests
+# In preprod US is also allowed (for GitHub Actions), so this alarm fires on traffic
+# from countries outside GB+US. In prod it fires on anything outside GB.
 resource "aws_cloudwatch_metric_alarm" "waf_non_uk_counted" {
   count               = local.waf_enabled ? 1 : 0
   alarm_name          = "WAF-NonUK-BlockedRequests-${local.workspace}"