Skip to content

Commit f513f31

Browse files
KarthikeyannhsKarthikeyannhs
committed
Merge branch 'main' into ELI-578/consumer-campaign-config-mappings
# Conflicts: # src/eligibility_signposting_api/common/request_validator.py # tests/unit/common/test_request_validator.py
2 parents e7d8862 + dc483f3 commit f513f31

10 files changed

Lines changed: 625 additions & 113 deletions

File tree

‎.github/workflows/release-candidate.yml‎

Lines changed: 434 additions & 0 deletions
Large diffs are not rendered by default.

‎infrastructure/stacks/api-layer/step_functions.tf‎

Lines changed: 17 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@ resource "aws_sfn_state_machine" "rotation_machine" {
2424
Resource = "arn:aws:states:::sns:publish.waitForTaskToken",
2525
TimeoutSeconds = 86400,
2626
Parameters = {
27+
Subject = "Action required: AWSPENDING secret created (Environment: ${var.environment})",
2728
TopicArn = aws_sns_topic.secret_rotation.arn,
2829
"Message.$" = local.add_jobs_message
2930
},
@@ -44,6 +45,7 @@ resource "aws_sfn_state_machine" "rotation_machine" {
4445
Resource = "arn:aws:states:::sns:publish.waitForTaskToken",
4546
TimeoutSeconds = 86400,
4647
Parameters = {
48+
Subject = "Action required: Secret AWSPENDING promoted to AWSCURRENT (Environment: ${var.environment})",
4749
TopicArn = aws_sns_topic.secret_rotation.arn,
4850
"Message.$" = local.delete_jobs_message
4951
},
@@ -59,7 +61,7 @@ resource "aws_sfn_state_machine" "rotation_machine" {
5961
Resource = "arn:aws:states:::sns:publish",
6062
Parameters = {
6163
TopicArn = aws_sns_topic.secret_rotation.arn,
62-
Subject = "WARNING: Secret Rotation Timed Out",
64+
Subject = "Warning: Secret rotation timed out (Environment: ${var.environment})",
6365
"Message.$" = local.timeout_message
6466
},
6567
Next = "Fail_Timeout"
@@ -75,7 +77,7 @@ resource "aws_sfn_state_machine" "rotation_machine" {
7577
Resource = "arn:aws:states:::sns:publish",
7678
Parameters = {
7779
TopicArn = aws_sns_topic.secret_rotation.arn,
78-
Subject = "CRITICAL: Secret Rotation Failed",
80+
Subject = "Critical: Secret Rotation Failed (Environment: ${var.environment})",
7981
"Message.$" = local.failure_message
8082
},
8183
Next = "Fail_Generic"
@@ -91,7 +93,7 @@ locals {
9193
add_jobs_message = <<EOT
9294
States.Format('
9395
======================================================
94-
ACTION REQUIRED: PENDING SECRET CREATED
96+
Action required: AWSPENDING secret created (Environment: ${var.environment})
9597
======================================================
9698
9799
A manual action is required to proceed.
@@ -100,20 +102,20 @@ CONTEXT:
100102
Secret Name: ${module.secrets_manager.aws_hashing_secret_name}
101103
102104
INSTRUCTIONS:
103-
1. Run the "Add New Hashes" job.
105+
1. Run the "Add New Hashes (elid_add_new_salt)" job.
104106
2. Ensure the new hashes are working as expected.
105107
3. Run the command below to approve and resume the workflow:
106108
107-
aws stepfunctions send-task-success --task-token {}
109+
aws stepfunctions send-task-success --task-token {} --task-output {}
108110
109111
======================================================
110-
', $$.Task.Token)
112+
', $$.Task.Token, '{}')
111113
EOT
112114

113115
delete_jobs_message = <<EOT
114116
States.Format('
115117
======================================================
116-
ACTION REQUIRED: SECRET AWSPENDING PROMOTED TO AWSCURRENT
118+
Action required: Secret AWSPENDING promoted to AWSCURRENT (Environment: ${var.environment})
117119
======================================================
118120
119121
A manual action is required to proceed.
@@ -122,24 +124,27 @@ CONTEXT:
122124
Secret Name: ${module.secrets_manager.aws_hashing_secret_name}
123125
124126
INSTRUCTIONS:
125-
1. Run the "Delete Old Hashes" job.
127+
1. Run the "Delete Old Hashes (elid_delete_old_salt)" job.
126128
2. Ensure the old hashes have been removed successfully.
127129
3. Run the command below to approve and resume the workflow:
128130
129-
aws stepfunctions send-task-success --task-token {}
131+
aws stepfunctions send-task-success --task-token {} --task-output {}
130132
131133
======================================================
132-
', $$.Task.Token)
134+
', $$.Task.Token, '{}')
133135
EOT
134136

135137
failure_message = <<EOT
136138
States.Format('
137139
======================================================
138-
CRITICAL: ROTATION FAILED
140+
Critical: Rotation failed (Environment: ${var.environment})
139141
======================================================
140142
141143
The workflow encountered an error and could not complete.
142144
145+
CONTEXT:
146+
Secret Name: ${module.secrets_manager.aws_hashing_secret_name}
147+
143148
ERROR DETAILS:
144149
{}
145150
@@ -162,7 +167,7 @@ EOT
162167
timeout_message = <<EOT
163168
States.Format('
164169
======================================================
165-
WARNING: ROTATION TIMED OUT
170+
Warning: Rotation timed out (Environment: ${var.environment})
166171
======================================================
167172
168173
The manual verification step was not completed within the 24-hour limit.

‎infrastructure/stacks/iams-developer-roles/github_actions_policies.tf‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -70,6 +70,7 @@ resource "aws_iam_policy" "lambda_management" {
7070
"lambda:PutProvisionedConcurrencyConfig",
7171
"lambda:DeleteProvisionedConcurrencyConfig",
7272
"lambda:ListProvisionedConcurrencyConfigs",
73+
"lambda:PutFunctionConcurrency",
7374

7475
],
7576
Resource = [
@@ -290,7 +291,8 @@ resource "aws_iam_policy" "api_infrastructure" {
290291
# CloudWatch Logs subscription filters for CSOC forwarding
291292
"logs:PutSubscriptionFilter",
292293
"logs:DeleteSubscriptionFilter",
293-
"logs:DescribeSubscriptionFilters"
294+
"logs:DescribeSubscriptionFilters",
295+
"logs:PutRetentionPolicy"
294296
],
295297
Resource = [
296298
# VPC Flow Logs
@@ -304,7 +306,8 @@ resource "aws_iam_policy" "api_infrastructure" {
304306
# WAF v2 logs (both naming conventions)
305307
"arn:aws:logs:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:log-group:/aws/wafv2/*",
306308
"arn:aws:logs:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:log-group:aws-wafv2-logs-*",
307-
"arn:aws:logs:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:log-group:aws-waf-logs-*"
309+
"arn:aws:logs:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:log-group:aws-waf-logs-*",
310+
"arn:aws:logs:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:log-group:/aws/stepfunctions/*"
308311
]
309312
},
310313
{
@@ -427,7 +430,11 @@ resource "aws_iam_policy" "api_infrastructure" {
427430
# State Machine
428431
"states:DescribeStateMachine",
429432
"states:ListStateMachineVersions",
430-
"states:ListTagsForResource"
433+
"states:ListTagsForResource",
434+
"states:ValidateStateMachineDefinition",
435+
"states:CreateStateMachine",
436+
"states:TagResource",
437+
"states:UpdateStateMachine",
431438
],
432439

433440

@@ -450,7 +457,8 @@ resource "aws_iam_policy" "api_infrastructure" {
450457
"arn:aws:events:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:rule/cloudwatch-alarm-state-change-to-splunk*",
451458
"arn:aws:wafv2:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:regional/webacl/*",
452459
"arn:aws:wafv2:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:regional/managedruleset/*",
453-
"arn:aws:states:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:stateMachine:SecretRotationWorkflow",
460+
"arn:aws:states:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:stateMachine:*",
461+
"arn:aws:events:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:rule/*"
454462
]
455463
},
456464
]

‎infrastructure/stacks/iams-developer-roles/iams_permissions_boundary.tf‎

Lines changed: 25 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -21,18 +21,15 @@ data "aws_iam_policy_document" "permissions_boundary" {
2121
# CloudWatch - monitoring and alarms
2222
"cloudwatch:PutMetricAlarm",
2323
"cloudwatch:DeleteAlarms",
24-
"cloudwatch:DescribeAlarms",
25-
"cloudwatch:DescribeAlarmsForMetric",
24+
"cloudwatch:DescribeAlarms*",
2625
"cloudwatch:ListTagsForResource",
2726
"cloudwatch:TagResource",
2827
"cloudwatch:UntagResource",
2928
"cloudwatch:GetDashboard",
3029
"cloudwatch:GetMetricWidgetImage",
3130

3231
# DynamoDB - table management
33-
"dynamodb:DescribeTimeToLive",
34-
"dynamodb:DescribeTable",
35-
"dynamodb:DescribeContinuousBackups",
32+
"dynamodb:Describe*",
3633
"dynamodb:ListTables",
3734
"dynamodb:DeleteTable",
3835
"dynamodb:CreateTable",
@@ -47,12 +44,10 @@ data "aws_iam_policy_document" "permissions_boundary" {
4744
"ec2:ModifyVpcBlockPublicAccessOptions",
4845
"ec2:CreateTags",
4946
"ec2:DeleteTags",
50-
"ec2:CreateNetworkAclEntry",
51-
"ec2:DeleteNetworkAclEntry",
52-
"ec2:CreateNetworkAcl",
53-
"ec2:DeleteNetworkAcl",
47+
"ec2:CreateNetworkAcl*",
48+
"ec2:DeleteNetworkAcl*",
5449
"ec2:AssociateRouteTable",
55-
"ec2:CreateVpc",
50+
"ec2:CreateVpc*",
5651
"ec2:ModifyVpcAttribute",
5752
"ec2:DeleteVpc",
5853
"ec2:CreateRouteTable",
@@ -62,7 +57,6 @@ data "aws_iam_policy_document" "permissions_boundary" {
6257
"ec2:RevokeSecurityGroupEgress",
6358
"ec2:AuthorizeSecurityGroupIngress",
6459
"ec2:AuthorizeSecurityGroupEgress",
65-
"ec2:CreateVpcEndpoint",
6660
"ec2:CreateFlowLogs",
6761
"ec2:ReplaceNetworkAclAssociation",
6862
"ec2:DeleteSecurityGroup",
@@ -93,13 +87,10 @@ data "aws_iam_policy_document" "permissions_boundary" {
9387
"firehose:StopDeliveryStreamEncryption",
9488

9589
# IAM - specific role and policy management
96-
"iam:GetRole",
97-
"iam:GetRolePolicy",
98-
"iam:GetPolicy",
99-
"iam:GetPolicyVersion",
100-
"iam:ListRoles",
90+
"iam:GetRole*",
91+
"iam:GetPolicy*",
92+
"iam:ListRole*",
10193
"iam:ListPolicies",
102-
"iam:ListRolePolicies",
10394
"iam:ListAttachedRolePolicies",
10495
"iam:ListPolicyVersions",
10596
"iam:CreateRole",
@@ -110,10 +101,8 @@ data "aws_iam_policy_document" "permissions_boundary" {
110101
"iam:PutRolePermissionsBoundary",
111102
"iam:AttachRolePolicy",
112103
"iam:DetachRolePolicy",
113-
"iam:CreatePolicy",
114-
"iam:CreatePolicyVersion",
115-
"iam:DeletePolicy",
116-
"iam:DeletePolicyVersion",
104+
"iam:CreatePolicy*",
105+
"iam:DeletePolicy*",
117106
"iam:TagRole",
118107
"iam:UntagPolicy",
119108
"iam:PassRole",
@@ -122,13 +111,9 @@ data "aws_iam_policy_document" "permissions_boundary" {
122111

123112
# KMS - encryption key management
124113
"kms:CreateKey",
125-
"kms:DescribeKey",
126114
"kms:Describe*",
127115
"kms:CreateAlias",
128-
"kms:ListKeys",
129116
"kms:List*",
130-
"kms:ListAliases",
131-
"kms:GetKeyPolicy",
132117
"kms:GetKeyPolicy*",
133118
"kms:GetKeyRotationStatus",
134119
"kms:DeleteAlias",
@@ -140,19 +125,15 @@ data "aws_iam_policy_document" "permissions_boundary" {
140125
"kms:ScheduleKeyDeletion",
141126
"kms:PutKeyPolicy",
142127
"kms:Encrypt",
143-
"kms:Decrypt",
144128
"kms:Decrypt*",
145129
"kms:ReEncrypt*",
146130
"kms:GenerateDataKey",
147131

148132
# Lambda - function management
149133
"lambda:CreateFunction",
150-
"lambda:UpdateFunctionCode",
151-
"lambda:UpdateFunctionConfiguration",
134+
"lambda:UpdateFunction*",
152135
"lambda:DeleteFunction",
153-
"lambda:GetFunction",
154-
"lambda:GetFunctionConfiguration",
155-
"lambda:GetFunctionCodeSigningConfig",
136+
"lambda:GetFunction*",
156137
"lambda:ListVersionsByFunction",
157138
"lambda:TagResource",
158139
"lambda:UntagResource",
@@ -171,44 +152,26 @@ data "aws_iam_policy_document" "permissions_boundary" {
171152
"lambda:PutProvisionedConcurrencyConfig",
172153
"lambda:DeleteProvisionedConcurrencyConfig",
173154
"lambda:ListProvisionedConcurrencyConfigs",
155+
"lambda:PutFunctionConcurrency",
174156

175157
# CloudWatch Logs - log management
176158
"logs:*",
177159

178160
# S3 - bucket and object management
179161
"s3:GetLifecycleConfiguration",
180162
"s3:PutLifecycleConfiguration",
181-
"s3:GetBucketVersioning",
182163
"s3:GetEncryptionConfiguration",
183164
"s3:PutEncryptionConfiguration",
184-
"s3:GetBucketPolicy",
185-
"s3:GetBucketObjectLockConfiguration",
186-
"s3:GetBucketLogging",
187165
"s3:GetReplicationConfiguration",
188-
"s3:GetBucketWebsite",
189-
"s3:GetBucketRequestPayment",
190-
"s3:GetBucketCORS",
191-
"s3:GetBucketAcl",
192-
"s3:PutBucketAcl",
193166
"s3:GetAccelerateConfiguration",
194167
"s3:ListBucket",
195-
"s3:GetObject",
196-
"s3:PutObject",
168+
"s3:GetObject*",
169+
"s3:PutObject*",
197170
"s3:DeleteObject",
198-
"s3:GetBucketLocation",
199-
"s3:GetBucketPublicAccessBlock",
200-
"s3:PutBucketCORS",
171+
"s3:GetBucket*",
201172
"s3:CreateBucket",
202173
"s3:DeleteBucket",
203-
"s3:GetBucketTagging",
204-
"s3:PutBucketPolicy",
205-
"s3:PutBucketVersioning",
206-
"s3:PutBucketPublicAccessBlock",
207-
"s3:PutBucketLogging",
208-
"s3:GetObjectTagging",
209-
"s3:PutObjectTagging",
210-
"s3:GetObjectVersion",
211-
"s3:PutBucketTagging",
174+
"s3:PutBucket*",
212175

213176
# SNS - notification management
214177
"sns:CreateTopic",
@@ -221,23 +184,20 @@ data "aws_iam_policy_document" "permissions_boundary" {
221184
"sns:UntagResource",
222185
"sns:Subscribe",
223186
"sns:Unsubscribe",
224-
"sns:ListSubscriptions",
225-
"sns:ListSubscriptionsByTopic",
187+
"sns:ListSubscriptions*",
226188
"sns:GetSubscriptionAttributes",
227189

228190
# SSM - parameter management
229191
"ssm:DescribeParameters",
230-
"ssm:GetParameter",
231-
"ssm:GetParameters",
192+
"ssm:GetParameter*",
232193
"ssm:ListTagsForResource",
233194
"ssm:PutParameter",
234195
"ssm:AddTagsToResource",
235196

236197
# WAFv2 - web application firewall management
237198
"wafv2:CreateWebACL",
238199
"wafv2:DeleteWebACL",
239-
"wafv2:GetWebACL",
240-
"wafv2:GetWebACLForResource",
200+
"wafv2:GetWebACL*",
241201
"wafv2:UpdateWebACL",
242202
"wafv2:ListWebACLs",
243203
"wafv2:TagResource",
@@ -255,7 +215,11 @@ data "aws_iam_policy_document" "permissions_boundary" {
255215
# State Machine management
256216
"states:DescribeStateMachine",
257217
"states:ListStateMachineVersions",
258-
"states:ListTagsForResource"
218+
"states:ListTagsForResource",
219+
"states:ValidateStateMachineDefinition",
220+
"states:CreateStateMachine",
221+
"states:TagResource",
222+
"states:UpdateStateMachine",
259223
]
260224

261225
resources = ["*"]

‎poetry.lock‎

Lines changed: 3 additions & 3 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/eligibility_signposting_api/common/api_error_response.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -128,7 +128,7 @@ def log_and_generate_response(
128128
fhir_display_message="An unexpected internal server error occurred.",
129129
)
130130

131-
NHS_NUMBER_MISMATCH_ERROR = APIErrorResponse(
131+
NHS_NUMBER_ERROR = APIErrorResponse(
132132
status_code=HTTPStatus.FORBIDDEN,
133133
fhir_issue_code=FHIRIssueCode.FORBIDDEN,
134134
fhir_issue_severity=FHIRIssueSeverity.ERROR,

0 commit comments

Comments
 (0)