Skip to content

eli-375 bugfix - casing on github variables and adding permissions for github actions #311

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
eddalmond1 merged 2 commits into from
Aug 27, 2025
Merged

eli-375 bugfix - casing on github variables and adding permissions for github actions #311

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
39ffd51
eli-375 bugfix - github secrets are in upper case, so need to assign …
eddalmond1 Aug 22, 2025
ef62168
adding permissions for github actions
eddalmond1 Aug 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions infrastructure/stacks/api-layer/ssm.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ resource "aws_ssm_parameter" "splunk_hec_token" {
description = "Splunk HEC token"
type = "SecureString"
key_id = aws_kms_key.splunk_hec_kms.id # Will migrate to customer key after initial creation
value = var.splunk_hec_token
value = var.SPLUNK_HEC_TOKEN
tier = "Advanced"

tags = {
Expand All @@ -78,7 +78,7 @@ resource "aws_ssm_parameter" "splunk_hec_endpoint" {
description = "Splunk HEC endpoint"
type = "SecureString"
key_id = aws_kms_key.splunk_hec_kms.id
value = var.splunk_hec_endpoint
value = var.SPLUNK_HEC_ENDPOINT
tier = "Advanced"

tags = {
Expand Down
4 changes: 2 additions & 2 deletions infrastructure/stacks/api-layer/variables.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
variable "splunk_hec_token" {
variable "SPLUNK_HEC_TOKEN" {
type = string
description = "The HEC token for ITOC splunk"
sensitive = true
}
variable "splunk_hec_endpoint" {
variable "SPLUNK_HEC_ENDPOINT" {
type = string
description = "The HEC endpoint url for ITOC splunk"
sensitive = true
Expand Down
29 changes: 25 additions & 4 deletions infrastructure/stacks/iams-developer-roles/github_actions_policies.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -170,8 +170,10 @@ resource "aws_iam_policy" "s3_management" {
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-truststore/*",
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-truststore-access-logs",
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-truststore-access-logs/*",
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-splunk-backup",
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-splunk-backup/*"
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-splunk",
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-splunk/*",
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-splunk-access-logs",
"arn:aws:s3:::*eligibility-signposting-api-${var.environment}-eli-splunk-access-logs/*"
]
}
]
Expand Down Expand Up @@ -304,6 +306,16 @@ resource "aws_iam_policy" "api_infrastructure" {
"acm:RequestCertificate",
"acm:AddTagsToCertificate",
"acm:ImportCertificate",

# eventbridge
"events:TagResource",
"events:PutRule",
"events:PutTargets",
"events:DescribeRule",
"events:ListTagsForResource",
"events:DeleteRule",
"events:ListTargetsByRule",
"events:RemoveTargets"
],


Expand All @@ -320,7 +332,9 @@ resource "aws_iam_policy" "api_infrastructure" {
"arn:aws:logs:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:log-group:/aws/apigateway/*",
"arn:aws:logs:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:log-group:NHSDAudit_trail_log_group*",
"arn:aws:ssm:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:parameter/${var.environment}/*",
"arn:aws:ssm:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:parameter/splunk/*",
"arn:aws:acm:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:certificate/*",
"arn:aws:events:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:rule/cloudwatch-alarm-state-change-to-splunk*",
]
},
]
Expand Down Expand Up @@ -436,7 +450,11 @@ resource "aws_iam_policy" "iam_management" {
# API role
"arn:aws:iam::*:role/*eligibility-signposting-api-role",
# Kinesis firehose role
"arn:aws:iam::*:role/eligibility_audit_firehose-role*"
"arn:aws:iam::*:role/eligibility_audit_firehose-role*",
# Eventbridge to firehose role
"arn:aws:iam::*:role/*-eventbridge-to-firehose-role*",
# Firehose splunk role
"arn:aws:iam::*:role/splunk-firehose-role"
]
}
]
Expand Down Expand Up @@ -495,7 +513,10 @@ resource "aws_iam_policy" "firehose_readonly" {
"firehose:StartDeliveryStreamEncryption",
"firehose:StopDeliveryStreamEncryption"
]
Resource = "arn:aws:firehose:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:deliverystream/eligibility-signposting-api*"
Resource = [
"arn:aws:firehose:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:deliverystream/eligibility-signposting-api*",
"arn:aws:firehose:${var.default_aws_region}:${data.aws_caller_identity.current.account_id}:deliverystream/splunk-alarm-events*"
]
}
]
})
Expand Down
1 change: 1 addition & 0 deletions infrastructure/stacks/iams-developer-roles/iams_permissions_boundary.tf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,6 +69,7 @@ data "aws_iam_policy_document" "permissions_boundary" {
"events:ListTargetsByRule",
"events:TagResource",
"events:UntagResource",
"events:ListTagsForResource",

# Kinesis Firehose - log streaming
"firehose:CreateDeliveryStream",
Expand Down